Patents by Inventor Pierre-André Savalle

Pierre-André Savalle has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Patent number: 10440577
    Abstract: In one embodiment, a device classification service receives a first set of telemetry data captured by one or more networking devices in a network regarding traffic associated with an endpoint device in the network. The service classifies the endpoint device as being of an unknown device type, by applying a machine learning-based classifier to the first set of telemetry data. The service instructs the one or more networking devices in the network to reset a finite state machine (FSM) of the traffic associated with the endpoint device. The device classification service receives a second set of telemetry data regarding traffic associated with the endpoint device and captured after reset of the FSM. The service reclassifies the endpoint device as being of a particular device type, by applying the machine learning-based classifier to the second set of telemetry data.
    Type: Grant
    Filed: November 8, 2018
    Date of Patent: October 8, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Jean-Philippe Vasseur, Pierre-André Savalle, Grégory Mermoud
  • Patent number: 10404728
    Abstract: In one embodiment, a device in a network receives traffic records indicative of network traffic between different sets of host address pairs. The device identifies one or more address grouping constraints for the sets of host address pairs. The device determines address groups for the host addresses in the sets of host address pairs based on the one or more address grouping constraints. The device provides an indication of the address groups to an anomaly detector.
    Type: Grant
    Filed: September 13, 2016
    Date of Patent: September 3, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Laurent Sartran, Sébastien Gay, Pierre-André Savalle, Grégory Mermoud, Jean-Philippe Vasseur
  • Patent number: 10404727
    Abstract: In one embodiment, a networking device at an edge of a network generates a first set of feature vectors using information regarding one or more characteristics of host devices in the network. The networking device forms the host devices into device clusters dynamically based on the first set of feature vectors. The networking device generates a second set of feature vectors using information regarding traffic associated with the device clusters. The networking device models interactions between the device clusters using a plurality of anomaly detection models that are based on the second set of feature vectors.
    Type: Grant
    Filed: June 8, 2016
    Date of Patent: September 3, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Jean-Philippe Vasseur, Sébastien Gay, Grégory Mermoud, Pierre-André Savalle, Alexandre Honoré, Fabien Flacher
  • Publication number: 20190268784
    Abstract: In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the vertices of the access point graph and represents transitions between access points in the network performed by the particular client. The device identifies a transition pattern from the client trajectories by deconstructing the trajectory subgraphs. The device uses the identified transition pattern to effect a configuration change in the network.
    Type: Application
    Filed: May 8, 2019
    Publication date: August 29, 2019
    Inventors: Pierre-André Savalle, Grégory Mermoud, Jean-Philippe Vasseur, Javier Cruz Mota
  • Patent number: 10389741
    Abstract: In one embodiment, a device in a network identifies a new interaction between two or more nodes in the network. The device forms a feature vector using contextual information associated with the new interaction between the two or more nodes. The device causes generation of an anomaly detection model for new node interactions using the feature vector. The device uses the anomaly detection model to determine whether a particular node interaction in the network is anomalous.
    Type: Grant
    Filed: May 24, 2016
    Date of Patent: August 20, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Pierre-André Savalle, Laurent Sartran, Jean-Philippe Vasseur, Grégory Mermoud
  • Patent number: 10346277
    Abstract: In one embodiment, a node in a network reports, to a supervisory service, histograms of application-specific throughput metrics measured from the network. The node receives, from the supervisory service, a merged histogram of application-specific throughput metrics. The supervisory service generated the merged histogram based on a plurality of histograms reported to the supervisory service by a plurality of nodes. The node performs, using the merged histogram, application throughput anomaly detection on traffic in the network. The node causes performance of a mitigation action in the network when an application throughput anomaly is detected. The node adjusts, based on a control command sent by the supervisory service, a histogram reporting strategy used by the node to report the histograms of application-specific throughput metrics to the supervisory service.
    Type: Grant
    Filed: October 12, 2017
    Date of Patent: July 9, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Pierre-André Savalle
  • Patent number: 10341885
    Abstract: In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the vertices of the access point graph and represents transitions between access points in the network performed by the particular client. The device identifies a transition pattern from the client trajectories by deconstructing the trajectory subgraphs. The device uses the identified transition pattern to effect a configuration change in the network.
    Type: Grant
    Filed: June 8, 2017
    Date of Patent: July 2, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Pierre-André Savalle, Grégory Mermoud, Jean-Philippe Vasseur, Javier Cruz Mota
  • Patent number: 10318887
    Abstract: In one embodiment, a device in a network identifies a plurality of applications from observed traffic in the network. The device forms two or more application clusters from the plurality of applications. Each of the application clusters includes one or more of the applications, and wherein a particular application in the plurality of applications is included in each of the application clusters. The device generates anomaly detection models for each of the application clusters. The device tests the anomaly detection models, to determine a measure of efficacy for each of the models with respect to traffic associated with the particular application. The device selects a particular anomaly detection model to analyze the traffic associated with the particular application based on the measures of efficacy for each of the models.
    Type: Grant
    Filed: June 21, 2016
    Date of Patent: June 11, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Jean-Philippe Vasseur, Pierre-André Savalle, Alexandre Honoré
  • Publication number: 20190114245
    Abstract: In one embodiment, a node in a network reports, to a supervisory service, histograms of application-specific throughput metrics measured from the network. The node receives, from the supervisory service, a merged histogram of application-specific throughput metrics. The supervisory service generated the merged histogram based on a plurality of histograms reported to the supervisory service by a plurality of nodes. The node performs, using the merged histogram, application throughput anomaly detection on traffic in the network. The node causes performance of a mitigation action in the network when an application throughput anomaly is detected. The node adjusts, based on a control command sent by the supervisory service, a histogram reporting strategy used by the node to report the histograms of application-specific throughput metrics to the supervisory service.
    Type: Application
    Filed: October 12, 2017
    Publication date: April 18, 2019
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Pierre-André Savalle
  • Patent number: 10243980
    Abstract: In one embodiment, a device in a network receives an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network. The device receives labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate scanning activity. The device trains a machine learning-based classifier using the labeled traffic data to distinguish between legitimate and illegitimate scanning activity in the network. The device deploys the trained classifier to the first node, to distinguish between legitimate and illegitimate scanning activity in the network.
    Type: Grant
    Filed: July 8, 2016
    Date of Patent: March 26, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Jean-Philippe Vasseur, Grégory Mermoud, Pierre-André Savalle, Alexandre Honoré
  • Publication number: 20190089599
    Abstract: In one embodiment, a service identifies a performance issue exhibited by a first device in a first network. The service forms a set of one or more time series of one or more characteristics of the first device associated with the identified performance issue. The service generates a mapping between the set of one or more time series of one or more characteristics of the first device to one or more time series of one or more characteristics of a second device in a second network. The mapping comprises a relevancy score that quantifies a degree of similarity between the characteristics of the first and second devices. The service determines a likelihood of the second device exhibiting the performance issue based on the generated mapping and on the relevancy score. The service provides an indication of the determined likelihood to a user interface associated with the second network.
    Type: Application
    Filed: September 15, 2017
    Publication date: March 21, 2019
    Inventors: Pierre-André Savalle, Grégory Mermoud, Jean-Philippe Vasseur
  • Publication number: 20190081973
    Abstract: In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model. The device provides an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models.
    Type: Application
    Filed: November 14, 2018
    Publication date: March 14, 2019
    Inventors: Pierre-André Savalle, Grégory Mermoud, Laurent Sartran, Jean-Philippe Vasseur
  • Patent number: 10220167
    Abstract: In one embodiment, a device in a network detects an anomaly in the network by analyzing a set of sample data regarding one or more conditions of the network using a behavioral analytics model. The device receives feedback regarding the detected anomaly. The device determines that the anomaly was a true positive based on the received feedback. The device excludes the set of sample data from a training set for the behavioral analytics model, in response to determining that the anomaly was a true positive.
    Type: Grant
    Filed: June 13, 2016
    Date of Patent: March 5, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Pierre-André Savalle
  • Patent number: 10218726
    Abstract: In one embodiment, a networking device in a network causes formation of device clusters of devices in the network. The devices in a particular cluster exhibit similar characteristics. The networking device receives feedback from a device identity service regarding the device clusters. The feedback is based in part on the device identity service probing the devices. The networking device adjusts the device clusters based on the feedback from the device identity service. The networking device performs anomaly detection in the network using the adjusted device clusters.
    Type: Grant
    Filed: June 13, 2016
    Date of Patent: February 26, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Jean-Philippe Vasseur, Grégory Mermoud, Pierre-André Savalle, Andrea Di Pietro, Sukrit Dasgupta
  • Patent number: 10212044
    Abstract: In one embodiment, a device in a network maintains a machine learning-based recursive model that models a time series of observations regarding a monitored entity in the network. The device applies sparse dictionary learning to the recursive model, to find a decomposition of a particular state vector of the recursive model. The decomposition of the particular state vector comprises a plurality of basis vectors. The device determines a mapping between at least one of the plurality of basis vectors for the particular state vector and one or more human-readable interpretations of the basis vectors. The device provides a label for the particular state vector to a user interface. The label is based on the mapping between the at least one of the plurality of basis vectors for the particular state vector and the one or more human-readable interpretations of the basis vectors.
    Type: Grant
    Filed: March 23, 2017
    Date of Patent: February 19, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Pierre-André Savalle, Jean-Philippe Vasseur, Javier Cruz Mota
  • Patent number: 10193912
    Abstract: In one embodiment, a device in a network loads an anomaly detection model for warm-start. The device filters input data for the model during a warm-start grace period after warm-start of the anomaly detection model. The model is not updated during the warm-start grace period based on the filtering. The device determines an end to the warm-start grace period. The device updates the anomaly detection model using unfiltered input data for the anomaly detection model after the determined end to the warm-start grace period.
    Type: Grant
    Filed: February 24, 2016
    Date of Patent: January 29, 2019
    Assignee: Cisco Technology, Inc.
    Inventors: Grégory Mermoud, Jean-Philippe Vasseur, Pierre-André Savalle
  • Patent number: 10164991
    Abstract: In one embodiment, a device in a network maintains a plurality of anomaly detection models for different sets of aggregated traffic data regarding traffic in the network. The device determines a measure of confidence in a particular one of the anomaly detection models that evaluates a particular set of aggregated traffic data. The device dynamically replaces the particular anomaly detection model with a second anomaly detection model configured to evaluate the particular set of aggregated traffic data and has a different model capacity than that of the particular anomaly detection model. The device provides an anomaly event notification to a supervisory controller based on a combined output of the second anomaly detection model and of one or more of the anomaly detection models in the plurality of anomaly detection models.
    Type: Grant
    Filed: June 8, 2016
    Date of Patent: December 25, 2018
    Assignee: Cisco Technology, Inc.
    Inventors: Pierre-André Savalle, Grégory Mermoud, Laurent Sartran, Jean-Philippe Vasseur
  • Publication number: 20180365581
    Abstract: In one embodiment, a service uses a set of collected characteristics of a client device in a network as input to a machine learning-based model that predicts a quality score for an online conference in which the client device is a participant. The service determines a resource consumption by the client device or the network that is associated with collecting the characteristics of the client device. The service determines an efficacy of the machine learning-based model as a function of the set of collected characteristics of the client device. The service adjusts the set of collected characteristics of the client device to optimize the efficacy of the model and the resource consumption associated with collecting the characteristics of the client device.
    Type: Application
    Filed: September 14, 2017
    Publication date: December 20, 2018
    Inventors: Jean-Philippe Vasseur, Grégory Mermoud, Pierre-André Savalle, Javier Cruz Mota
  • Publication number: 20180359651
    Abstract: In one embodiment, a device receives observed access point (AP) features of one or more APs in a monitored network. The device clusters the observed AP features within a latent space to form AP feature clusters. The device applies labels to the AP feature clusters within the latent space. The device uses the applied labels to the AP feature clusters to describe future behaviors of the one or more APs in the monitored network.
    Type: Application
    Filed: June 12, 2017
    Publication date: December 13, 2018
    Inventors: Javier Cruz Mota, Jean-Philippe Vasseur, Pierre-André Savalle, Grégory Mermoud
  • Publication number: 20180359648
    Abstract: In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the vertices of the access point graph and represents transitions between access points in the network performed by the particular client. The device identifies a transition pattern from the client trajectories by deconstructing the trajectory subgraphs. The device uses the identified transition pattern to effect a configuration change in the network.
    Type: Application
    Filed: June 8, 2017
    Publication date: December 13, 2018
    Inventors: Pierre-André Savalle, Grégory Mermoud, Jean-Philippe Vasseur, Javier Cruz Mota