Abstract: In one embodiment, a supervisory service for a network obtains quality of experience metrics for application sessions of an online application. The supervisory service maps the application sessions to paths that traverse a plurality of autonomous systems. The supervisory service identifies, based in part on the quality of experience metrics, a particular autonomous system from the plurality of autonomous systems associated with a decreased quality of experience for the online application. The supervisory service causes application traffic for the online application to avoid the particular autonomous system.

Abstract: In one embodiment, a device obtains data regarding routing decisions made by a machine learning-based predictive routing engine for a network. The device determines, based on the data regarding the routing decisions, a behavior of the machine learning-based predictive routing engine. The device compares the behavior of the machine learning-based predictive routing engine to a behavioral policy for the machine learning-based predictive routing engine. The device adjusts operation of the machine learning-based predictive routing engine, when the behavior of the machine learning-based predictive routing engine violates the behavioral policy.

Abstract: In one embodiment, a service identifies a set of attributes associated with a first machine learning model trained to make an inference about a computer network. The service obtains labels for each of the set of attributes, each label indicating whether its corresponding attribute is a probable cause of the inference. The service maps input features of the first machine learning model to those attributes in the set of attributes that were labeled as probable causes of the inference. The service generates a second machine learning model in part by using the mapped attributes to form a set of input features for the second machine learning model, whereby the input features of the first machine learning model and the input features of the second machine learning model differ.

Abstract: In one embodiment, a device obtains telemetry data that results from an edge router sending probes to a cloud-hosted application via a plurality of points of presence. The device makes, based on the telemetry data, predictions as to whether use of each of the plurality of points of presence by the edge router to access the cloud-hosted application will result in a violation of a service level agreement. The device selects, based on the predictions, a particular point of presence from among the plurality of points of presence that the edge router should use to access the cloud-hosted application during a time window. The device causes the edge router to access the cloud-hosted application via the particular point of presence during the time window.

Abstract: In one embodiment, a service receives software version data regarding versions of software executed by devices in a network. The service detects a version change in the version of software executed by one or more of the devices, based on the received software version data. The service makes a determination that a drop in data quality of input data for a machine learning model used to monitor the network is associated with the detected version change. The service reverts the one or more devices to a prior version of software, based on the determination that the drop in quality of the input data for the machine learning model used to monitor the network is associated with the detected version change.

Abstract: In one embodiment, a service in a network computes an expected information gain associated with rerouting traffic from a first tunnel onto a backup tunnel in the network. The service initiates, based on the expected information gain, rerouting of the traffic from the first tunnel onto the backup tunnel. The service obtains performance measurements for the traffic rerouted onto the backup tunnel. The service uses the performance measurements to train a machine learning model to predict whether rerouting traffic from the first tunnel onto the backup tunnel will satisfy a service level agreement (SLA) of the traffic.

Abstract: In one embodiment, a device receives application experience metrics for a software-as-a-service application. The device generates, based on the application experience metrics, a predictive model that predicts application experience scores for a plurality of network service providers that provide connectivity to the software-as-a-service application. The device selects a particular network service provider for use by a location, based on an application experience score predicted by the predictive model. The device sends an indication of the particular network service provider to the location.

Abstract: In one embodiment, a service tracks performance of a machine learning model over time. The machine learning model is used to monitor one or more computer networks based on data collected from the one or more computer networks. The service also tracks performance metrics associated with training of the machine learning model. The service determines that a degradation of the performance of the machine learning model is anomalous, based on the tracked performance of the machine learning model and performance metrics associated with training of the model. The service initiates a corrective measure for the degradation of the performance, in response to determining that the degradation of the performance is anomalous.

Abstract: In one embodiment, a device obtains behavioral metrics for application traffic in a network for a plurality of applications. The device identifies a first application and a second application from among the plurality of applications as fate sharing applications, based on a correlation between the behavioral metrics for their application traffic. The device generates a configuration change for the network that would prevent the first application and the second application from being fate sharing applications, when application traffic for the first application negatively affects the behavioral metrics for the application traffic of the second application. The device causes the configuration change to be implemented in the network.

Abstract: In one embodiment, a device obtains characteristics of a first anomaly detection model executed by a first distributed learning agent in a network. The device receives a query from a second distributed learning agent in the network that requests identification of a similar anomaly detection to that of a second anomaly detection model executed by the second distributed learning agent. The device identifies, after receiving the query from the second distributed learning agent, the first anomaly detection model as being similar to that of the second anomaly detection model, based on the characteristics of the first anomaly detection model. The device causes the first anomaly detection model to be sent to the second distributed learning agent for execution.

Abstract: In one embodiment, a device receives application experience metrics for a software-as-a-service application. The device generates, based on the application experience metrics, a predictive model that predicts application experience scores for a plurality of network service providers that provide connectivity to the software-as-a-service application. The device selects a particular network service provider for use by a location, based on an application experience score predicted by the predictive model. The device sends an indication of the particular network service provider to the location.

Abstract: In one embodiment, a device uses a classification model to determine whether implementation of a routing change suggested by a predictive routing engine for a network will result in a violation of one or more network policies. The device computes a trust score, based on performance metrics for the classification model. The device causes, based in part on the trust score, implementation of the routing change in the network, when the classification model determines that application of the routing change will not result in a violation of the one or more network policies.

Abstract: In one embodiment, a device obtains routing forecasts for a software defined network. The device splits a particular routing policy for the software defined network into two or more routing policies, based on the routing forecasts. The device makes an evaluation as to whether the two or more routing policies should be reverted back into the particular routing policy. The device sends, to a user interface, data indicative of the particular routing policy that was split into the two or more routing policies and the evaluation as to whether the two or more routing policies should be reverted back into the particular routing policy.

Abstract: In various embodiments, a device classification service obtains traffic telemetry data for a plurality of devices in a network. The service applies clustering to the traffic telemetry data, to form device clusters. The service generates a device classification rule based on a particular one of the device clusters. The service receives feedback from a user interface regarding the device classification rule. The service adjusts the device classification rule based on the received feedback.

Abstract: In one embodiment, a device predicts a failure of a first tunnel in a software-defined wide area network (SD-WAN). The device determines that no backup tunnel for the first tunnel exists in the SD-WAN that can satisfy one or more service level agreements (SLAs) of traffic on the first tunnel, were the traffic rerouted from the first tunnel onto that tunnel. The device predicts, using a machine learning model, that a backup tunnel for the first tunnel exists in the SD-WAN that can satisfy an SLA of a subset of the traffic on the first tunnel, in response to determining that no backup tunnel exists in the SD-WAN that can satisfy the one or more SLAs of the traffic on the first tunnel. The device proactively reroutes the subset of the traffic on the first tunnel onto the backup tunnel, in advance of the predicted failure of the first tunnel.

Abstract: In one embodiment, a controller obtains data indicative of an application experience metric for an online application having application traffic conveyed via the network. The controller predicts the application experience metric that would result from a first edge router conveying its application traffic to the online application via a second edge router that is not currently connected to the first edge router via a tunnel, based on the obtained data. The controller makes a determination that the first edge router should route its application traffic to the online application via a tunnel between the first edge router and the second edge router, based on the predicted application experience metric. The controller causes a tunnel to be established in the network between the first edge router and the second edge router, whereby the first edge router routes its application traffic to the online application via the second edge router.

Abstract: In one embodiment, a device predicts a range of bitrates expected to be required by one or more applications associated with traffic conveyed via a particular path in a network. The device obtains telemetry data indicative of observed bitrates associated with the traffic conveyed via the particular path in the network. The device identifies, a presence of congestion along the particular path in the network, by comparing the observed bitrates to the range of bitrates expected to be required by the one or more applications. The device causes at least a portion of the traffic to be re-routed from the particular path to a second path in the network, when the device identifies the presence of congestion along the particular path.

Abstract: In one embodiment, a device identifies a sudden change in a time series of a quality of service metric for a first path in a network that violates a service level agreement threshold associated with application traffic conveyed via the first path. The device predicts a length of time that the sudden change in the time series will last. The device determines, based in part on the length of time that the sudden change in the time series is predicted to last, that the application traffic should be rerouted onto a second path in the network. The device causes the application traffic to be rerouted onto the second path in the network.

Abstract: In one embodiment, a supervisory service for a network obtains a first set of user experience survey data from users of an online application whose traffic was rerouted by a predictive routing engine. The supervisory service obtains a second set of user experience survey data from users of the online application whose traffic was not rerouted by the predictive routing engine. The supervisory service generates, using the first set of user experience survey data and the second set of user experience survey data, a user experience prediction model to predict user experience scores for the online application. The supervisory service adjusts the predictive routing engine using predicted user experience scores from the user experience prediction model.

Abstract: In one embodiment, a device classification service obtains telemetry data for a plurality of devices in a network. The device classification service repeatedly assigns the devices to device clusters by applying clustering to the obtained telemetry data. The device classification service determines a measure of stability loss associated with the cluster assignments. The measure of stability loss is based in part on whether a device is repeatedly assigned to the same device cluster. The device classification service determines, based on the measure of stability loss, that the cluster assignments have stabilized. The device classification service obtains device type labels for the device clusters, after determining that the cluster assignments have stabilized.