US 11,792,217 B2
Systems and methods to detect abnormal behavior in networks
David Côté, Gatineau (CA); Merlin Davies, Montréal (CA); Olivier Simard, Montréal (CA); Emil Janulewicz, Ottawa (CA); and Thomas Triplet, Manotick (CA)
Assigned to Ciena Corporation, Hanover, MD (US)
Filed by Ciena Corporation, Hanover, MD (US)
Filed on Mar. 14, 2022, as Appl. No. 17/694,222.
Application 17/694,222 is a continuation of application No. 15/896,380, filed on Feb. 14, 2018, granted, now 11,277,420, issued on Mar. 15, 2022.
Claims priority of provisional application 62/463,060, filed on Feb. 24, 2017.
Prior Publication US 2022/0210176 A1, Jun. 30, 2022
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01); H04L 43/045 (2022.01); H04L 41/14 (2022.01); G06F 17/18 (2006.01); G06N 20/00 (2019.01); H04L 41/0677 (2022.01); G06F 15/76 (2006.01); G06N 3/08 (2023.01); G06N 20/20 (2019.01); G06N 20/10 (2019.01); G06F 18/2411 (2023.01); G06F 18/2413 (2023.01); G06N 5/01 (2023.01); G06N 3/02 (2006.01); G06N 5/04 (2023.01)
CPC H04L 63/1425 (2013.01) [G06F 15/76 (2013.01); G06F 17/18 (2013.01); G06F 18/2411 (2023.01); G06F 18/2413 (2023.01); G06N 3/08 (2013.01); G06N 5/01 (2023.01); G06N 20/00 (2019.01); G06N 20/10 (2019.01); G06N 20/20 (2019.01); H04L 41/0677 (2013.01); H04L 41/145 (2013.01); H04L 43/045 (2013.01); H04L 63/1441 (2013.01); G06N 3/02 (2013.01); G06N 5/04 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform the steps of:
receiving a machine learning model that is configured to detect anomalies in network devices operating in a multi-layer network, wherein the machine learning model is trained via unsupervised learning that includes training the machine learning model with unlabeled data that describes an operational status of the network devices over time, wherein the training builds a set of Probability Density Functions (PDFs), a likelihood function for each PDF, and a global likelihood function based on a product of each individual likelihood function, wherein the global likelihood function is a single multivariate function to describe a network component;
receiving live data related to a current operational status of the network devices;
analyzing the live data with the machine learning model; and
detecting an anomaly related to any of the network device based on the analyzing.