CPC H04L 63/1425 (2013.01) [G06F 15/76 (2013.01); G06F 17/18 (2013.01); G06F 18/2411 (2023.01); G06F 18/2413 (2023.01); G06N 3/08 (2013.01); G06N 5/01 (2023.01); G06N 20/00 (2019.01); G06N 20/10 (2019.01); G06N 20/20 (2019.01); H04L 41/0677 (2013.01); H04L 41/145 (2013.01); H04L 43/045 (2013.01); H04L 63/1441 (2013.01); G06N 3/02 (2013.01); G06N 5/04 (2013.01)] | 20 Claims |
1. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform the steps of:
receiving a machine learning model that is configured to detect anomalies in network devices operating in a multi-layer network, wherein the machine learning model is trained via unsupervised learning that includes training the machine learning model with unlabeled data that describes an operational status of the network devices over time, wherein the training builds a set of Probability Density Functions (PDFs), a likelihood function for each PDF, and a global likelihood function based on a product of each individual likelihood function, wherein the global likelihood function is a single multivariate function to describe a network component;
receiving live data related to a current operational status of the network devices;
analyzing the live data with the machine learning model; and
detecting an anomaly related to any of the network device based on the analyzing.
|