Abstract: Techniques are described for identifying root cause anomalies in time series. Information to be used for root cause analysis (RCA) is obtained from a graph neural network (GNN) and is used to construct a dependency graph having nodes corresponding to each time series and directed edges corresponding to dependencies between the time series. Nodes corresponding to time series that do not contain anomalies may be removed from this dependency graph, as well as edges connected to these nodes. This edge and node removal may result in the creation of one or more sub-graphs from the dependency graph. A root cause analysis algorithm may be run on these one or more sub-graphs to create a root cause graph for each sub-graph. These root cause graphs may then be used to identify root cause anomalies within the multiple time series, as well as sequences of anomalies within the multiple time series.

Abstract: The present disclosure generally relates to systems and methods for operation research optimization. The systems and methods include receiving, at a data processing system, a payload including a request for optimizing a service and processing the payload using a meta learning classifier. The processing includes extracting a problem and use case characteristics from the payload, predicting at least one machine learning model capable of solving the problem having the use case characteristics, and executing the at least one machine learning model to solve the problem. The systems and methods also include outputting a solution to the problem for optimizing the service from the at least one machine learning model, and providing the solution to a computing device.

Abstract: A time series forecasting system is disclosed that obtains a time series forecast request requesting a forecast for a particular time point. The forecast request identifies a primary time series dataset for generating the requested forecast and a set of features related to the primary time series dataset. The system provides the primary time series dataset and the set of features to a model to be used for generating the forecast. The model computes a feature importance score for one or more features and selects a subset of features based on their feature importance scores. The model determines attention scores for a set of data points in the primary time series dataset based on the selected subset of features. The system predicts an actual forecast for the particular time point based on the attention scores and outputs the actual forecast and explanation information associated with the actual forecast.

Abstract: Systems, methods, and other embodiments associated with autonomous discrimination of operation vibration signals are described herein. In one embodiment, a method includes automatically choosing a plurality of vibration frequencies that vary in correlation with variation of a load on a monitored device. Vibration amplitudes for the plurality of vibration frequencies are monitored for incipient failure using a machine learning model. The machine learning model is trained to expect the vibration amplitudes to be consistent with undegraded operation of the monitored device. The incipient failure is detected where vibration amplitudes are not consistent with undegraded operation of the monitored device. An alert is then transmitted to suggest maintenance to prevent the incipient failure of the monitored device.

Abstract: Embodiments of the present disclosure discloses a method, an apparatus and a system for securing Network Functions (NFs) in a disaggregated network. The apparatus receives metrics and events related to one or more Network functions from an agent deployed in a host system. The apparatus validates the metrics and events by comparing with reference metrics and events. Further, the apparatus detects a threat in the disaggregated network based on the validation and performs one or more actions. The proposed solution helps in detecting an attack that originates from within a host machine of the disaggregated network, isolate the rogue NF and perform actions to protect the rest of the disaggregated network.

Abstract: A computing device may access a graph comprising one or more model nodes, one or more dataset nodes, and one or more edges, the model nodes having a plurality of features. The device may add one or more test dataset nodes and test edges to the graph. The device may perform a series of iterative steps until a threshold is reached. For each iterative step: a selection probability is determined, the selection probability being based at least in part on a plurality of selection criteria; a particular model node is selected, the particular model node being selected based at least in part on the selection probability; the selection criteria is updated based at least in part on the particular model; and the plurality of features are updated based at least in part on the particular model. The device may provide the particular model node selected in the last iterative step.

Abstract: Systems, methods, and other embodiments associated with autonomous discrimination of operation vibration signals are described herein. In one embodiment, a method includes partitioning a frequency spectrum of output into a plurality of discrete bins, wherein the output is collected from vibration sensors monitoring a reference device; generating a representative time series signal for each bin while the device is operated in a deterministic stress load; generating a PSD for each bin by converting each signal from the time domain to the frequency domain; determining a maximum power spectral density value and a peak frequency value for each bin; selecting a subset of the bins that have maximum PSD values exceeding a threshold; assigning the representative time series signals from the selected subset of bins as operation vibration signals indicative of operational load on the reference device; and configuring a machine learning model based on at least the operation vibration signals.

Abstract: Systems, methods, and other embodiments associated with autonomous discrimination of operation vibration signals are described herein. In one embodiment, a method includes partitioning a frequency spectrum of output into a plurality of discrete bins, wherein the output is collected from vibration sensors monitoring a reference device; generating a representative time series signal for each bin while the device is operated in a deterministic stress load; generating a PSD for each bin by converting each signal from the time domain to the frequency domain; determining a maximum power spectral density value and a peak frequency value for each bin; selecting a subset of the bins that have maximum PSD values exceeding a threshold; assigning the representative time series signals from the selected subset of bins as operation vibration signals indicative of operational load on the reference device; and configuring a machine learning model based on at least the operation vibration signals.

Abstract: Systems, methods, and other embodiments associated with passive inferencing of signal following in multivariate anomaly detection are described. In one embodiment, a method for inferencing signal following in a machine learning (ML) model includes calculating an average standard deviation of measured values of time series signals in a set of time series signals; training the ML model to predict values of the signals; predicting values of each of the signals with the trained ML model; generating a time series set of residuals between the predicted values and the measured values; calculating an average standard deviation of the sets of residuals; determining that signal following is present in the trained ML model where a ratio of the average standard deviation of measured values to the average standard deviation of the sets of residuals exceeds a threshold; and presenting an alert indicating the presence of signal following in the trained ML model.

Abstract: The disclosed embodiments relate to a system that optimizes a prognostic-surveillance system to achieve a user-selectable functional objective. During operation, the system allows a user to select a functional objective to be optimized from a set of functional objectives for the prognostic-surveillance system. Next, the system optimizes the selected functional objective by performing Monte Carlo simulations, which vary operational parameters for the prognostic-surveillance system while the prognostic-surveillance system operates on synthesized signals, to determine optimal values for the operational parameters that optimize the selected functional objective.

Abstract: The disclosed embodiments relate to a system that produces anomaly-free training data to facilitate ML-based prognostic surveillance operations. During operation, the system receives a dataset comprising time-series signals obtained from a monitored system during normal, but not necessarily fault-free operation of the monitored system. Next, the system divides the dataset into subsets. The system then identifies subsets that contain anomalies by training one or more inferential models using combinations of the subsets, and using the one or more trained inferential models to detect anomalies in other target subsets of the dataset. Finally, the system removes any identified subsets from the dataset to produce anomaly-free training data.

Abstract: Consistent with embodiments of the present disclosure, systems and methods are disclosed for providing per-group ECMP for multidestination traffic in a DCE/TRILL network. Embodiments enable per-group load balancing of multidestination traffic in DCE/L2MP networks by creating a new IS-IS PDU to convey the affinity of the parent node for a given multicast group. For broadcast and unknown unicast flooded traffic, the load balancing may be done on a per-vlan basis.

Abstract: Consistent with embodiments of the present disclosure, systems and methods are disclosed for providing per-group ECMP for multidestination traffic in a DCE/TRILL network. Embodiments enable per-group load balancing of multidestination traffic in DCE/L2MP networks by creating a new IS-IS PDU to convey the affinity of the parent node for a given multicast group. For broadcast and unknown unicast flooded traffic, the load balancing may be done on a per-vlan basis.

Abstract: Consistent with embodiments of the present disclosure, systems and methods are disclosed for providing per-group ECMP for multidestination traffic in a DCE/TRILL network. Embodiments enable per-group load balancing of multidestination traffic in DCE/L2MP networks by creating a new IS-IS PDU to convey the affinity of the parent node for a given multicast group. For broadcast and unknown unicast flooded traffic, the load balancing may be done on a per-vlan basis.

Abstract: Certain embodiments of the present disclosure generally relate to allocating a sub-area of Fiber Channel addresses (FCIDs) to a device. A range of addresses may be assigned to the device using a mask address, where the most significant bits represent a mask and the least significant bits represent a sub-range of FCIDs available to be assigned to the device. Therefore, routing information may be stored efficiently in a Ternary Content Addressable Memory (TCAM) by storing a single entry in the TCAM for each sub-area of FCIDs allocated to a device, instead of storing an entry for each FCID. The single entry may indicate the mask address and the width of the mask.

Abstract: Consistent with embodiments of the present disclosure, systems and methods are disclosed for providing per-group ECMP for multidestination traffic in a DCE/TRILL network. Embodiments enable per-group load balancing of multidestination traffic in DCE/L2MP networks by creating a new IS-IS PDU to convey the affinity of the parent node for a given multicast group. For broadcast and unknown unicast flooded traffic, the load balancing may be done on a per-vlan basis.

Abstract: Techniques are described which facilitate multi-destination forwarding in a Layer 2 Multipath (L2MP) network which includes an emulated switch. The emulated switch may correspond to two or more underlying peer link switches in the L2MP network, in which each of the peer link switches is linked to a Classical Ethernet (CE) switch over a virtual port channel (vPC). Traffic received by one of the peer link switches over the vPC is automatically forwarded to the other peer link switch (or switches). Multi-destination frames originating from the L2MP network addressed to hosts within the CE network are sent over only one of the peer link switches.

Abstract: An example method is provided and can include initiating a probe session at a source network element; identifying multiple paths from the source network element to a destination network element in a network; transmitting packets from the source network element along the multiple paths; compiling a list of network characteristics associated with the multiple paths; and selecting a particular one of the multiple paths for packet routing based on the network characteristics.

Abstract: In one embodiment, a method includes identifying a current topology associated with a virtual local area network (VLAN) and determining whether the current topology of the VLAN is to be moved to a base topology associated with a Transparent Interconnection of Lots of Links (TRILL) protocol. The method also includes moving the current topology of the VLAN to the base topology if it is determined that the current topology of the VLAN is to be moved to the base topology.

Abstract: In one embodiment, a method includes establishing a link between two N_Port Identifier Virtualization (NPIV) switches, the link having a high cost assigned thereto. The NPIV switches are in communication with a plurality of hosts through an N_Port Virtualization (NPV) device. The method further includes receiving at a first of the NPIV switches, an indication of a failure at a second of the NPIV switches, receiving data at the first NPIV switch, the data destined for one of the hosts associated with a domain of the second NPIV switch, and forwarding the data to the NPV device for delivery to the host, wherein a Fibre Channel Identifier (FCID) of the host is the same before and after the failure at the second NPIV switch. An apparatus is also disclosed.