Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Systems and methods are provided for dynamic virtual private network concentrators (VPNC) gateway selection and on-demand VRF-ID configuration. A dynamic VPNC gateway selection component can dynamically route to a particular VPNC gateway based on multiple user-specific factors, including: a) behavior of users on the network; and b) performance of a destination service/device. A dynamic VPNC gateway selection component can rank a user based on one or more factors relating to the behavior of the user. Also, the dynamic VPNC gateway selection component can determine whether a VPNC gateway at a data center is healthy, and whether a destination service at the data center is healthy. The dynamic VPNC gateway selection component can dynamically select a VPNC gateway from a plurality of VPNC gateways at the data center for communicating forwarded traffic from the user based on the user's ranking if either the VPNC gateway or the service are unhealthy.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Automated inductive machine learning is provided. The method comprises a) receiving a dataset comprising positive examples and negative examples of a given target literal; b) learning a rule regarding the target literal from the positive examples and negative examples in the dataset according to a gini impurity heuristic; c) responsive to a determination that there are a number of the positive examples in the dataset above a specified tail value are covered by the rule: ruling out those positive examples covered by the rule from the dataset; adding the rule to a rule set; and returning to step b) to learn a new rule for the target literal according to all remaining positive examples and negative examples in the dataset; and d) responsive to a determination that there are no remaining positive examples in the dataset covered by the rule, returning the rule set to a user.

Abstract: Some examples relate to identifying a dynamic network parameter probe interval in an SD-WAN. In an example, a controller may define a probe profile of an uplink in the SD-WAN. The probe profile of the uplink may include a static probe interval and a probe retry value. The controller may determine the value of the network parameter for the uplink, prior to expiration of a static probe timer interval. If the value of the network parameter is in negative deviation with a baseline value of the network parameter, the controller may identify a dynamic probe interval for each successive determination of the value of the network parameter. The identification of the dynamic probe interval for a given successive determination may depend on at least one previously determined value of the network parameter. The controller may initiate duplicate network traffic on a secondary uplink in the SD-WAN.

Abstract: A system receives one or more ingress data packets from a client device or a user in a network. The system obtains attributes, via packet inspection, from the one or more ingress data packets, and determines one or more embedding vectors from the attributes. The one or more embedding vectors represent a status of a session during which the ingress data packets are obtained. The system transmits the one or more embedding vectors as inputs to a trained machine learning model. The system infers, using the trained machine learning mode, one or more security policies based on the embedding vectors. The system provides or implementing the one or more security policies.

Abstract: Examples described herein relate to generation of radio frequency (RF) plans for network deployments. Examples described herein may receive an input RF plan with modified set of features of a network deployment area. A first machine learning (ML) model generates an intermediate RF plan indicating candidate AR locations based on the modified set of features and a first set of parameters. A second ML model determines a network optimization score for the intermediate RF plan. Based on the optimization score, the first set of parameters are optimized. The first ML model generates an output RF plan indicating optimized AP locations based on the optimized first set of parameters and the modified set of features.

Abstract: Examples relate to a BC network including a plurality of network devices deployed in a network. The plurality of network devices includes an authoritative network device that generates a transaction in a distributed ledger. The transaction includes location information of a new public key certificate to be deployed in each of the network devices. In order to verify the transaction, a network device of the plurality of network devices verifies, using a smart contract, whether the new public key certificate is valid and whether the new public key certificate is different from a previously recorded public key certificate in the distributed ledger. In response to successful verification by at least a predefined number of network devices of the plurality of network devices, each of the network device record the transaction in the distributed ledger.

Abstract: Some examples relate to managing multicast group traffic. In an example, a switch anchor controller receives a request for a multicast group from an associated network switch in a multicast-capable network. The associated network switch registers to the switch anchor controller in the multicast-capable network. In response to the request, the switch anchor controller selects a non-anchor controller in the multicast-capable network to serve the multicast group to the associated network switch. The switch anchor controller provides the information related to the non-anchor controller to the associated network switch, which in response creates a specific multicast tunnel between the associated network switch and the non-anchor controller to transfer multicast traffic related to the multicast group.

Abstract: The present disclosure describes dynamic intrusion detection and prevention in computer networks. The method includes generation of clusters of network sites based on a plurality of parameters related to operational features and network threats associated with the network sites. Data models are trained upon the clusters developed through the clustering. The data models are executed to predict a threat frequency of each network threat for each cluster. A difference between the predicted threat frequency of each network threat and corresponding baseline frequencies is determined. Dynamic rulesets are configured, based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequencies, for each cluster by integrating rules applicable to prevent each network threat.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Examples described herein provide for associating a network device to a network management system (NMS). Examples herein include determining, by a network orchestrator, a set of embeddings indicative of characteristics of the network device and each of a plurality of instances of the NMS. Examples herein include determining, by the network orchestrator for each of the plurality of instances, a probability score based on the set of embeddings, wherein the probability score is indicative of a likelihood of the network device to be associated with the instance. Examples herein further include, based on the probability score for each of the plurality of instances, selecting, by the network orchestrator, a first instance of the plurality of instances to associate with the network device. Examples herein include associating, by the network orchestrator, the network device to the first instance.

Abstract: In an example, a Dynamic Host Configuration Protocol (DHCP) lease request from a client device connected to a network is received. Based on the DHCP lease request, an Internet Protocol (IP) address is assigned to the client device for a lease time. A first lease renewal request is received. A probability of utilization for a lease time block is predicted based on a historical lease pattern, device characteristics, traffic information, and DHCP information. Based on a combination of the probability of utilization and a reward value, the lease time block is allotted for lease renewal. For each allotment, the reward value is adjusted based on deployment characteristics and traffic load in the network, and a network connection duration of the client device. A normalized reward value for the lease time block is determined based on reward values for the lease time block over multiple allotments.

Abstract: Dynamic path steering utilizing automatic generation of user threshold profiles is described. An example of a storage medium includes instructions for obtaining a threshold policy for a first application, the threshold policy including a set of threshold values for operational parameters; generating a migration score for a first user, the migration score based at least in part on a user score for the first user; generating a set of secondary threshold values for the first user based at least in part on the migration score and the set of threshold values; enabling operation of the first application for the first user using a first network uplink; monitoring network parameter values in operation of the first application; and upon detecting an operational parameter value exceeding a secondary threshold value, migrating operation of the first application for the first user from the first network uplink to a second network uplink.

Abstract: Systems and methods are provided for new network device provisioning without Internet access. One method may include a method of network device provisioning without Internet access, the method including entering a pre-shared key (PSK) in a dynamic host configuration protocol (DHCP) message, obtaining the PSK from a set of DHCP message options by an onboarding network device requesting to join a private network, presenting the PSK, by the onboarding network device, to a network management system (NMS) of the private network, validating the PSK by the NMS, and updating an inventory list of the NMS to include the onboarding network device in the inventory list.

Abstract: Systems and methods are provided for dynamic virtual private network concentrators (VPNC) gateway selection and on-demand VRF-ID configuration. A dynamic VPNC gateway selection component can dynamically route to a particular VPNC gateway based on multiple user-specific factors, including: a) behavior of users on the network; and b) performance of a destination service/device. A dynamic VPNC gateway selection component can rank a user based on one or more factors relating to the behavior of the user. Also, the dynamic VPNC gateway selection component can determine whether a VPNC gateway at a data center is healthy, and whether a destination service at the data center is healthy. The dynamic VPNC gateway selection component can dynamically select a VPNC gateway from a plurality of VPNC gateways at the data center for communicating forwarded traffic from the user based on the user's ranking if either the VPNC gateway or the service are unhealthy.

Abstract: A method for troubleshooting and resolving access point device uplink failures. The method includes detecting an unresponsive access point on a wired computer network. In addition, the method includes retrieving a record of peer access points to determine the peer access points for the unresponsive access point. Further, the method proceeds to sending a first request to a peer access point of the unresponsive access point to query the unresponsive access point for a response over a wireless network. In response to the query, the network management system sends a notification that the unresponsive access point has a cable malfunction if the unresponsive access point responds to the query. Furthermore, the method includes, in response to the query, sending a notification to the network management system to inform that the unresponsive access point has a power malfunction if the unresponsive access point fails to respond to the query.

Abstract: A method for use in managing a networked computing system includes: receiving a trigger for a migration of a plurality of local migration artifacts from a first deployment state associated with an on-premises network management system to a second deployment state; and migrating the plurality of local migration artifacts from the first deployment state associated with the on-premises network management system to the second deployment state associated with the cloud-based provisioning system. The migration is seamless and includes reconciling at least one local migration artifact of the plurality of local migration artifacts with a plurality of remote migration artifacts maintained by the cloud-based provisioning system.

Abstract: Systems and methods are provided for network device configuration update. A method includes selecting a group of network devices to receive a configuration update; ranking the network devices according to an importance; updating each of the network devices in order of the ranking, from least important to most important, comprising: generating a first health score for the network device, the first health score representing a performance level of the network device prior to the configuration update; updating a configuration of the network device according to the configuration update subsequent to generating the first health score; generating a second health score for the updated network device subsequent to updating the configuration of the network device; and responsive to the second health score being lower than the first health score by more than a predetermined score threshold, rolling back the configuration update for the network devices that have been updated.

Abstract: A method for managing bandwidth may include identifying a first tier of applications and a second tier of applications, determining a number of user sessions associated with at least one application among the first tier of applications and the second tier of applications, each user session consuming a percentage of bandwidth of at least one communication channel in a network, and baselining a second tier application bandwidth use for each user session associated with the second tier of applications to determine a first interval and a second interval.