Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Systems and methods are provided for dynamic virtual private network concentrators (VPNC) gateway selection and on-demand VRF-ID configuration. A dynamic VPNC gateway selection component can dynamically route to a particular VPNC gateway based on multiple user-specific factors, including: a) behavior of users on the network; and b) performance of a destination service/device. A dynamic VPNC gateway selection component can rank a user based on one or more factors relating to the behavior of the user. Also, the dynamic VPNC gateway selection component can determine whether a VPNC gateway at a data center is healthy, and whether a destination service at the data center is healthy. The dynamic VPNC gateway selection component can dynamically select a VPNC gateway from a plurality of VPNC gateways at the data center for communicating forwarded traffic from the user based on the user's ranking if either the VPNC gateway or the service are unhealthy.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Some examples relate to identifying a dynamic network parameter probe interval in an SD-WAN. In an example, a controller may define a probe profile of an uplink in the SD-WAN. The probe profile of the uplink may include a static probe interval and a probe retry value. The controller may determine the value of the network parameter for the uplink, prior to expiration of a static probe timer interval. If the value of the network parameter is in negative deviation with a baseline value of the network parameter, the controller may identify a dynamic probe interval for each successive determination of the value of the network parameter. The identification of the dynamic probe interval for a given successive determination may depend on at least one previously determined value of the network parameter. The controller may initiate duplicate network traffic on a secondary uplink in the SD-WAN.

Abstract: A system receives one or more ingress data packets from a client device or a user in a network. The system obtains attributes, via packet inspection, from the one or more ingress data packets, and determines one or more embedding vectors from the attributes. The one or more embedding vectors represent a status of a session during which the ingress data packets are obtained. The system transmits the one or more embedding vectors as inputs to a trained machine learning model. The system infers, using the trained machine learning mode, one or more security policies based on the embedding vectors. The system provides or implementing the one or more security policies.

Abstract: Examples relate to a BC network including a plurality of network devices deployed in a network. The plurality of network devices includes an authoritative network device that generates a transaction in a distributed ledger. The transaction includes location information of a new public key certificate to be deployed in each of the network devices. In order to verify the transaction, a network device of the plurality of network devices verifies, using a smart contract, whether the new public key certificate is valid and whether the new public key certificate is different from a previously recorded public key certificate in the distributed ledger. In response to successful verification by at least a predefined number of network devices of the plurality of network devices, each of the network device record the transaction in the distributed ledger.

Abstract: Systems and methods are provided for clustering network devices into cohorts. Next, the systems may determine a subset of the network devices between which tunnels are created, based on any of amounts of available memory, jitter, latency, packet loss, and average round trip time. The selective determination may include, determining to create a first tunnel between a first network device of the first cohort and a second network device within the first cohort, and a second tunnel between the first network device and a third network device within the second cohort, and determining not to create tunnels between first remaining network devices of the first cohort and the second set of network devices of the second cohort. The systems provision the tunnel and the second tunnel to transmit data.

Abstract: Some examples relate to managing multicast group traffic. In an example, a switch anchor controller receives a request for a multicast group from an associated network switch in a multicast-capable network. The associated network switch registers to the switch anchor controller in the multicast-capable network. In response to the request, the switch anchor controller selects a non-anchor controller in the multicast-capable network to serve the multicast group to the associated network switch. The switch anchor controller provides the information related to the non-anchor controller to the associated network switch, which in response creates a specific multicast tunnel between the associated network switch and the non-anchor controller to transfer multicast traffic related to the multicast group.

Abstract: The present disclosure describes dynamic intrusion detection and prevention in computer networks. The method includes generation of clusters of network sites based on a plurality of parameters related to operational features and network threats associated with the network sites. Data models are trained upon the clusters developed through the clustering. The data models are executed to predict a threat frequency of each network threat for each cluster. A difference between the predicted threat frequency of each network threat and corresponding baseline frequencies is determined. Dynamic rulesets are configured, based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequencies, for each cluster by integrating rules applicable to prevent each network threat.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: In an example, a Dynamic Host Configuration Protocol (DHCP) lease request from a client device connected to a network is received. Based on the DHCP lease request, an Internet Protocol (IP) address is assigned to the client device for a lease time. A first lease renewal request is received. A probability of utilization for a lease time block is predicted based on a historical lease pattern, device characteristics, traffic information, and DHCP information. Based on a combination of the probability of utilization and a reward value, the lease time block is allotted for lease renewal. For each allotment, the reward value is adjusted based on deployment characteristics and traffic load in the network, and a network connection duration of the client device. A normalized reward value for the lease time block is determined based on reward values for the lease time block over multiple allotments.

Abstract: Dynamic path steering utilizing automatic generation of user threshold profiles is described. An example of a storage medium includes instructions for obtaining a threshold policy for a first application, the threshold policy including a set of threshold values for operational parameters; generating a migration score for a first user, the migration score based at least in part on a user score for the first user; generating a set of secondary threshold values for the first user based at least in part on the migration score and the set of threshold values; enabling operation of the first application for the first user using a first network uplink; monitoring network parameter values in operation of the first application; and upon detecting an operational parameter value exceeding a secondary threshold value, migrating operation of the first application for the first user from the first network uplink to a second network uplink.

Abstract: Systems and methods are provided for dynamic virtual private network concentrators (VPNC) gateway selection and on-demand VRF-ID configuration. A dynamic VPNC gateway selection component can dynamically route to a particular VPNC gateway based on multiple user-specific factors, including: a) behavior of users on the network; and b) performance of a destination service/device. A dynamic VPNC gateway selection component can rank a user based on one or more factors relating to the behavior of the user. Also, the dynamic VPNC gateway selection component can determine whether a VPNC gateway at a data center is healthy, and whether a destination service at the data center is healthy. The dynamic VPNC gateway selection component can dynamically select a VPNC gateway from a plurality of VPNC gateways at the data center for communicating forwarded traffic from the user based on the user's ranking if either the VPNC gateway or the service are unhealthy.

Abstract: Examples relate to a BC network including a plurality of network devices deployed in a network. The plurality of network devices includes an authoritative network device that generates a transaction in a distributed ledger. The transaction includes location information of a new public key certificate to be deployed in each of the network devices. In order to verify the transaction, a network device of the plurality of network devices verifies, using a smart contract, whether the new public key certificate is valid and whether the new public key certificate is different from a previously recorded public key certificate in the distributed ledger. In response to successful verification by at least a predefined number of network devices of the plurality of network devices, each of the network device record the transaction in the distributed ledger.

Abstract: Some examples relate to managing multicast group traffic. In an example, a switch anchor controller receives a request for a multicast group from an associated network switch in a multicast-capable network. The associated network switch registers to the switch anchor controller in the multicast-capable network. In response to the request, the switch anchor controller selects a non-anchor controller in the multicast-capable network to serve the multicast group to the associated network switch. The switch anchor controller provides the information related to the non-anchor controller to the associated network switch, which in response creates a specific multicast tunnel between the associated network switch and the non-anchor controller to transfer multicast traffic related to the multicast group.

Abstract: An example non-transitory, computer-readable medium includes instructions that cause a device to determine, for uplinks of a branch gateway, a link health baseline. The instructions further cause the device to determine, for a set of criticality classes, a class link health baseline for each link health baseline, based on the link health baseline and a tolerance level of each criticality class. The instructions further cause the device to calculate, based in part on weighted parameters of the class link health baselines and an uplink cost, a path quality threshold score for each application category and for each uplink. The instructions further cause the device to select, for each application category, a primary uplink and a secondary uplink based on the path quality threshold scores. The instructions further cause the device to route network traffic through the primary uplink of the application category assigned to the network traffic.

Abstract: Examples include detection of a status of an uplink in an SD-WAN. Some examples use a predicted probe profile determined based on predicted RTT values generated using a machine learning algorithm for estimating whether the uplink is failed. In response to estimating that the uplink is failed, some examples compute a confidence level value and determine whether the estimated failure of the uplink is acceptable based on the confidence level value to detect a status of the uplink.

Abstract: Dynamic path steering utilizing automatic generation of user threshold profiles is described. An example of a storage medium includes instructions for obtaining a threshold policy for a first application, the threshold policy including a set of threshold values for operational parameters; generating a migration score for a first user, the migration score based at least in part on a user score for the first user; generating a set of secondary threshold values for the first user based at least in part on the migration score and the set of threshold values; enabling operation of the first application for the first user using a first network uplink; monitoring network parameter values in operation of the first application; and upon detecting an operational parameter value exceeding a secondary threshold value, migrating operation of the first application for the first user from the first network uplink to a second network uplink.

Abstract: Some examples relate to identifying a dynamic network parameter probe interval in an SD-WAN. In an example, a controller may define a probe profile of an uplink in the SD-WAN. The probe profile of the uplink may include a static probe interval and a probe retry value. The controller may determine the value of the network parameter for the uplink, prior to expiration of a static probe timer interval. If the value of the network parameter is in negative deviation with a baseline value of the network parameter, the controller may identify a dynamic probe interval for each successive determination of the value of the network parameter. The identification of the dynamic probe interval for a given successive determination may depend on at least one previously determined value of the network parameter. The controller may initiate duplicate network traffic on a secondary uplink in the SD-WAN.

Abstract: An example branch gateway includes processing circuitry and a memory including instructions that cause the branch gateway to perform various functions. The various functions include determining a first uplink health threshold, determining a second uplink health threshold, calculating migration thresholds for a set of non-critical applications, determining that a QoS threshold of a critical application is likely to be imminently breached, selecting a least critical application, based on the migration threshold of the least critical application, and migrating the least critical application from the first uplink to a second uplink.