Abstract: In one embodiment, a service receives telemetry data collected from a plurality of different networks. The service combines the telemetry data into a synthetic input trace. The service inputs the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), each of the models having been trained to assess telemetry data from an associated network in the plurality of different networks and predict a KPI for that network. The service compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

Abstract: In one embodiment, techniques are shown and described relating to traffic-based inference of influence domains in a network by using learning machines. In particular, in one embodiment, a management device computes a time-based traffic matrix indicating traffic between pairs of transmitter and receiver nodes in a computer network, and also determines a time-based quality parameter for a particular node in the computer network. By correlating the time-based traffic matrix and time-based quality parameter for the particular node, the device may then determine an influence of particular traffic of the traffic matrix on the particular node.

Abstract: The present technology allows a hybrid approach to using artificial intelligence engines to perform issue generation, leveraging both on-premise and cloud components. In the technology, a cloud-based computing device receives data associated with a computing network of devices and uses machine-learning to create a model of the computing network. The cloud-based computing device communicates the model to a computing system located on-premise with the computing network and receives data related to the issues and insights created by the on-premise computing system. The cloud-based computing device determines if the on-premise computing system is producing issues and insights below a threshold quality. If yes, the cloud-based computing device updates the model based on updated data associated with the computing network and communicates the updated model to the on-premise computing system.

Abstract: In one embodiment, a service receives telemetry data collected from a plurality of different networks. The service combines the telemetry data into a synthetic input trace. The service inputs the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), each of the models having been trained to assess telemetry data from an associated network in the plurality of different networks and predict a KPI for that network. The service compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.

Abstract: In one embodiment, a network assurance service that monitors a network detects a network issue in the network using a machine learning model and based on telemetry data captured in the network. The service assigns the detected network issue to an issue cluster by applying clustering to the detected network issue and to a plurality of previously detected network issues. The service selects a set of one or more actions for the detected network issue from among a plurality of actions associated with the previously detected network issues in the issue cluster. The service obtains context data for the detected network issue. The service provides, to a user interface, an indication of the detected network issue, the obtained context data for the detected network issue, and the selected set of one or more actions.

Abstract: In one embodiment, a network assurance service that monitors a network detects a network anomaly in the network using a machine learning-based anomaly detector. The network assurance service identifies a set of network conditions associated with the detected network anomaly. The network assurance service initiates a network test on one or more clients in the network that exhibit the identified network conditions. The network assurance service retrains the machine learning-based anomaly detector based on a result of the network test.

Abstract: The technology provides for providing an interactive user interface to explore a complete network, see relationships with various aspects of the network, and drill down to details in an instinctive manner. In some embodiments, network component data is received that identifies metrics associated with network components. A graphical user interface made up of representations of network components of a network is presented, where the network components are selectable. Relevant network components are displayed at varying network scales by receiving an input selecting a first representation of a first network component at a first network level. Based on a network component relationship between the first representation of the first network component and a second relationship of a second network component, second network component data is received that identifies one or more metrics associated with the second network component. The second network component is at a second network level.

Abstract: In one embodiment, a device in a network receives anomaly data regarding an anomaly detected by a machine learning-based anomaly detection mechanism of a first node in the network. The device matches the anomaly data to threat intelligence feed data from one or more threat intelligence services. The device determines whether to provide threat intelligence feedback to the first node based on the matched threat intelligence feed data and one or more policy rules. The device provides threat intelligence feedback to the first node regarding the matched threat intelligence feed data, in response to determining that the device should provide threat intelligence feedback to the first node.

Abstract: In one embodiment, a device in a network performs anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in the network. The device identifies an ability of one or more nodes in the network to perform at least one of the anomaly detection functions. The device selects a particular one of the anomaly detection functions to offload to a particular one of the nodes, based on the ability of the particular node to perform the particular anomaly detection function. The device instructs the particular node to perform the selected anomaly detection function.

Abstract: The technology provides for providing an interactive user interface to explore a complete network, see relationships with various aspects of the network, and drill down to details in an instinctive manner. In some embodiments, network component data is received that identifies metrics associated with network components. A graphical user interface made up of representations of network components of a network is presented, where the network components are selectable. Relevant network components are displayed at varying network scales by receiving an input selecting a first representation of a first network component at a first network level. Based on a network component relationship between the first representation of the first network component and a second relationship of a second network component, second network component data is received that identifies one or more metrics associated with the second network component. The second network component is at a second network level.

Abstract: In one embodiment, techniques are shown and described relating to traffic-based inference of influence domains in a network by using learning machines. In particular, in one embodiment, a management device computes a time-based traffic matrix indicating traffic between pairs of transmitter and receiver nodes in a computer network, and also determines a time-based quality parameter for a particular node in the computer network. By correlating the time-based traffic matrix and time-based quality parameter for the particular node, the device may then determine an influence of particular traffic of the traffic matrix on the particular node.

Abstract: In one embodiment, a primary networking device in a branch network receives a notification of an anomaly detected by a secondary networking device in the branch network. The primary networking device is located at an edge of the network. The primary networking device aggregates the anomaly detected by the secondary networking device and a second anomaly detected in the network into an aggregated anomaly. The primary networking device associates the aggregated anomaly with a location of the secondary networking device in the branch network. The primary networking device reports the aggregated anomaly and the associated location of the secondary networking device to a supervisory device.

Abstract: In one embodiment, a network assurance service that monitors a network detects a network anomaly in the network using a machine learning-based anomaly detector. The network assurance service identifies a set of network conditions associated with the detected network anomaly. The network assurance service initiates a network test on one or more clients in the network that exhibit the identified network conditions. The network assurance service retrains the machine learning-based anomaly detector based on a result of the network test.

Abstract: In one embodiment, techniques are shown and described relating to traffic-based inference of influence domains in a network by using learning machines. In particular, in one embodiment, a management device computes a time-based traffic matrix indicating traffic between pairs of transmitter and receiver nodes in a computer network, and also determines a time-based quality parameter for a particular node in the computer network. By correlating the time-based traffic matrix and time-based quality parameter for the particular node, the device may then determine an influence of particular traffic of the traffic matrix on the particular node.

Abstract: In one embodiment, a node in a network detects an anomaly in the network based on a result of a machine learning-based anomaly detector analyzing network traffic. The node determines a packet capture policy for the anomaly by applying a machine learning-based classifier to the result of the anomaly detector. The node selects a set of packets from the analyzed traffic based on the packet capture policy. The node stores the selected set of packets for the detected anomaly.

Abstract: In one embodiment, one or more reporting nodes are selected to report network metrics in a network. From a monitoring node in the network, a trigger message is sent to the one or more reporting nodes. The trigger message may trigger the one or more reporting nodes to report one or more network metrics local to the respective reporting node. In response to the trigger message, a report of the one or more network metrics is received at the monitoring node from one of the one or more reporting nodes.

Abstract: In one embodiment, a first device in a network identifies an anomalous traffic flow in the network. The first device reports the anomalous traffic flow to a supervisory device in the network. The first device determines a quarantine policy for the anomalous traffic flow. The first device determines an action policy for the anomalous traffic flow. The first device applies the quarantine and action policies to one or more packets of the anomalous traffic flow.

Abstract: In one embodiment, a device receives health status data indicative of a health status of a data source in a network that provides collected telemetry data from the network for analysis by a machine learning-based network analyzer. The device maintains a performance model for the data source that models the health of the data source. The device computes a trustworthiness index for the telemetry data provided by the data source based on the received health status data and the performance model for the data source. The device adjusts, based on the computed trustworthiness index for the telemetry data provided by the data source, one or more parameters used by the machine learning-based network analyzer to analyze the telemetry data provided by the data source.

Abstract: In one embodiment, a first device in a network maintains raw traffic flow information for the network. The first device provides a compressed summary of the raw traffic flow information to a second device in the network. The second device is configured to transform the compressed summary for presentation to a user interface. The first device detects an anomalous traffic flow based on an analysis of the raw traffic flow information using a machine learning-based anomaly detector. The first device provides at least a portion of the raw traffic flow information related to the anomalous traffic flow to the second device for presentation to the user interface.

Abstract: In one embodiment, one or more reporting nodes are selected to report network metrics in a network. From a monitoring node in the network, a trigger message is sent to the one or more reporting nodes. The trigger message may trigger the one or more reporting nodes to report one or more network metrics local to the respective reporting node. In response to the trigger message, a report of the one or more network metrics is received at the monitoring node from one of the one or more reporting nodes.