Network Anomaly Detection Using Multi-Network Telemetry Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network assurance services face challenges in detecting anomalies in new networks due to the need for a sufficient training dataset, leading to 'cold start' scenarios where anomaly detection is delayed, and applying pre-existing anomaly detectors can result in poor performance due to differences in network behavior.
Innovation Solution
A network assurance service computes similarity scores between telemetry data from a new network and existing networks to select a machine learning-based anomaly detector trained on the most similar dataset, allowing for initial anomaly detection until sufficient data is collected for training a custom detector.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a custom anomaly detector is trained on a new network's telemetry data, then detection accuracy is improved, but the time required to collect sufficient training data increases the cold start period
Solution Approach 1:
The system performs preliminary actions by pre-training anomaly detectors on telemetry data from multiple existing networks before a new network needs monitoring. These pre-trained detectors are stored and can be immediately applied to a new network, eliminating the cold start waiting period while maintaining detection accuracy through subsequent retraining with the new network's data
2Loss of time
If a pre-existing anomaly detector is applied to a new network, then the cold start period is reduced, but detection performance deteriorates due to differences in network behavior
Solution Approach 1:
The system implements dynamic adaptation by continuously retraining the anomaly detector with telemetry data from the new network after initial deployment. The detector transitions from a static pre-trained model to a dynamic system that evolves and adapts to the specific characteristics of the new network, improving detection accuracy over time while maintaining immediate operational capability
Solution Approach 2:
The anomaly detector performs self-service by automatically retraining itself using the telemetry data it collects from the new network. This self-retraining process allows the detector to improve its performance specific to the new network's behavior patterns without requiring external intervention or manual reconfiguration
3Measurement precision
If multiple anomaly detectors are maintained for different networks, then detection accuracy for each network is improved, but system complexity increases
Solution Approach 1:
The system achieves universality by creating anomaly detectors that can serve multiple networks. A single detector can be trained on data from one network and then applied to monitor other networks with similar characteristics, allowing the same detector to perform multiple functions across different networks and reducing the total number of detectors needed
4Adaptability or versatility
If telemetry data is collected from multiple networks for training, then detector adaptability is improved, but data processing complexity increases
Solution Approach 1:
The system applies parameter changes by transforming and normalizing telemetry data from multiple networks into a unified format with consistent parameters. This standardization process adjusts the data parameters across different networks to be comparable, enabling the detector to learn from diverse sources while simplifying the processing complexity through parameter harmonization
Data Source
AI summary
In one embodiment, a network assurance service receives a first set of telemetry data captured in a first network monitored by the network assurance service. The network assurance service computes, for each of a plurality of other networks monitored by the service, a similarity score between the first set of telemetry data and a set of telemetry data captured in that other network. The service selects a machine learning-based anomaly detector trained using a particular one of the sets of telemetry data captured in one of the plurality of other networks, based on the computed similarity score between the first set of telemetry data and the particular set of telemetry data captured in one of the plurality of other networks. The service uses the selected anomaly detector to assess telemetry data from the first network, until the service has received a threshold amount of telemetry data for the first network.