Abstract: In one embodiment, a device receives path telemetry data for one or more network paths in a network over which traffic for an online application is conveyed. The device computes time series dynamics for the path telemetry data. The device determines a mapping of the time series dynamics to application experience metrics for the online application. The device routes traffic associated with the online application based on the mapping.

Abstract: In one embodiment, a device makes a prediction regarding service level agreement violations by a network transport available between a site and an online application. The device associates a risk metric with the prediction, based in part on a type of the network transport. The device computes a longevity metric for the prediction that indicates an expected validity period for the prediction. The device cause traffic to be routed between the site and the online application using the network transport, based on the prediction and its associated risk metric and its longevity metric.

Abstract: In one embodiment, a device computes an efficiency metric regarding ingestion of telemetry data from a particular portion of a network by a predictive routing engine used to make predictive routing decisions for that portion of the network. The device makes a comparison between the efficiency metric and one or more control rules. The device determines, based on the comparison, whether ingestion of the telemetry data from the particular portion of the network by the predictive routing engine should be disabled. The device causes the predictive routing engine to stop ingesting telemetry data from the particular portion of the network.

Abstract: In one embodiment, a device obtains data indicative of quality of experience for an online application. The device predicts, based on the data, path performances of network paths between an endpoint and the online application for different traffic loads. The device selects traffic loads for the network paths between the endpoint and the online application, based on the path performances predicted by the device. The device causes application traffic to be load balanced across the network paths between the endpoint and the online application, in accordance with those traffic loads selected by the device.

Abstract: In one embodiment, a device obtains metadata for routing decisions made by a predictive routing service for a plurality of network deployments. The device identifies a network topology for a network deployment that does not use the predictive routing service. The device estimates, based on the metadata for routing decisions made by the predictive routing service, performance metrics for the predictive routing service were it to be used to make routing decisions for the network topology. The device sends, to a user interface, report data indicative of the performance metrics estimated for the predictive routing service were it to be used to make routing decisions for the network topology.

Abstract: In one embodiment, a service receives software version data regarding versions of software executed by devices in a network. The service detects a version change in the version of software executed by one or more of the devices, based on the received software version data. The service makes a determination that a drop in data quality of input data for a machine learning model used to monitor the network is associated with the detected version change. The service reverts the one or more devices to a prior version of software, based on the determination that the drop in quality of the input data for the machine learning model used to monitor the network is associated with the detected version change.

Abstract: In one embodiment, a device obtains performance data regarding failures of a tunnel in a network. The device generates a failure profile for the tunnel by applying machine learning to the performance data regarding the failures of the tunnel. The device determines, based on the failure profile for the tunnel, whether the tunnel exhibits failure flapping behavior. The device adjusts one or more Bidirectional Forwarding Detection (BFD) probing timers used to detect failures of the tunnel, based on the determination as to whether the tunnel exhibits failure flapping behavior.

Abstract: In one embodiment, techniques are shown and described relating to traffic-based inference of influence domains in a network by using learning machines. In particular, in one embodiment, a management device computes a time-based traffic matrix indicating traffic between pairs of transmitter and receiver nodes in a computer network, and also determines a time-based quality parameter for a particular node in the computer network. By correlating the time-based traffic matrix and time-based quality parameter for the particular node, the device may then determine an influence of particular traffic of the traffic matrix on the particular node.

Abstract: In one embodiment, a label stability analyzer service receives classification data indicative of device type labels assigned to endpoints in a network by a device classification service. The label stability analyzer service counts device type label changes made by the device classification service to the endpoints. The label stability analyzer service computes variability metrics for the device type labels, wherein the variability metric for a device type label is based on a count of the device type label changes associated with that label. The label stability analyzer service determines, based on one of the variability metrics for a particular one of the device type labels exceeding a threshold value, a configuration change for the device classification service that adjusts how the device classification service applies the particular label to endpoints. The label stability analyzer service provides the configuration change to the device classification service.

Abstract: In one embodiment, a supervisory service for a software-defined wide area network (SD-WAN) uses a plurality of different decision thresholds for a machine learning-based classifier, to predict tunnel failures of a tunnel in the SD-WAN. The supervisory service captures performance data indicative of performance of the classifier when using the different decision thresholds. The supervisory service selects, based on the captured performance data, a particular decision threshold for the classifier, in an attempt to optimize the performance of the classifier. The supervisory service uses the selected decision threshold for the classifier, to predict a tunnel failure of the tunnel.

Abstract: In one embodiment, a device uses a multi-armed bandit model to select different network paths over time via which traffic associated with an online application is routed. The device obtains, from a provider of the online application, application experience metrics associated with the different network paths and indicative of user satisfaction with the online application. The device learns, by the multi-armed bandit model, which of the different network paths will provide satisfactory application experience metrics, based on the application experience metrics associated with the different network paths. The device causes the traffic associated with the online application to be routed via a set of one or more paths expected by the multi-armed bandit model to provide satisfactory application experience metrics for the online application.

Abstract: In one embodiment, a device obtains user experience metrics for a plurality of sessions with an online application. The device detects a plurality of anomalies from among the user experience metrics. The device determines, based on a correlation between the plurality of anomalies, that a particular path entity is a root cause of the plurality of anomalies. The particular path entity comprises an egress service provider or data center of the online application. The device provides an indication of the particular path entity being the root cause of the plurality of anomalies.

Abstract: In one embodiment, a device obtains information regarding temporary routing patches applied to a network. Each temporary routing patch implements a routing change in the network for a specified amount of time to avoid or mitigate against a service level agreement violation. The device evaluates, using the information regarding the temporary routing patches applied to the network, a plurality of replay scenarios for the network. The device determines, based on the plurality of replay scenarios, a long-term configuration change for the network. The device provides an indication of the long-term configuration change for display.

Abstract: In one embodiment, a device obtains telemetry data for network paths to a plurality of servers for an online application. The telemetry data includes application experience metrics based on feedback provided by users of the online application. The device decomposes the telemetry data for the network paths from different vantage points. The device also identifies, using the decomposed telemetry data, a particular endpoint of the online application as a cause of application experience degradation for the online application. The device provides an alert indicative of the particular endpoint of the online application being the cause of quality of experience degradation for the online application.

Abstract: In one embodiment, a device obtains an indication of a network event predicted by a routing engine for a network. The device initiates monitoring of one or more network paths associated with the network event, to determine one or more states of the network. The device makes a comparison between the one or more states of the network and a set of one or more constraints. The device provides a prediction cancelation notification to the routing engine, based on the comparison.

Abstract: In one embodiment, a device obtains a first set of measurements of a path metric for a path in a network that are measured using periodic probing of the path. The device obtains a second set of measurements of the path metric for the path that are measured using fine-grained probing of the path at a higher frequency than that of the periodic probing. The device generates a predictive model that predicts values of the path metric, based on the first set of measurements and on the second set of measurements. The device causes, based on a value of the path metric predicted by the predictive model, traffic to be rerouted from the path to another path in the network.

Abstract: In one embodiment, a controller for a network receives, via a user interface, a downgrade policy for the network that specifies an objective for path downgrades in the network. The controller identifies traffic of an application conveyed by an edge router in the network via a particular path in the network and using a first type of link. The controller predicts an effect of downgrading the particular path from using the first type of link to using a second type of link to convey the traffic of the application. The controller causes the edge router to convey the traffic of the application via the second type of link, when the effect predicted by the controller satisfies the objective specified by the downgrade policy.

Abstract: In one embodiment, a device obtains telemetry data that results from an edge router sending probes to a cloud-hosted application via a plurality of points of presence. The device makes, based on the telemetry data, predictions as to whether use of each of the plurality of points of presence by the edge router to access the cloud-hosted application will result in a violation of a service level agreement. The device selects, based on the predictions, a particular point of presence from among the plurality of points of presence that the edge router should use to access the cloud-hosted application during a time window. The device causes the edge router to access the cloud-hosted application via the particular point of presence during the time window.

Abstract: In one embodiment, a labeling service receives telemetry data for a cluster of endpoint devices in a first network environment. The endpoint devices in the cluster are clustered by a device classification service based on their telemetry data and labeled by a device type classifier of the device classification service as being of an unknown device type. The labeling service obtains a first device type label for the cluster of endpoint devices via a first user interface. The labeling service identifies one or more other network environments in which endpoint devices are located that have similar telemetry data as that of the cluster of endpoint devices. The labeling service obtains device type labels for the cluster of endpoint devices via a selected set of user interfaces from the identified one or more other network environments.

Abstract: In one embodiment, a device identifies a set of probes configured between a first endpoint and a second endpoint serving an online application. Each probe has one or more characteristics and is associated with a different segment between the endpoints. The device selects a subset of the set whose associated segments are along a plurality of paths between the endpoints, based on a match between the online application and the one or more characteristics of probes in the set of probes. The device approximates a performance metric for each of the plurality of paths by aggregating performance metrics measured by probes in the subset of probes that are associated with segments of that path. The device causes traffic to be routed between the endpoints via a particular path in the plurality of paths, based on the performance metric of the particular path.