Patents by Inventor Grégory Mermoud

Grégory Mermoud has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Publication number: 20190138938
    Abstract: In one embodiment, a service receives relevancy feedback regarding anomalies detected in a network by one or more unsupervised learning-based anomaly detectors. The service generates a set of rules based on those of the anomalies deemed relevant by the relevancy feedback. The service uses the set of rules to trigger collection of data features from the network. The service trains a supervised learning-based classifier using the data features collected from the network.
    Type: Application
    Filed: November 6, 2017
    Publication date: May 9, 2019
    Inventors: Jean-Philippe Vasseur, Grégory Mermoud, Vinay Kumar Kolar
  • Patent number: 10277476
    Abstract: In one embodiment, a predictive model is constructed by mapping multiple network characteristics to multiple network performance metrics. Then, a network performance metric pertaining to a node in a network is predicted based on the constructed predictive model and one or more network characteristics relevant to the node. Also, a local parameter of the node is optimized based on the predicted network performance metric.
    Type: Grant
    Filed: January 27, 2014
    Date of Patent: April 30, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Sukrit Dasgupta
  • Publication number: 20190114245
    Abstract: In one embodiment, a node in a network reports, to a supervisory service, histograms of application-specific throughput metrics measured from the network. The node receives, from the supervisory service, a merged histogram of application-specific throughput metrics. The supervisory service generated the merged histogram based on a plurality of histograms reported to the supervisory service by a plurality of nodes. The node performs, using the merged histogram, application throughput anomaly detection on traffic in the network. The node causes performance of a mitigation action in the network when an application throughput anomaly is detected. The node adjusts, based on a control command sent by the supervisory service, a histogram reporting strategy used by the node to report the histograms of application-specific throughput metrics to the supervisory service.
    Type: Application
    Filed: October 12, 2017
    Publication date: April 18, 2019
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Pierre-André Savalle
  • Patent number: 10243980
    Abstract: In one embodiment, a device in a network receives an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network. The device receives labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate scanning activity. The device trains a machine learning-based classifier using the labeled traffic data to distinguish between legitimate and illegitimate scanning activity in the network. The device deploys the trained classifier to the first node, to distinguish between legitimate and illegitimate scanning activity in the network.
    Type: Grant
    Filed: July 8, 2016
    Date of Patent: March 26, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Jean-Philippe Vasseur, Grégory Mermoud, Pierre-André Savalle, Alexandre Honoré
  • Publication number: 20190089599
    Abstract: In one embodiment, a service identifies a performance issue exhibited by a first device in a first network. The service forms a set of one or more time series of one or more characteristics of the first device associated with the identified performance issue. The service generates a mapping between the set of one or more time series of one or more characteristics of the first device to one or more time series of one or more characteristics of a second device in a second network. The mapping comprises a relevancy score that quantifies a degree of similarity between the characteristics of the first and second devices. The service determines a likelihood of the second device exhibiting the performance issue based on the generated mapping and on the relevancy score. The service provides an indication of the determined likelihood to a user interface associated with the second network.
    Type: Application
    Filed: September 15, 2017
    Publication date: March 21, 2019
    Inventors: Pierre-André Savalle, Grégory Mermoud, Jean-Philippe Vasseur
  • Publication number: 20190081973
    Abstract: In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model. The device provides an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models.
    Type: Application
    Filed: November 14, 2018
    Publication date: March 14, 2019
    Inventors: Pierre-André Savalle, Grégory Mermoud, Laurent Sartran, Jean-Philippe Vasseur
  • Patent number: 10220167
    Abstract: In one embodiment, a device in a network detects an anomaly in the network by analyzing a set of sample data regarding one or more conditions of the network using a behavioral analytics model. The device receives feedback regarding the detected anomaly. The device determines that the anomaly was a true positive based on the received feedback. The device excludes the set of sample data from a training set for the behavioral analytics model, in response to determining that the anomaly was a true positive.
    Type: Grant
    Filed: June 13, 2016
    Date of Patent: March 5, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Pierre-André Savalle
  • Publication number: 20190068474
    Abstract: In one embodiment, a service in a network samples application traffic throughputs for a set of applications present in a network. The service generates a throughput model based on the sampled application throughputs for the set of applications. The service performs anomaly detection on wireless throughput measurements from the network by comparing the wireless throughput measurements to the generated throughput model. The service sends an anomaly detection notification based on a determination that the wireless throughput measurements from the network are anomalous.
    Type: Application
    Filed: August 22, 2017
    Publication date: February 28, 2019
    Inventors: Jean-Philippe Vasseur, Grégory Mermoud, Abhishek Kumar
  • Patent number: 10218726
    Abstract: In one embodiment, a networking device in a network causes formation of device clusters of devices in the network. The devices in a particular cluster exhibit similar characteristics. The networking device receives feedback from a device identity service regarding the device clusters. The feedback is based in part on the device identity service probing the devices. The networking device adjusts the device clusters based on the feedback from the device identity service. The networking device performs anomaly detection in the network using the adjusted device clusters.
    Type: Grant
    Filed: June 13, 2016
    Date of Patent: February 26, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Jean-Philippe Vasseur, Grégory Mermoud, Pierre-André Savalle, Andrea Di Pietro, Sukrit Dasgupta
  • Patent number: 10212044
    Abstract: In one embodiment, a device in a network maintains a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network. The device applies sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model. The decomposition of the particular state vector comprises a plurality of basis vectors. The device determines a mapping between at least one of the plurality of basis vectors for the particular state vector and one or more human-readable interpretations of the basis vectors. The device provides a label for the particular state vector to a user interface. The label is based on the mapping between the at least one of the plurality of basis vectors for the particular state vector and the one or more human-readable interpretations of the basis vectors.
    Type: Grant
    Filed: March 23, 2017
    Date of Patent: February 19, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Pierre-André Savalle, Jean-Philippe Vasseur, Javier Cruz Mota
  • Patent number: 10193912
    Abstract: In one embodiment, a device in a network loads an anomaly detection model for warm-start. The device filters input data for the model during a warm-start grace period after warm-start of the anomaly detection model. The model is not updated during the warm-start grace period based on the filtering. The device determines an end to the warm-start grace period. The device updates the anomaly detection model using unfiltered input data for the anomaly detection model after the determined end to the warm-start grace period.
    Type: Grant
    Filed: February 24, 2016
    Date of Patent: January 29, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Pierre-André Savalle
  • Publication number: 20190028909
    Abstract: In one embodiment, a device receives network metrics regarding networking equipment of a network in a physical location. The device predicts a health status score for the networking equipment in the physical location using the received network metrics as input to a machine learning-based predictive scoring model. The device provides an indication of the predicted health status score in conjunction with a visualization of the physical location for display by an electronic display. The device adjusts the predictive scoring model based on feedback regarding the predicted health status score.
    Type: Application
    Filed: July 20, 2017
    Publication date: January 24, 2019
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur
  • Patent number: 10187413
    Abstract: In one embodiment, a supervisory device in a network receives traffic data from a security device that uses traffic signatures to assess traffic in the network. The supervisory device receives traffic data from one or more distributed learning agents that use machine learning-based anomaly detection to assess traffic in the network. The supervisory device trains a traffic classifier using the received traffic data from the security device and from the one or more distributed learning agents. The supervisory device deploys the traffic classifier to a selected one of the one or more distributed learning agents.
    Type: Grant
    Filed: July 18, 2016
    Date of Patent: January 22, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Jean-Philippe Vasseur, Andrea Di Pietro, Grégory Mermoud, Fabien Flacher
  • Patent number: 10182066
    Abstract: In one embodiment, a device in a network analyzes data indicative of a behavior of a network using a supervised anomaly detection model. The device determines whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data. The device trains an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.
    Type: Grant
    Filed: November 2, 2017
    Date of Patent: January 15, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Fabien Flacher, Grégory Mermoud, Jean-Philippe Vasseur, Sukrit Dasgupta
  • Patent number: 10171332
    Abstract: In one embodiment, network information associated with a plurality of nodes in a network is received at a device in a network. From the plurality of nodes, a node is selected based on a determination that the selected node is an outlier among the plurality of nodes according to the received network information. Then, a probe is sent to the selected node, and in response to the probe, a performance metric is received from the selected node at the device.
    Type: Grant
    Filed: June 22, 2017
    Date of Patent: January 1, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Diane Bouchacourt
  • Patent number: 10164991
    Abstract: In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model. The device provides an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models.
    Type: Grant
    Filed: June 8, 2016
    Date of Patent: December 25, 2018
    Assignee: Cisco Technology, Inc.
    Inventors: Pierre-André Savalle, Grégory Mermoud, Laurent Sartran, Jean-Philippe Vasseur
  • Publication number: 20180365581
    Abstract: In one embodiment, a service uses a set of collected characteristics of a client device in a network as input to a machine learning-based model that predicts a quality score for an online conference in which the client device is a participant. The service determines a resource consumption by the client device or the network that is associated with collecting the characteristics of the client device. The service determines an efficacy of the machine learning-based model as a function of the set of collected characteristics of the client device. The service adjusts the set of collected characteristics of the client device to optimize the efficacy of the model and the resource consumption associated with collecting the characteristics of the client device.
    Type: Application
    Filed: September 14, 2017
    Publication date: December 20, 2018
    Inventors: Jean-Philippe Vasseur, Grégory Mermoud, Pierre-André Savalle, Javier Cruz Mota
  • Publication number: 20180367428
    Abstract: In one embodiment, a device receives health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer. The device maintains a performance model for the data source that models the health of the data source. The device computes a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source. The device adjusts, based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.
    Type: Application
    Filed: June 19, 2017
    Publication date: December 20, 2018
    Inventors: Andrea Di Pietro, Grégory Mermoud, Jean-Philippe Vasseur, Sukrit Dasgupta
  • Publication number: 20180359648
    Abstract: In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the vertices of the access point graph and represents transitions between access points in the network performed by the particular client. The device identifies a transition pattern from the client trajectories by deconstructing the trajectory subgraphs. The device uses the identified transition pattern to effect a configuration change in the network.
    Type: Application
    Filed: June 8, 2017
    Publication date: December 13, 2018
    Inventors: Pierre-André Savalle, Grégory Mermoud, Jean-Philippe Vasseur, Javier Cruz Mota
  • Publication number: 20180359651
    Abstract: In one embodiment, a device receives observed access point (AP) features of one or more APs in a monitored network. The device clusters the observed AP features within a latent space to form AP feature clusters. The device applies labels to the AP feature clusters within the latent space. The device uses the applied labels to the AP feature clusters to describe future behaviors of the one or more APs in the monitored network.
    Type: Application
    Filed: June 12, 2017
    Publication date: December 13, 2018
    Inventors: Javier Cruz Mota, Jean-Philippe Vasseur, Pierre-André Savalle, Grégory Mermoud