Granted Patent B2

US 12,452,264 · App. 18/410,901 · Granted Oct 21, 2025

Inventors: Yi Hong (Foster City, CA); Tian Bu (Basking Ridge, NJ); Girish P Chandranmenon (Edison, NJ)

Assignee: Cisco Technology, Inc.

H04L63/1416H04L41/22H04L63/1425

Abstract

Claims (79)

1. A method comprising:

receiving, by a processor, a set of monitoring events associated with a system, wherein the set of monitoring events is associated with a feature schema defining a first feature and a second feature;

determining, by the processor, a first entropy measure associated with the first feature and a second entropy measure associated with the second feature, wherein the first entropy measure falls below the second entropy measure, and wherein determining the first entropy measure comprises determining a first ratio of the set of monitoring events that are associated with a first value for the first feature and a second ratio of the set of monitoring events that are associated with a second value for the first feature;

based at least in part on determining that the first entropy measure falls below the second entropy measure, associating, by the processor, the first feature with a first layer of a tree structure and the second feature with a second layer of the tree structure;

generating, by the processor, the tree structure based on the first layer and the second layer, wherein:

the first layer represents a first subset of the set of monitoring events that are associated with the first value for the first feature and a second subset of the set of monitoring events that are associated with the second value for the first feature, and

the second layer represents a third subset of the first subset that are associated with a third value for the second feature and a fourth subset of the first subset that are associated with a fourth value for the second feature; and

displaying, by the processor, a representation of the tree structure using a system administrator platform associated with the system.

2. The method of claim 1 , wherein determining the first entropy measure comprises:

determining a first logarithmic normalization value based on the first ratio and a second logarithmic normalization value based on the second ratio;

determining a first normalized ratio based on the first ratio and the first logarithmic normalization value;

determining a second normalized ratio based on the second ratio and the second logarithmic normalization value; and

determining the first entropy measure based on the first normalized ratio and the second normalized ratio.

3. The method of claim 1 , wherein the second layer further represents:

a fifth subset of the second subset that are associated with the third value for the second feature, and

a sixth subset of the second subset that are associated with the fourth value for the second feature.

4. The method of claim 3 , wherein:

the feature schema further defines a third feature, and

the first entropy measure and the second entropy measure fall below a third entropy measure associated with the third feature.

5. The method of claim 1 , wherein the second entropy measure represents an entropy of the second feature in relation to the first subset.

6. The method of claim 5 , wherein:

the feature schema further defines a third feature,

the third feature is associated with a third entropy measure with respect to the second subset that falls below a fourth entropy measure associated with the second feature with respect to the second subset,

the third feature is associated with a fifth entropy measure with respect to the first subset that falls below the second entropy measure, and

the second layer further represents a fifth subset of the second subset that are associated with a fifth value for the third feature and a sixth subset of the second subset that are associated with a sixth value for the third feature.

7. The method of claim 1 , further comprising:

receiving, by the processor, a user selection of the first feature and the second feature from a plurality of features defined in the feature schema.

8. The method of claim 1 , further comprising:

determining a monitoring event based on a shape of the tree structure.

9. A system comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving a set of monitoring events associated with a system, wherein the set of monitoring events is associated with a feature schema defining a first feature and a second feature;

determining a first entropy measure associated with the first feature and a second entropy measure associated with the second feature, wherein the first entropy measure falls below the second entropy measure, and wherein determining the first entropy measure comprises determining a first ratio of the set of monitoring events that are associated with a first value for the first feature and a second ratio of the set of monitoring events that are associated with a second value for the first feature;

based at least in part on determining that the first entropy measure falls below the second entropy measure, associating the first feature with a first layer of a tree structure and the second feature with a second layer of the tree structure;

generating the tree structure based on the first layer and the second layer, wherein:

the first layer represents a first subset of the set of monitoring events that are associated with the first value for the first feature and a second subset of the set of monitoring events that are associated with the second value for the first feature, and

the second layer represents a third subset of the first subset that are associated with a third value for the second feature and a fourth subset of the first subset that are associated with a fourth value for the second feature; and

displaying a representation of the tree structure using a system administrator platform associated with the system.

10. The system of claim 9 , wherein determining the first entropy measure comprises:

determining a first logarithmic normalization value based on the first ratio and a second logarithmic normalization value based on the second ratio;

determining a first normalized ratio based on the first ratio and the first logarithmic normalization value;

determining a second normalized ratio based on the second ratio and the second logarithmic normalization value; and

determining the first entropy measure based on the first normalized ratio and the second normalized ratio.

11. The system of claim 9 , wherein the second layer further represents:

a fifth subset of the second subset that are associated with the third value for the second feature, and

a sixth subset of the second subset that are associated with the fourth value for the second feature.

12. The system of claim 11 , wherein:

the feature schema further defines a third feature, and

the first entropy measure and the second entropy measure fall below a third entropy measure associated with the third feature.

13. The system of claim 9 , wherein the second entropy measure represents an entropy of the second feature in relation to the first subset.

14. The system of claim 13 , wherein:

the feature schema further defines a third feature,

the third feature is associated with a third entropy measure with respect to the second subset that falls below a fourth entropy measure associated with the second feature with respect to the second subset,

the third feature is associated with a fifth entropy measure with respect to the first subset that falls below the second entropy measure, and

the second layer further represents a fifth subset of the second subset that are associated with a fifth value for the third feature and a sixth subset of the second subset that are associated with a sixth value for the third feature.

15. The system of claim 9 , the operations further comprising:

receiving a user selection of the first feature and the second feature from a plurality of features defined in the feature schema.

16. The system of claim 9 , the operations further comprising:

determining a monitoring event based on a shape of the tree structure.

17. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving a set of monitoring events associated with a system, wherein the set of monitoring events is associated with a feature schema defining a first feature and a second feature;

determining a first entropy measure associated with the first feature and a second entropy measure associated with the second feature, wherein the first entropy measure falls below the second entropy measure, and wherein determining the first entropy measure comprises determining a first ratio of the set of monitoring events that are associated with a first value for the first feature and a second ratio of the set of monitoring events that are associated with a second value for the first feature;

based at least in part on determining that the first entropy measure falls below the second entropy measure, associating the first feature with a first layer of a tree structure and the second feature with a second layer of the tree structure;

generating the tree structure based on the first layer and the second layer, wherein:

the first layer represents a first subset of the set of monitoring events that are associated with the first value for the first feature and a second subset of the set of monitoring events that are associated with the second value for the first feature, and

the second layer represents a third subset of the first subset that are associated with a third value for the second feature and a fourth subset of the first subset that are associated with a fourth value for the second feature; and

displaying a representation of the tree structure using a system administrator platform associated with the system.

18. The one or more non-transitory computer-readable media of claim 17 , wherein determining the first entropy measure comprises:

determining a first logarithmic normalization value based on the first ratio and a second logarithmic normalization value based on the second ratio;

determining a first normalized ratio based on the first ratio and the first logarithmic normalization value;

determining a second normalized ratio based on the second ratio and the second logarithmic normalization value; and

determining the first entropy measure based on the first normalized ratio and the second normalized ratio.

19. The one or more non-transitory computer-readable media of claim 17 , wherein the second layer further represents:

a fifth subset of the second subset that are associated with the third value for the second feature, and

a sixth subset of the second subset that are associated with the fourth value for the second feature.

20. The one or more non-transitory computer-readable media of claim 19 , wherein:

the feature schema further defines a third feature, and

the first entropy measure and the second entropy measure fall below a third entropy measure associated with the third feature.

Assignments (1)

Continuity (1)

References Cited (13)