Abstract: In some examples, a system receives metrics of a plurality of network paths connected to a computing environment. The system determines performances of respective path combinations of the plurality of network paths based on the metrics. The path combinations include a first path combination including a first subset of network paths of the plurality of network paths, and second path combination including a different second subset of network paths of the plurality of network paths. The system selects, based on the determined performances, a path combination from the path combinations for a multipath session between a client device and the computing environment.

Abstract: A system and method for nationwide emergency response coordination following vehicle collisions. The system receives emergency data from vehicle computing devices and intelligently routes communications to appropriate emergency services using a pool of temporary routing numbers. The system determines the vehicle's geographic location, accesses a database of emergency service coverage areas, and selects a local provider. It obtains a temporary routing number from a managed pool and establishes a priority connection to the selected provider. The system implements sophisticated number management including verification of active usage, expiration timestamps, and automated recycling. Emergency data is transmitted through prioritized channels with confirmation tracking. The system can operate in automatic mode or with fleet manager oversight, implementing timeout-based escalation when needed.

Abstract: A process includes monitoring a plurality of message flows sent by respective network devices of a plurality of network devices. The plurality of message flows is associated with reporting a network telemetry metric to a network management system. The process includes determining that a given message flow of the plurality of message flows exhibits an unexpected behavior. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, determining an aggregate available bandwidth for message flows of the plurality of message flows, which respectively exhibit expected behaviors. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, modifying a bandwidth of the given message flow based on the aggregate available bandwidth.

Abstract: A process includes monitoring a plurality of message flows sent by respective network devices of a plurality of network devices. The plurality of message flows is associated with reporting a network telemetry metric to a network management system. The process includes determining that a given message flow of the plurality of message flows exhibits an unexpected behavior. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, determining an aggregate available bandwidth for message flows of the plurality of message flows, which respectively exhibit expected behaviors. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, modifying a bandwidth of the given message flow based on the aggregate available bandwidth.

Abstract: In some examples, an authorization controller includes a machine learning model to manage access control to a network environment by a client device based on input features to the machine learning model, the input features including user information of a user of the client device, device information representing the client device, and network information representing a network used by the client device. The machine learning model when executed by the authorization controller generates a security policy used by the authorization controller in managing the access control. A system can correlate the security policy to model parameters set by the machine learning model in generating the security policy, and use the correlation to indicate which of the input features contributed to the security policy generated by the machine learning model.

Abstract: A method of decision tree split selection is provided. The method comprises scanning, in a data source, all values of a feature and example labels. Intermediate statistics information of size O(N×C) are prepared, wherein N is the number of unique values of the feature and C is the number of label classes. A set of the N unique values of the feature are prepared with time cost O(N×C). The process then loops N times to compute heuristic scores for all splits of each unique value. Each loop has a time cost O(C). The time complexity of decision tree split selection for a single feature is O(M+N×C), wherein M is the number of examples of the feature. A model is trained in real-time with decision tree splits selected according to the heuristic scores.

Abstract: Examples described herein relate to generation of radio frequency (RF) plans for network deployments. Examples described herein may receive an input RF plan with modified set of features of a network deployment area. A first machine learning (ML) model generates an intermediate RF plan indicating candidate AP locations based on the modified set of features and a first set of parameters. A second ML model determines a network optimization score for the intermediate RF plan. Based on the optimization score, the first set of parameters are optimized. The first ML model generates an output RF plan indicating optimized AP locations based on the optimized first set of parameters and the modified set of features.

Abstract: A system receives one or more ingress data packets from a client device or a user in a network. The system obtains attributes, via packet inspection, from the one or more ingress data packets, and determines one or more embedding vectors from the attributes. The one or more embedding vectors represent a status of a session during which the ingress data packets are obtained. The system transmits the one or more embedding vectors as inputs to a trained machine learning model. The system infers, using the trained machine learning mode, one or more security policies based on the embedding vectors. The system provides or implementing the one or more security policies.

Abstract: In some examples, a system receives a first representation of attributes associated with a network stack connected to an underlay network that couples a first system to a computing environment, where the network stack comprises a plurality of layers. The system receives a second representation of attributes associated with an overlay network provided over the underlay network. The system provides the first representation and the second representation to a machine learning model trained to detect a fault associated with communications between the first system and the computing environment. The machine learning model generates an output comprising a value representing a likelihood of a presence of the fault associated with the overlay layer or the underlay layer. Based on the output, the system initiates a remediation action to address the fault.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: A forced upgrade technique for airgapped network management system (NMS) deployments utilizes a package upgrade record. The package upgrade record includes metadata about a target major version of a software package for the NMS deployment, and is generated by an update server that is airgapped from the NMS deployment. A control server of the NMS deployment determines whether the package upgrade record has been provided to the control server. Access to a user interface of the control server is denied in response to the package upgrade record not having been provided to the control server within an upgrade check window, while access to the user interface of the control server is permitted in response to the package upgrade record having been provided to the control server. Additionally, the NMS deployment may be forced to upgrade the software package to the target major.

Abstract: A process includes monitoring a plurality of message flows sent by respective network devices of a plurality of network devices. The plurality of message flows is associated with reporting a network telemetry metric to a network management system. The process includes determining that a given message flow of the plurality of message flows exhibits an unexpected behavior. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, determining an aggregate available bandwidth for message flows of the plurality of message flows, which respectively exhibit expected behaviors. The process includes, responsive to determining that the given message flow exhibits the unexpected behavior, modifying a bandwidth of the given message flow based on the aggregate available bandwidth.

Abstract: A process includes, responsive to a migration of a network device deployment from a first network management system cluster to a second network management system cluster, retaining first data in the first network management system cluster for a retention period. The data represents information about the network device deployment. The process includes receiving, by a federation layer engine of the second network management system cluster, a given query directed to information associated with the network device deployment. The process includes determining, by the federation layer engine, whether a query time that is associated with the given query is within the retention period and processing, by the federation layer engine, the given query responsive to the determination of whether the query time is within the retention period.

Abstract: In some examples, a network device receives first indicators of performances of a plurality of computing environments, and receives second indicators of performances of a plurality of network paths from the network device to the computing environments. The network device aggregates the first indicators and second indicators to produce aggregate indicators of performances of the network paths. The network device selects, based on the aggregate indicators, a selected network path of the plurality of network paths for communication of data through the network device between a client and a computing environment of the plurality of computing environments.

Abstract: A forced upgrade technique for airgapped network management system (NMS) deployments utilizes a package upgrade record. The package upgrade record includes metadata about a target major version of a software package for the NMS deployment, and is generated by an update server that is airgapped from the NMS deployment. A control server of the NMS deployment determines whether the package upgrade record has been provided to the control server. Access to a user interface of the control server is denied in response to the package upgrade record not having been provided to the control server within an upgrade check window, while access to the user interface of the control server is permitted in response to the package upgrade record having been provided to the control server. Additionally, the NMS deployment may be forced to upgrade the software package to the target major.

Abstract: In an example implementation consistent with the features disclosed herein, network management system deployments with a large operational footprint are given a longer grace period before they are forced to upgrade than network management system deployments with a small operational footprint. Criticality scores for the network management system deployments are calculated based on the operational footprints of the network management system deployments. The network management system deployments are grouped into criticality groups based on the criticality scores for the network management system deployments. The network management system deployments are forced to upgrade within timelines that are based on the criticality groups in which the network management system deployments are grouped.

Abstract: The present disclosure describes dynamic intrusion detection and prevention in computer networks. The method includes generation of clusters of network sites based on a plurality of parameters related to operational features and network threats associated with the network sites. Data models are trained upon the clusters developed through the clustering. The data models are executed to predict a threat frequency of each network threat for each cluster. A difference between the predicted threat frequency of each network threat and corresponding baseline frequencies is determined. Dynamic rulesets are configured, based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequencies, for each cluster by integrating rules applicable to prevent each network threat.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Abstract: Systems and methods are provided for dynamic virtual private network concentrators (VPNC) gateway selection and on-demand VRF-ID configuration. A dynamic VPNC gateway selection component can dynamically route to a particular VPNC gateway based on multiple user-specific factors, including: a) behavior of users on the network; and b) performance of a destination service/device. A dynamic VPNC gateway selection component can rank a user based on one or more factors relating to the behavior of the user. Also, the dynamic VPNC gateway selection component can determine whether a VPNC gateway at a data center is healthy, and whether a destination service at the data center is healthy. The dynamic VPNC gateway selection component can dynamically select a VPNC gateway from a plurality of VPNC gateways at the data center for communicating forwarded traffic from the user based on the user's ranking if either the VPNC gateway or the service are unhealthy.

Abstract: Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.