US 12,289,226 B2
Anomaly detection for network devices using intent-based analytics
Aleksei Slutckii, Saratov (RU); Diheng Qu, Palo Alto, CA (US); Chi Fung Michael Chan, Mountain View, CA (US); Atul Bhaskarrao Patil, San Ramon, CA (US); Georgy Savostyanov, Schiphol-Rijk (NL); and Ilia Kharin, Amsterdam (NL)
Assigned to Juniper Networks, Inc., Sunnyvale, CA (US)
Appl. No. 18/003,300
Filed by Juniper Networks, Inc., Sunnyvale, CA (US)
PCT Filed Jun. 22, 2022, PCT No. PCT/RU2022/000192
§ 371(c)(1), (2) Date Dec. 23, 2022,
PCT Pub. No. WO2023/249507, PCT Pub. Date Dec. 28, 2023.
Prior Publication US 2024/0275707 A1, Aug. 15, 2024
Int. Cl. H04L 43/50 (2022.01); H04L 41/22 (2022.01); H04L 43/062 (2022.01)
CPC H04L 43/50 (2013.01) [H04L 41/22 (2013.01); H04L 43/062 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system comprising:
memory; and
one or more processors coupled to the memory;
wherein the memory stores instructions that, when executed, cause the one or more processors to:
determine, based on one or more operating characteristics indicated in a time series of telemetry data received from a plurality of network devices of a network, a threshold for a parameter of the plurality of network devices, the one or more operating characteristics comprising one or more of a temperature of the plurality of network devices, a voltage level of the plurality of network devices, a power consumption of the plurality of network devices, or a current draw level of the plurality of network devices;
to based on receiving an indication that an instant value of a particular network device of the plurality of network devices does not satisfy the determined threshold for the parameter of the plurality of network devices, determine that an anomaly has occurred at the particular network device;
based on determining that the anomaly has occurred at the particular network device, generate first data for a first time period that occurs before the anomaly occurs, second data for a second time period corresponding to when the anomaly occurs, and third data for a third time period that occurs after the anomaly occurs;
generate, based on the first data, the second data, and the third data, data representing a user interface; and
output, for display, the data representing the user interface.