Granted Patent B2

US 12,476,874 · App. 18/505,914 · Granted Nov 18, 2025

Inventors: Santhosh Kumar Vuda (Bangalore, IN); Kiran Kumar Palukuri (Bangalore, IN); Kumar G Varun (Pleasanton, CA); Jerry Paul Russell (Seattle, WA)

Assignee: Oracle International Corporation

H04L41/12H04L41/147

Abstract

Claims (105)

1 . One or more non-transitory computer readable media comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:

determining network topology information for a plurality of time periods, the network topology information comprising, for individual time periods of the plurality of time periods:

a plurality of entities associated with the network topology,

a plurality of relationships between the plurality of entities, and

health metrics of the plurality of entities;

storing, in a topology log, the network topology information for the individual time periods in association with the health metrics of the plurality of entities for the individual time periods;

based on the topology log, predicting characteristics of the network topology for a future time period;

selecting a subset of the network topology for anomaly detection analysis;

determining that predicted characteristics of a threshold number of nodes in the subset of the network topology meet at least one anomaly detection criteria;

responsive to determining that predicted characteristics of a threshold number of nodes in the subset of the network topology meet the at least one anomaly detection criteria, predicting an anomaly corresponding to the subset of the network topology for the future time period based on the predicted characteristics, wherein the subset of the network topology comprises two or more nodes of the network topology;

determining a candidate remediation for the subset of the network topology based on the predicted anomaly for the subset of the network topology; and

presenting, using a computer-user interface, the candidate remediation for the subset of the network topology.

2 . The one or more non-transitory computer readable media of claim 1 , wherein predicting the characteristics of the network topology comprise:

predicting the characteristics based on current or predicted relationships in the plurality of relationships.

3 . The one or more non-transitory computer readable media of claim 1 , wherein the operations further comprise:

receiving a user input defining the future time period; and

predicting the characteristics of the network topology at the future time period by modeling behaviors of the entities associated within the network topology using network topology information for a current time period.

4 . The one or more non-transitory computer readable media of claim 1 , wherein predicting an anomaly corresponding to the subset of the network topology for the future time period based on the predicted characteristics comprises:

determining that predicted characteristics of a first node, of the network topology, meet at least one of the anomaly detection criteria;

iteratively identifying additional nodes that are (a) connected to the first node or previously identified additional nodes, and (b) meet at least one of the anomaly detection criteria; and

selecting the first node and the additional nodes for inclusion in the subset of the network topology.

5 . The one or more non-transitory computer readable media of claim 1 , wherein the operations further comprise:

based on the predicted characteristics of the network topology for the future time period, identifying a particular edge for a pair of nodes in the network topology, wherein the particular edge represents a communicative coupling between the pair of nodes;

determining that the particular edge for the pair of nodes in the network topology meets at least one of the anomaly detection criteria; and

responsive to determining that the particular edge for the pair of nodes in the network topology meets at least one of the anomaly detection criteria, including the pair of nodes and the particular edge within the subset of the network topology for which the anomaly is predicted.

6 . The one or more non-transitory computer readable media of claim 1 , wherein the operations further comprise determining one or more remediation plans for the subset by:

determining an image of the subset; and

applying a trained machine learning model to the image of the subset that identifies the one or more remediation plans of historical subsets similar to the subset.

7 . The one or more non-transitory computer readable media of claim 1 , wherein presenting the candidate remediation for the subset comprises displaying a plurality of proposed remediation plans.

8 . The one or more non-transitory computer readable media of claim 7 , wherein displaying the plurality of proposed remediation plans comprises:

receiving, using the computer-user interface, a selection of a remediation plan from the plurality of proposed remediation plans; and

displaying, using the computer-user interface, the network topology information including modifications of the selected remediation plan.

9 . The one or more non-transitory computer readable media of claim 8 , wherein the operations further comprise:

receiving, using the computer-user interface, an instruction to implement the selected remediation plan; and

implementing the selected remediation in the network.

10 . A system comprising a hardware processor and computer-readable program instructions that, when executed by the hardware processor, control the system to perform operations, comprising:

determining network topology information for a plurality of time periods, the network topology information comprising, for individual time periods of the plurality of time periods:

a plurality of entities associated with the network topology,

a plurality of relationships between the plurality of entities, and

health metrics of the plurality of entities;

storing, in a topology log, the network topology information for the individual time periods in association with the health metrics of the plurality of entities for the individual time periods;

based on the topology log, predicting characteristics of the network topology for a future time period;

selecting a subset of the network topology for anomaly detection analysis;

determining that predicted characteristics of a threshold number of nodes in the subset of the network topology meet an anomaly detection criteria;

responsive to determining that predicted characteristics of a threshold number of nodes in the subset of the network topology meet an anomaly detection criteria, predicting an anomaly corresponding to the subset of the network topology for a future time period based on the predicted characteristics, wherein the subset of the network topology comprises two or more nodes of the network topology;

determining a candidate remediation for the subset of the network topology based on the predicted anomaly for the subset of the network topology; and

presenting, using a computer-user interface, the candidate remediation for the subset of the network topology.

11 . The system of claim 10 , wherein predicting the characteristics of the network topology comprise:

predicting the characteristics based on current or predicted relationships in the plurality of relationships.

12 . The system of claim 10 , wherein the operations further comprise:

receiving a user input defining the future time period; and

predicting the characteristics of the network topology at the future time period by modeling behaviors of the entities associated within the network topology using network topology information for a current time period.

13 . The system of claim 10 , wherein predicting an anomaly corresponding to the subset of the network topology for the future time period based on the predicted characteristics comprises:

determining that predicted characteristics of a first node, of the network topology, meet at least one of the anomaly detection criteria;

iteratively identifying additional nodes that are (a) connected to the first node or previously identified additional nodes, and (b) meet at least one of the anomaly detection criteria; and

selecting the first node and the additional nodes for inclusion in the subset of the network topology.

14 . The system of claim 10 , wherein the operations further comprise:

based on the predicted characteristics of the network topology for the future time period, identifying a particular edge for a pair of nodes in the network topology, wherein the particular edge represents a communicative coupling between the pair of nodes;

determining that the particular edge for the pair of nodes in the network topology meets at least one of the anomaly detection criteria; and

responsive to determining that the particular edge for the pair of nodes in the network topology meets at least one of the anomaly detection criteria, including the pair of nodes and the particular edge within the subset of the network topology for which the anomaly is predicted.

15 . The system of claim 10 , wherein the operations further comprise determining one or more remediation plans for the subset by:

determining an image of the subset; and

applying a trained machine learning model to the image of the subset that identifies the one or more remediation plans of historical subsets similar to the subset.

16 . The system of claim 10 , wherein presenting the candidate remediation for the subset comprises displaying a plurality of proposed remediation plans.

17 . The system of claim 16 , wherein displaying the plurality of proposed remediation plans comprises:

receiving, using the computer-user interface, a selection of a remediation plan from the plurality of proposed remediation plans; and

displaying, using the computer-user interface, the network topology information including modifications of the selected remediation plan.

18 . The system of claim 17 , wherein the operations further comprise:

receiving, using the computer-user interface, an instruction to implement the selected remediation plan; and

implementing the selected remediation in the network.

19 . A method comprising:

determining network topology information for a plurality of time periods, the network topology information comprising, for individual time periods of the plurality of time periods:

a plurality of entities associated with the network topology,

a plurality of relationships between the plurality of entities, and

health metrics of the plurality of entities;

storing, in a topology log, the network topology information for the individual time periods in association with the health metrics of the plurality of entities for the individual time periods;

based on the topology log, predicting characteristics of the network topology for a future time period;

selecting a subset of the network topology for anomaly detection analysis;

determining that predicted characteristics of a threshold number of nodes in the subset of the network topology meet an anomaly detection criteria;

responsive to determining that predicted characteristics of a threshold number of nodes in the subset of the network topology meet an anomaly detection criteria, predicting an anomaly corresponding to the subset of the network topology for a future time period based on the predicted characteristics, wherein the subset of the network topology comprises two or more nodes of the network topology;

determining a candidate remediation for the subset of the network topology based on the predicted anomaly for the subset of the network topology; and

presenting, using a computer-user interface, the candidate remediation for the subset of the network topology.

20 . The method of claim 19 , wherein predicting the characteristics of the network topology comprises:

predicting the characteristics based on current or predicted relationships in the plurality of relationships.

21 . The method of claim 19 , further comprising:

receiving a user input defining the future time period; and

predicting the characteristics of the network topology at the future time period by modeling behaviors of the entities associated within the network topology using network topology information for a current time period.

22 . The method of claim 19 , wherein predicting an anomaly corresponding to the subset of the network topology for the future time period based on the predicted characteristics comprises:

determining that predicted characteristics of a first node, of the network topology, meet at least one of the anomaly detection criteria;

iteratively identifying additional nodes that are (a) connected to the first node or previously identified additional nodes, and (b) meet at least one of the anomaly detection criteria; and

selecting the first node and the additional nodes for inclusion in the subset of the network topology.

23 . The method of claim 19 , further comprising:

based on the predicted characteristics of the network topology for the future time period, identifying a particular edge for a pair of nodes in the network topology, wherein the particular edge represents a communicative coupling between the pair of nodes;

determining that the particular edge for the pair of nodes in the network topology meets at least one of the anomaly detection criteria; and

responsive to determining that the particular edge for the pair of nodes in the network topology meets at least one of the anomaly detection criteria, including the pair of nodes and the particular edge within the subset of the network topology for which the anomaly is predicted.

24 . The method of claim 19 , further comprising determining one or more remediation plans for the subset by:

determining an image of the subset; and

applying a trained machine learning model to the image of the subset that identifies the one or more remediation plans of historical subsets similar to the subset.

25 . The method of claim 19 , wherein presenting the candidate remediation for the subset comprises displaying a plurality of proposed remediation plans.

26 . The method of claim 25 , wherein displaying the plurality of proposed remediation plans comprises:

receiving, using the computer-user interface, a selection of a remediation plan from the plurality of proposed remediation plans; and

displaying, using the computer-user interface, the network topology information including modifications of the selected remediation plan.

27 . The method of claim 26 , further comprising:

receiving, using the computer-user interface, an instruction to implement the selected remediation plan; and

implementing the selected remediation in the network.

Assignments (1)

Continuity (2)

References Cited (15)