Abstract: A process includes monitoring a plurality of message flows sent by respective network devices of a plurality of network devices. The plurality of message flows is associated with reporting a network telemetry metric to a network management system. The process includes determining that a given message flow of the plurality of message flows exhibits an unexpected behavior. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, determining an aggregate available bandwidth for message flows of the plurality of message flows, which respectively exhibit expected behaviors. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, modifying a bandwidth of the given message flow based on the aggregate available bandwidth.

Abstract: A process includes, responsive to a migration of a network device deployment from a first network management system cluster to a second network management system cluster, retaining first data in the first network management system cluster for a retention period. The data represents information about the network device deployment. The process includes receiving, by a federation layer engine of the second network management system cluster, a given query directed to information associated with the network device deployment. The process includes determining, by the federation layer engine, whether a query time that is associated with the given query is within the retention period and processing, by the federation layer engine, the given query responsive to the determination of whether the query time is within the retention period.

Abstract: In some examples, a network device receives first indicators of performances of a plurality of computing environments, and receives second indicators of performances of a plurality of network paths from the network device to the computing environments. The network device aggregates the first indicators and second indicators to produce aggregate indicators of performances of the network paths. The network device selects, based on the aggregate indicators, a selected network path of the plurality of network paths for communication of data through the network device between a client and a computing environment of the plurality of computing environments.

Abstract: A forced upgrade technique for airgapped network management system (NMS) deployments utilizes a package upgrade record. The package upgrade record includes metadata about a target major version of a software package for the NMS deployment, and is generated by an update server that is airgapped from the NMS deployment. A control server of the NMS deployment determines whether the package upgrade record has been provided to the control server. Access to a user interface of the control server is denied in response to the package upgrade record not having been provided to the control server within an upgrade check window, while access to the user interface of the control server is permitted in response to the package upgrade record having been provided to the control server. Additionally, the NMS deployment may be forced to upgrade the software package to the target major.

Abstract: In an example implementation consistent with the features disclosed herein, network management system deployments with a large operational footprint are given a longer grace period before they are forced to upgrade than network management system deployments with a small operational footprint. Criticality scores for the network management system deployments are calculated based on the operational footprints of the network management system deployments. The network management system deployments are grouped into criticality groups based on the criticality scores for the network management system deployments. The network management system deployments are forced to upgrade within timelines that are based on the criticality groups in which the network management system deployments are grouped.

Abstract: The present disclosure describes dynamic intrusion detection and prevention in computer networks. The method includes generation of clusters of network sites based on a plurality of parameters related to operational features and network threats associated with the network sites. Data models are trained upon the clusters developed through the clustering. The data models are executed to predict a threat frequency of each network threat for each cluster. A difference between the predicted threat frequency of each network threat and corresponding baseline frequencies is determined. Dynamic rulesets are configured, based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequencies, for each cluster by integrating rules applicable to prevent each network threat.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Systems and methods are provided for dynamic virtual private network concentrators (VPNC) gateway selection and on-demand VRF-ID configuration. A dynamic VPNC gateway selection component can dynamically route to a particular VPNC gateway based on multiple user-specific factors, including: a) behavior of users on the network; and b) performance of a destination service/device. A dynamic VPNC gateway selection component can rank a user based on one or more factors relating to the behavior of the user. Also, the dynamic VPNC gateway selection component can determine whether a VPNC gateway at a data center is healthy, and whether a destination service at the data center is healthy. The dynamic VPNC gateway selection component can dynamically select a VPNC gateway from a plurality of VPNC gateways at the data center for communicating forwarded traffic from the user based on the user's ranking if either the VPNC gateway or the service are unhealthy.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Automated inductive machine learning is provided. The method comprises a) receiving a dataset comprising positive examples and negative examples of a given target literal; b) learning a rule regarding the target literal from the positive examples and negative examples in the dataset according to a gini impurity heuristic; c) responsive to a determination that there are a number of the positive examples in the dataset above a specified tail value are covered by the rule: ruling out those positive examples covered by the rule from the dataset; adding the rule to a rule set; and returning to step b) to learn a new rule for the target literal according to all remaining positive examples and negative examples in the dataset; and d) responsive to a determination that there are no remaining positive examples in the dataset covered by the rule, returning the rule set to a user.

Abstract: Some examples relate to identifying a dynamic network parameter probe interval in an SD-WAN. In an example, a controller may define a probe profile of an uplink in the SD-WAN. The probe profile of the uplink may include a static probe interval and a probe retry value. The controller may determine the value of the network parameter for the uplink, prior to expiration of a static probe timer interval. If the value of the network parameter is in negative deviation with a baseline value of the network parameter, the controller may identify a dynamic probe interval for each successive determination of the value of the network parameter. The identification of the dynamic probe interval for a given successive determination may depend on at least one previously determined value of the network parameter. The controller may initiate duplicate network traffic on a secondary uplink in the SD-WAN.

Abstract: A system receives one or more ingress data packets from a client device or a user in a network. The system obtains attributes, via packet inspection, from the one or more ingress data packets, and determines one or more embedding vectors from the attributes. The one or more embedding vectors represent a status of a session during which the ingress data packets are obtained. The system transmits the one or more embedding vectors as inputs to a trained machine learning model. The system infers, using the trained machine learning mode, one or more security policies based on the embedding vectors. The system provides or implementing the one or more security policies.

Abstract: Examples described herein relate to generation of radio frequency (RF) plans for network deployments. Examples described herein may receive an input RF plan with modified set of features of a network deployment area. A first machine learning (ML) model generates an intermediate RF plan indicating candidate AR locations based on the modified set of features and a first set of parameters. A second ML model determines a network optimization score for the intermediate RF plan. Based on the optimization score, the first set of parameters are optimized. The first ML model generates an output RF plan indicating optimized AP locations based on the optimized first set of parameters and the modified set of features.

Abstract: Examples relate to a BC network including a plurality of network devices deployed in a network. The plurality of network devices includes an authoritative network device that generates a transaction in a distributed ledger. The transaction includes location information of a new public key certificate to be deployed in each of the network devices. In order to verify the transaction, a network device of the plurality of network devices verifies, using a smart contract, whether the new public key certificate is valid and whether the new public key certificate is different from a previously recorded public key certificate in the distributed ledger. In response to successful verification by at least a predefined number of network devices of the plurality of network devices, each of the network device record the transaction in the distributed ledger.

Abstract: Some examples relate to managing multicast group traffic. In an example, a switch anchor controller receives a request for a multicast group from an associated network switch in a multicast-capable network. The associated network switch registers to the switch anchor controller in the multicast-capable network. In response to the request, the switch anchor controller selects a non-anchor controller in the multicast-capable network to serve the multicast group to the associated network switch. The switch anchor controller provides the information related to the non-anchor controller to the associated network switch, which in response creates a specific multicast tunnel between the associated network switch and the non-anchor controller to transfer multicast traffic related to the multicast group.

Abstract: The present disclosure describes dynamic intrusion detection and prevention in computer networks. The method includes generation of clusters of network sites based on a plurality of parameters related to operational features and network threats associated with the network sites. Data models are trained upon the clusters developed through the clustering. The data models are executed to predict a threat frequency of each network threat for each cluster. A difference between the predicted threat frequency of each network threat and corresponding baseline frequencies is determined. Dynamic rulesets are configured, based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequencies, for each cluster by integrating rules applicable to prevent each network threat.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Examples described herein provide for associating a network device to a network management system (NMS). Examples herein include determining, by a network orchestrator, a set of embeddings indicative of characteristics of the network device and each of a plurality of instances of the NMS. Examples herein include determining, by the network orchestrator for each of the plurality of instances, a probability score based on the set of embeddings, wherein the probability score is indicative of a likelihood of the network device to be associated with the instance. Examples herein further include, based on the probability score for each of the plurality of instances, selecting, by the network orchestrator, a first instance of the plurality of instances to associate with the network device. Examples herein include associating, by the network orchestrator, the network device to the first instance.

Abstract: In an example, a Dynamic Host Configuration Protocol (DHCP) lease request from a client device connected to a network is received. Based on the DHCP lease request, an Internet Protocol (IP) address is assigned to the client device for a lease time. A first lease renewal request is received. A probability of utilization for a lease time block is predicted based on a historical lease pattern, device characteristics, traffic information, and DHCP information. Based on a combination of the probability of utilization and a reward value, the lease time block is allotted for lease renewal. For each allotment, the reward value is adjusted based on deployment characteristics and traffic load in the network, and a network connection duration of the client device. A normalized reward value for the lease time block is determined based on reward values for the lease time block over multiple allotments.

Abstract: Dynamic path steering utilizing automatic generation of user threshold profiles is described. An example of a storage medium includes instructions for obtaining a threshold policy for a first application, the threshold policy including a set of threshold values for operational parameters; generating a migration score for a first user, the migration score based at least in part on a user score for the first user; generating a set of secondary threshold values for the first user based at least in part on the migration score and the set of threshold values; enabling operation of the first application for the first user using a first network uplink; monitoring network parameter values in operation of the first application; and upon detecting an operational parameter value exceeding a secondary threshold value, migrating operation of the first application for the first user from the first network uplink to a second network uplink.