Abstract: Systems and methods for checking whether training data to be inputted into a training phase of a ML model is Independent and Identically Distributed data (IID data), and taking action based on that determination. One example of the present disclosure provides a method implemented by an edge node operating in a distributed swarm learning blockchain network. The method includes receiving a smart contract including a definition of conforming data and executing the smart contract including the definition of conforming data. The method further includes receiving one or more batches of training data for training a ML model. The method further includes checking whether each batch of training data conforms to the agreed-upon definition of conforming data, tagging and isolating non-conforming batches of training data, and inputting conforming batches of training data into a training phase of the machine learning model. The conforming batches of training data are IID data.

Abstract: A system and a method of classifying data and providing an accuracy of classification are described. The method includes determining values of statistical features associated with data packets present in a data stream. The values of statistical features are provided to a data model for producing a classification output including the data packets classified into one or more categories. While producing the classification output, the data model extracts heuristics for each of the values of statistical features, compares the heuristics with one or more conditional checks defined at each node within the data model, and determines a cumulative score based on results of the comparing. The cumulative score is determined by aggregating a score assigned to successful clearance of each conditional check. The cumulative score indicates an accuracy of the classification output.

Abstract: An example method includes recording, by a node out of a plurality of nodes, occurrence of one or more baseline node events, generating a statistical data corresponding to a recorded occurrence of the one or more baseline node events over a pre-determined period, comparing one or more subsequent node events with the statistical data, and communicating data corresponding to the one or more subsequent node events to the central control device, in response to determining that the one or more subsequent node events satisfy the event deviation threshold.

Abstract: Sessions are core components of communication between communicating systems, which may include, for example, a client device and a server. A network device can be used to monitor and analyze session information that is transmitted in a client-server communication. Visibility into the session information and the traffic flow of a network device is critical to improve the performance and security of the network device and the transmission of information in the client-server communication. A lack of visibility into the session information can reduce security, leading to viruses, malware, and malfunctions.

Abstract: A device may determine sample points associated with network routes within a network during a time interval, wherein each sample point that is associated with a respective network route comprises an amount of uptime for the respective network route during the time interval and a total frequency of state changes for the respective network route during the time interval. The device may generate, using an unsupervised machine learning mechanism, clusters of the sample points and may label the network routes with route stability labels based at least in part on the clusters. The device may generate, using a supervised machine learning mechanism, a route stability classifier based at least in part on the route stability labels for the network routes, and may determine, using the route stability classifier, a route stability of a new network route within the network.

Abstract: Systems and methods are provided for collecting data related to changes to a data store table, which may be used for analyzing problems that occur in the network. The information monitored may include types of changes made to a data store/table, such as insertions and deletions of data store elements. When an anomaly occurs in the statistical data store/table data, an alert is issued. This statistical data of the types of changes to a data store may be suggestive of similar changes in a network. For example, the uptime, inactive time, and stable time of rows of a data store table may be used for estimating or inferring the uptime, inactive time, and stable time for nodes, data paths, or other elements of a network. The system may include a web UI or a command line interface, which may aid in diagnosing problems in the network, and taking corrective action.

Abstract: An example method can include tracking, by a network device, a plurality of database operations performed and a plurality of expected database operations for an event that executes for a time period, generating, by the network device, a plurality of clusters based on a ratio of the database operations performed compared to the plurality of expected database operations and the time period for the event, classifying, by the network device, the clusters based on performance, and evaluating, by the network device, a system performance metric based on a classification of real time data into the clusters.

Abstract: Examples described herein relate to selectively forwarding traffic flows based on traffic flow classification. Examples include classifying a traffic flow into a first traffic class by a first machine learning (ML) model based on flow characteristics of the traffic flow. A second traffic class is determined based on a deviation between the flow characteristics of the traffic flow and average flow characteristics of each of the plurality of traffic classes. A quality metric for the first ML model is updated based on whether the first traffic class and the second traffic class match. The traffic flow is selectively forwarded based on the quality metric.

Abstract: Systems and methods are provided for implementing a distributed training by exchanging learnt parameters generated from unsupervised machine learning (ML) modeling. Each device in a distributed network may implement the unsupervised ML model to determine clusters of input data and/or determine a centroid of each determined cluster. The approximate centroid location of each cluster of data may be transmitted to other network devices in the local computing environment or other distributed computing environments. Each device may share their list of centroids of the clusters with other network devices (e.g., to implement swarm learning). These distributed network devices may compare the received centroids with centroids generated from a local ML model at each network device and initiate an action in response to the comparison.

Abstract: Systems and methods are provided for monitoring traffic flow using a trained machine learning (ML) model. For example, in order to maintain a stable level of connectivity and network experience for the devices in a network, the ML model can monitor the data flow of each device and label each data flow based on its behavior and properties. The system can take various actions based on the labeled data flow, including generate an alert, automatically change network settings, or otherwise adjust the data flow from the device.

Abstract: Sessions are core components of communication between communicating systems, which may include, for example, a client device and a server. A network device can be used to monitor and analyze session information that is transmitted in a client-server communication. Visibility into the session information and the traffic flow of a network device is critical to improve the performance and security of the network device and the transmission of information in the client-server communication. A lack of visibility into the session information can reduce security, leading to viruses, malware, and malfunctions.

Abstract: Systems and methods are provided for combining a multiple sub-time window sampling architecture with machine learning to detect outlier traffic flow behavior which may indicate malicious/problematic network activity. For example, a network device may obtain a sample of traffic flow data during a defined time window. The sample of traffic flow data may comprise information associated with a sampled subset of traffic flows transferred by a network device in the defined time window. The network device may partition the defined time window into two or more sub-time windows. In each sub-time window, using machine learning, the network device may assign an outlier-related classification to each sampled traffic flow based on the relative behavioral characteristics of all the sampled traffic flows. The network device may aggregate the outlier-related classifications for each sampled traffic flow across multiple sub-time windows, and process traffic flows based on the aggregated outlier-related classifications.

Abstract: Systems and methods are provided for implementing pattern detection as a first step for security improvements of a computer network. The pattern detection may utilize a machine learning (ML) model for predicting network tuple parameters. The ML model can be trained on labelled data flow information and deployed by a central server for preventing network-wide cyber-security challenges (e.g., including DNS flux, etc.). Networking devices (e.g. switches, etc.) can monitor the data flow traffic that it receives from the networking devices and classify network tuple parameters based on the flow behavior. The system can compare the output of the ML model (e.g., a classification of the data flow traffic, etc.) to an implicit label (e.g., the network tuple parameter included with the data flow traffic, etc.). When the classification matches a particular network tuple parameter, the system can generate an alert and/or otherwise identify potential network intrusions and other abnormalities.

Abstract: Systems and methods are provided for monitoring traffic flow using a trained machine learning (ML) model. For example, in order to maintain a stable level of connectivity and network experience for the devices in a network, the ML model can monitor the data flow of each device and label each data flow based on its behavior and properties. The system can take various actions based on the labeled data flow, including generate an alert, automatically change network settings, or otherwise adjust the data flow from the device.

Abstract: Systems and methods are provided for detecting changes in network activity that are depicted in a routing table. The routing table may be stored as a search tree data structure (e.g., Merkle Patricia Tree) to mimic a standard routing table and reduce the search time to find the desired route by allowing the router to traverse the search tree data structure more efficiently. Additionally, the metadata of the tree may be provided to an unstructured machine learning model (e.g., K-means) to identify new clusters of routes week-over-week and generate an alert with any changes. Changes are identified in near real time and dynamically at the router (not a central device) to reduce the time needed to respond to network changes.

Abstract: An example method can include tracking, by a network device, a plurality of attributes associated with a plurality of unique client device identifiers stored in a tracking table; deriving, by the network device, a training data set based on the plurality of attributes; and generating, by the network device, a plurality of clusters by inputting the derived training data set to an unsupervised machine learning mechanism. The example method can include receiving, by the network device, a labeling of the plurality of unique client device identifiers in the tracking table based at least on the plurality of clusters; generating, by the network device, a plurality of classifiers by inputting the labelled tracking table to a supervised machine learning mechanism; and classifying, by the network device, a new unique client device identifier in the tracking table based at least on the plurality of classifiers.

Abstract: Some examples relate to classifying IoT malware at a network device. An example includes receiving, by a network device, network traffic from an Internet of Things (IoT) device. Network device may analyze network parameters from the network traffic with a machine learning model. In response to analyzing, network device may classify the network traffic into a category of malware activity. Network device may determine an effectiveness of network traffic classification by measuring a deviation of the network parameters from previously trained network parameters that were used for training the machine learning model. In response to a determination that the deviation of the network parameters from the trained network parameters is more than a pre-defined threshold, network device may generate an alert highlighting the deviation, which allows a user to perform a remedial action pertaining to the IoT device.

Abstract: A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.

Abstract: An example method includes recording, by a node out of a plurality of nodes, occurrence of one or more baseline node events, generating a statistical data corresponding to a recorded occurrence of the one or more baseline node events over a pre-determined period, comparing one or more subsequent node events with the statistical data, and communicating data corresponding to the one or more subsequent node events to the central control device, in response to determining that the one or more subsequent node events satisfy the event deviation threshold.

Abstract: A system and a method of classifying data and providing an accuracy of classification are described. The method includes determining values of statistical features associated with data packets present in a data stream. The values of statistical features are provided to a data model for producing a classification output including the data packets classified into one or more categories. While producing the classification output, the data model extracts heuristics for each of the values of statistical features, compares the heuristics with one or more conditional checks defined at each node within the data model, and determines a cumulative score based on results of the comparing. The cumulative score is determined by aggregating a score assigned to successful clearance of each conditional check. The cumulative score indicates an accuracy of the classification output.