Abstract: In some examples, an authorization controller includes a machine learning model to manage access control to a network environment by a client device based on input features to the machine learning model, the input features including user information of a user of the client device, device information representing the client device, and network information representing a network used by the client device. The machine learning model when executed by the authorization controller generates a security policy used by the authorization controller in managing the access control. A system can correlate the security policy to model parameters set by the machine learning model in generating the security policy, and use the correlation to indicate which of the input features contributed to the security policy generated by the machine learning model.

Abstract: A method of decision tree split selection is provided. The method comprises scanning, in a data source, all values of a feature and example labels. Intermediate statistics information of size O(N×C) are prepared, wherein N is the number of unique values of the feature and C is the number of label classes. A set of the N unique values of the feature are prepared with time cost O(N×C). The process then loops N times to compute heuristic scores for all splits of each unique value. Each loop has a time cost O(C). The time complexity of decision tree split selection for a single feature is O(M+N×C), wherein M is the number of examples of the feature. A model is trained in real-time with decision tree splits selected according to the heuristic scores.

Abstract: Examples described herein relate to generation of radio frequency (RF) plans for network deployments. Examples described herein may receive an input RF plan with modified set of features of a network deployment area. A first machine learning (ML) model generates an intermediate RF plan indicating candidate AP locations based on the modified set of features and a first set of parameters. A second ML model determines a network optimization score for the intermediate RF plan. Based on the optimization score, the first set of parameters are optimized. The first ML model generates an output RF plan indicating optimized AP locations based on the optimized first set of parameters and the modified set of features.

Abstract: A system receives one or more ingress data packets from a client device or a user in a network. The system obtains attributes, via packet inspection, from the one or more ingress data packets, and determines one or more embedding vectors from the attributes. The one or more embedding vectors represent a status of a session during which the ingress data packets are obtained. The system transmits the one or more embedding vectors as inputs to a trained machine learning model. The system infers, using the trained machine learning mode, one or more security policies based on the embedding vectors. The system provides or implementing the one or more security policies.

Abstract: In some examples, a system receives a first representation of attributes associated with a network stack connected to an underlay network that couples a first system to a computing environment, where the network stack comprises a plurality of layers. The system receives a second representation of attributes associated with an overlay network provided over the underlay network. The system provides the first representation and the second representation to a machine learning model trained to detect a fault associated with communications between the first system and the computing environment. The machine learning model generates an output comprising a value representing a likelihood of a presence of the fault associated with the overlay layer or the underlay layer. Based on the output, the system initiates a remediation action to address the fault.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: A forced upgrade technique for airgapped network management system (NMS) deployments utilizes a package upgrade record. The package upgrade record includes metadata about a target major version of a software package for the NMS deployment, and is generated by an update server that is airgapped from the NMS deployment. A control server of the NMS deployment determines whether the package upgrade record has been provided to the control server. Access to a user interface of the control server is denied in response to the package upgrade record not having been provided to the control server within an upgrade check window, while access to the user interface of the control server is permitted in response to the package upgrade record having been provided to the control server. Additionally, the NMS deployment may be forced to upgrade the software package to the target major.

Abstract: A process includes monitoring a plurality of message flows sent by respective network devices of a plurality of network devices. The plurality of message flows is associated with reporting a network telemetry metric to a network management system. The process includes determining that a given message flow of the plurality of message flows exhibits an unexpected behavior. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, determining an aggregate available bandwidth for message flows of the plurality of message flows, which respectively exhibit expected behaviors. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, modifying a bandwidth of the given message flow based on the aggregate available bandwidth.

Abstract: A process includes, responsive to a migration of a network device deployment from a first network management system cluster to a second network management system cluster, retaining first data in the first network management system cluster for a retention period. The data represents information about the network device deployment. The process includes receiving, by a federation layer engine of the second network management system cluster, a given query directed to information associated with the network device deployment. The process includes determining, by the federation layer engine, whether a query time that is associated with the given query is within the retention period and processing, by the federation layer engine, the given query responsive to the determination of whether the query time is within the retention period.

Abstract: In some examples, a network device receives first indicators of performances of a plurality of computing environments, and receives second indicators of performances of a plurality of network paths from the network device to the computing environments. The network device aggregates the first indicators and second indicators to produce aggregate indicators of performances of the network paths. The network device selects, based on the aggregate indicators, a selected network path of the plurality of network paths for communication of data through the network device between a client and a computing environment of the plurality of computing environments.

Abstract: A forced upgrade technique for airgapped network management system (NMS) deployments utilizes a package upgrade record. The package upgrade record includes metadata about a target major version of a software package for the NMS deployment, and is generated by an update server that is airgapped from the NMS deployment. A control server of the NMS deployment determines whether the package upgrade record has been provided to the control server. Access to a user interface of the control server is denied in response to the package upgrade record not having been provided to the control server within an upgrade check window, while access to the user interface of the control server is permitted in response to the package upgrade record having been provided to the control server. Additionally, the NMS deployment may be forced to upgrade the software package to the target major.

Abstract: In an example implementation consistent with the features disclosed herein, network management system deployments with a large operational footprint are given a longer grace period before they are forced to upgrade than network management system deployments with a small operational footprint. Criticality scores for the network management system deployments are calculated based on the operational footprints of the network management system deployments. The network management system deployments are grouped into criticality groups based on the criticality scores for the network management system deployments. The network management system deployments are forced to upgrade within timelines that are based on the criticality groups in which the network management system deployments are grouped.

Abstract: The present disclosure describes dynamic intrusion detection and prevention in computer networks. The method includes generation of clusters of network sites based on a plurality of parameters related to operational features and network threats associated with the network sites. Data models are trained upon the clusters developed through the clustering. The data models are executed to predict a threat frequency of each network threat for each cluster. A difference between the predicted threat frequency of each network threat and corresponding baseline frequencies is determined. Dynamic rulesets are configured, based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequencies, for each cluster by integrating rules applicable to prevent each network threat.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Systems and methods are provided for dynamic virtual private network concentrators (VPNC) gateway selection and on-demand VRF-ID configuration. A dynamic VPNC gateway selection component can dynamically route to a particular VPNC gateway based on multiple user-specific factors, including: a) behavior of users on the network; and b) performance of a destination service/device. A dynamic VPNC gateway selection component can rank a user based on one or more factors relating to the behavior of the user. Also, the dynamic VPNC gateway selection component can determine whether a VPNC gateway at a data center is healthy, and whether a destination service at the data center is healthy. The dynamic VPNC gateway selection component can dynamically select a VPNC gateway from a plurality of VPNC gateways at the data center for communicating forwarded traffic from the user based on the user's ranking if either the VPNC gateway or the service are unhealthy.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Automated inductive machine learning is provided. The method comprises a) receiving a dataset comprising positive examples and negative examples of a given target literal; b) learning a rule regarding the target literal from the positive examples and negative examples in the dataset according to a gini impurity heuristic; c) responsive to a determination that there are a number of the positive examples in the dataset above a specified tail value are covered by the rule: ruling out those positive examples covered by the rule from the dataset; adding the rule to a rule set; and returning to step b) to learn a new rule for the target literal according to all remaining positive examples and negative examples in the dataset; and d) responsive to a determination that there are no remaining positive examples in the dataset covered by the rule, returning the rule set to a user.

Abstract: Some examples relate to identifying a dynamic network parameter probe interval in an SD-WAN. In an example, a controller may define a probe profile of an uplink in the SD-WAN. The probe profile of the uplink may include a static probe interval and a probe retry value. The controller may determine the value of the network parameter for the uplink, prior to expiration of a static probe timer interval. If the value of the network parameter is in negative deviation with a baseline value of the network parameter, the controller may identify a dynamic probe interval for each successive determination of the value of the network parameter. The identification of the dynamic probe interval for a given successive determination may depend on at least one previously determined value of the network parameter. The controller may initiate duplicate network traffic on a secondary uplink in the SD-WAN.

Abstract: A system receives one or more ingress data packets from a client device or a user in a network. The system obtains attributes, via packet inspection, from the one or more ingress data packets, and determines one or more embedding vectors from the attributes. The one or more embedding vectors represent a status of a session during which the ingress data packets are obtained. The system transmits the one or more embedding vectors as inputs to a trained machine learning model. The system infers, using the trained machine learning mode, one or more security policies based on the embedding vectors. The system provides or implementing the one or more security policies.

Abstract: Examples described herein relate to generation of radio frequency (RF) plans for network deployments. Examples described herein may receive an input RF plan with modified set of features of a network deployment area. A first machine learning (ML) model generates an intermediate RF plan indicating candidate AR locations based on the modified set of features and a first set of parameters. A second ML model determines a network optimization score for the intermediate RF plan. Based on the optimization score, the first set of parameters are optimized. The first ML model generates an output RF plan indicating optimized AP locations based on the optimized first set of parameters and the modified set of features.