Abstract: In one embodiment, a controller obtains data indicative of an application experience metric for an online application having application traffic conveyed via the network. The controller predicts the application experience metric that would result from a first edge router conveying its application traffic to the online application via a second edge router that is not currently connected to the first edge router via a tunnel, based on the obtained data. The controller makes a determination that the first edge router should route its application traffic to the online application via a tunnel between the first edge router and the second edge router, based on the predicted application experience metric. The controller causes a tunnel to be established in the network between the first edge router and the second edge router, whereby the first edge router routes its application traffic to the online application via the second edge router.

Abstract: In one embodiment, a device obtains, from a plurality of routers in a network, a set of routing policies that collectively specify a first set of paths in the network, a second set of paths in the network, and time periods during which traffic is to be rerouted from one of the first set of paths to one of the second set of paths in the network. The device identifies overlapping path segments of the second set of paths in the network. The device makes, based in part on the overlapping path segments, a prediction that two or more of the set of routing policies will cause congestion along paths with overlapping path segments. The device adjusts, based on the prediction, the set of routing policies, to avoid causing the congestion.

Abstract: In one embodiment, a controller for a network receives, via a user interface, a downgrade policy for the network that specifies an objective for path downgrades in the network. The controller identifies traffic of an application conveyed by an edge router in the network via a particular path in the network and using a first type of link. The controller predicts an effect of downgrading the particular path from using the first type of link to using a second type of link to convey the traffic of the application. The controller causes the edge router to convey the traffic of the application via the second type of link, when the effect predicted by the controller satisfies the objective specified by the downgrade policy.

Abstract: In one embodiment, a device obtains routing forecasts for a software defined network. The device splits a particular routing policy for the software defined network into two or more routing policies, based on the routing forecasts. The device makes an evaluation as to whether the two or more routing policies should be reverted back into the particular routing policy. The device sends, to a user interface, data indicative of the particular routing policy that was split into the two or more routing policies and the evaluation as to whether the two or more routing policies should be reverted back into the particular routing policy.

Abstract: In one embodiment, a device deploys a first machine learning model to an inference location in a network. The first machine learning model is used at the inference location to make inferences about the network. The device receives, from the inference location, an indication that the first machine learning model is exhibiting poor performance. The device identifies a corrective measure for the poor performance that minimizes resource consumption by a model training pipeline of the device. The device deploys, based on the corrective measure, a second machine learning model to the inference location. The second machine learning model is used in lieu of the first machine learning model to make the inferences about the network.

Abstract: In one embodiment, a device identifies a set of probes configured between a first endpoint and a second endpoint serving an online application. Each probe has one or more characteristics and is associated with a different segment between the endpoints. The device selects a subset of the set whose associated segments are along a plurality of paths between the endpoints, based on a match between the online application and the one or more characteristics of probes in the set of probes. The device approximates a performance metric for each of the plurality of paths by aggregating performance metrics measured by probes in the subset of probes that are associated with segments of that path. The device causes traffic to be routed between the endpoints via a particular path in the plurality of paths, based on the performance metric of the particular path.

Abstract: In one embodiment, a device calculates one or more distributions of bitrates associated with an application whose traffic is conveyed via one or more paths in a network. The device detects throughput modes of the application, based on the one or more distributions of bitrates associated with the application. The device associates each throughput mode with a quality of experience label, to form a plurality of pairs of throughput modes and quality of experience labels. The device estimates a quality of experience metric for the application, based on a bitrate of the application and the plurality of pairs of throughput modes and quality of experience labels.

Abstract: In various embodiments, a device classification service obtains data indicative of device attributes of a plurality of devices. The device classification service forms, based on the obtained data indicative of the device attributes, a concept graph that comprises nodes that represent different sets of the device attributes. The device classification service determines, by analyzing the concept graph, a relevance score for each of the device attributes that quantifies how relevant that attribute is to classifying a device by its device type. The device classification service uses the relevance scores for the device attributes to cluster the plurality of devices into device type clusters by their device attributes.

Abstract: In one embodiment, a service receives software version data regarding versions of software executed by devices in a network. The service detects a version change in the version of software executed by one or more of the devices, based on the received software version data. The service makes a determination that a drop in data quality of input data for a machine learning model used to monitor the network is associated with the detected version change. The service reverts the one or more devices to a prior version of software, based on the determination that the drop in quality of the input data for the machine learning model used to monitor the network is associated with the detected version change.

Abstract: In one embodiment, a service in a network computes an expected information gain associated with rerouting traffic from a first tunnel onto a backup tunnel in the network. The service initiates, based on the expected information gain, rerouting of the traffic from the first tunnel onto the backup tunnel. The service obtains performance measurements for the traffic rerouted onto the backup tunnel. The service uses the performance measurements to train a machine learning model to predict whether rerouting traffic from the first tunnel onto the backup tunnel will satisfy a service level agreement (SLA) of the traffic.

Abstract: In one embodiment, a device receives data regarding usage of access points in a network by a plurality of clients in the network. The device maintains an access point graph that represents the access points in the network as vertices of the access point graph. The device generates, for each of the plurality of clients, client trajectories as trajectory subgraphs of the access point graph. A particular client trajectory for a particular client comprises a set of edges between a subset of the vertices of the access point graph and represents transitions between access points in the network performed by the particular client. The device identifies a transition pattern from the client trajectories by deconstructing the trajectory subgraphs. The device uses the identified transition pattern to effect a configuration change in the network.

Abstract: In one embodiment, a service computes a data fidelity metric for network telemetry data used by a machine learning model to monitor a computer network. The service detects unacceptable performance of the machine learning model. The service determines a correlation between the data fidelity metric and the unacceptable performance of the machine learning model. The service adjusts generation of the network telemetry data for input to the machine learning model, based on the determined correlation between the data fidelity metric and the unacceptable performance of the machine learning model.

Abstract: In one embodiment, a device makes a first determination as to whether a time series of a performance metric for a first network path exhibits seasonality. The device makes a second determination as to whether the time series exhibits a trend. The device predicts, based on the first determination and on the second determination, the performance metric for the first network path during a future time period. The device assesses, based on the performance metric predicted for the first network path, whether a measure of application experience will degrade for application traffic sent via the first network path. The device causes the application traffic to be proactively switched to a second network path, when the measure of application experience is expected to degrade.

Abstract: In various embodiments, a device classification service uses an initial device classification rule to label each of a set of endpoint devices in a network as being of a particular device type. The device classification service identifies a particular attribute exhibited by at least a portion of the set of endpoint devices and was not previously used to generate the initial device classification rule. The device classification service generates one or more new device classification rules based in part on the particular attribute. The device classification service switches from using the initial device classification rule to label endpoint devices in the network to using the one or more new device classification rules to label endpoint devices in the network.

Abstract: In one embodiment, a networking device reroutes traffic in a network from a first path to a second path, based on a prediction that the first path will not satisfy a service level agreement associated with the traffic. The networking device enters a fast monitoring state during which the networking device performs fast probing of the first path and of the second path onto which the traffic was rerouted. The networking device makes, based on the fast probing, a determination as to whether the first path would have violated the service level agreement and whether the second path violates the service level agreement. The networking device enacts a routing decision for the traffic by applying a routing policy to the determination.

Abstract: In one embodiment, a device obtains traffic telemetry data regarding a first path in a network and an alternate path in the network. The device predicts, based on the traffic telemetry data, an amount of traffic for an application that is expected at a particular time. The device makes, based on the traffic telemetry data and on the amount of traffic for the application that is predicted to be expected at the particular time, a counterfactual prediction as to whether the alternate path would violate a service level agreement associated with the traffic, should the traffic be routed via the alternate path at the particular time. The device causes, based on the counterfactual prediction, the traffic for the application to be rerouted from the first path in the network to the alternate path, prior to the particular time.

Abstract: In one embodiment, a device forms a telemetry cluster by applying clustering to telemetry data regarding a plurality of network connections over an access network between a plurality of entities and a remote application. The device applies anomaly detection to the telemetry cluster, to identify one or more anomalies. The device makes a determination as to whether the one or more anomalies are attributable to the remote application or to the access network. The device initiates a corrective measure, based on the determination as to whether the one or more anomalies are attributable to the remote application or to the access network.

Abstract: In one embodiment, a network assurance service that monitors one or more networks identifies changes in a key performance indicator for each of a plurality of network entities in the one or more networks. The service forms a peer group of network entities from the plurality of network entities whose changes in the key performance indicator are correlated. The service monitors the key performance indicator for network entities in the peer group of network entities. The service, based on the monitoring, detects an anomalous change in the key performance indicator for a particular network entity in the peer group of network entities relative to other network entities in the peer group of network entities.

Abstract: In one embodiment, a device obtains, from a plurality of routers in a network, a set of routing patches that collectively specify a first set of paths in the network, a second set of paths in the network, and time periods during which traffic is to be rerouted from one of the first set of paths to one of the second set of paths in the network. The device identifies overlapping path segments of the second set of paths in the network. The device makes, based in part on the overlapping path segments, a prediction that two or more of the set of routing patches will cause congestion along paths with overlapping path segments. The device adjusts, based on the prediction, the set of routing patches, to avoid causing the congestion.

Abstract: In one embodiment, a device calculates one or more distributions of bitrates associated with an application whose traffic is conveyed via one or more paths in a network. The device detects throughput modes of the application, based on the one or more distributions of bitrates associated with the application. The device associates each throughput mode with a quality of experience label, to form a plurality of pairs of throughput modes and quality of experience labels. The device estimates a quality of experience metric for the application, based on a bitrate of the application and the plurality of pairs of throughput modes and quality of experience labels.