Abstract: In one embodiment, a supervisory service for a wireless network receives telemetry data indicative of client movement of wireless clients of the network within a location. The service determines a measure of client movement stability for the location, based on the received telemetry data. The service selects one or more of the clients for wireless access point reassignment, when the determined measure of client movement stability exceeds a predefined threshold. The service causes the selected one or more clients to switch from a first wireless access point at the location to a second wireless access point at the location.

Abstract: In one embodiment, a device obtains characteristics of a first anomaly detection model executed by a first distributed learning agent in a network. The device receives a query from a second distributed learning agent in the network that requests identification of a similar anomaly detection to that of a second anomaly detection model executed by the second distributed learning agent. The device identifies, after receiving the query from the second distributed learning agent, the first anomaly detection model as being similar to that of the second anomaly detection model, based on the characteristics of the first anomaly detection model. The device causes the first anomaly detection model to be sent to the second distributed learning agent for execution.

Abstract: In one embodiment, a device configures a plurality of subinterfaces for each of a plurality of physical ports of a software defined network (SDN). The device allocates a fixed amount of bandwidth to each of the subinterfaces. The device forms a plurality of midlays for the SDN by assigning subsets of the plurality of subinterfaces to each of the midlays. The device assigns a network slice to one or more of the midlays, based on a bandwidth requirement of the network slice.

Abstract: In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

Abstract: In one embodiment, a network assurance service that monitors a plurality of networks subdivides telemetry data regarding devices located in the networks into subsets, wherein each subset is associated with a device type, time period, metric type, and network. The service summarizes each subset by computing distribution percentiles of metric values in the subset. The service identifies an outlier subset by comparing distribution percentiles that summarize the subsets. The service reports insight data regarding the outlier subset to a user interface. The service adjusts the subsets based in part on feedback regarding the insight data from the user interface.

Abstract: In one embodiment, a network assurance service receives one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space. The network assurance service applies machine learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous. The network assurance service identifies, based on the labeled one or more sets of network characteristics, an anomaly pattern as a collection of unidimensional cutoffs in the feature space. The network assurance service initiates a change to the network based on the identified anomaly pattern.

Abstract: In one embodiment, an elimination point device in a network obtains a master secret from a network controller. The elimination point device assesses, using the master secret, whether an incoming packet received by the elimination point device from a redundant path between the elimination point device and a replication point device in the network includes a valid message integrity check (MIC). The elimination point device determines whether the incoming packet was injected maliciously into the redundant path, based on the assessment of the incoming packet. The elimination point device initiates performance of a mitigation action in the network, when the elimination point device determines that the incoming packet was injected maliciously into the redundant path.

Abstract: In one embodiment, a device in a network receives a path computation agent configured to determine a path in the network that satisfies an objective function. The device executes the path computation agent to update state information regarding the network maintained by the path computation agent. The device selects a neighbor of the device in the network to execute the path computation agent based on the updated state information regarding the network. The device instructs the selected neighbor to execute the path computation agent with the updated state information regarding the network. The device unloads the path computation agent from the device after selecting the neighbor of the device to execute the path computation agent.

Abstract: In one embodiment, a device receives traffic telemetry data captured by a plurality of networks and used by device classification services in the networks to classify endpoints in the networks with device types. The device compares the telemetry data from a particular one of the networks to the telemetry data from the other networks to identify one or more traffic characteristics that are missing from the telemetry data for one or more endpoints of the particular network. The device identifies a networking entity in the particular network that is common to the one or more endpoints for which the one or more characteristics are missing. The device determines a configuration change for the networking entity by comparing a current configuration of the entity to those of one or more entities in the other networks. The device initiates implementation of the determined configuration change for the entity in the particular network.

Abstract: In one embodiment, a device in a network receives anomaly data regarding an anomaly detected by a machine learning-based anomaly detection mechanism of a first node in the network. The device matches the anomaly data to threat intelligence feed data from one or more threat intelligence services. The device determines whether to provide threat intelligence feedback to the first node based on the matched threat intelligence feed data and one or more policy rules. The device provides threat intelligence feedback to the first node regarding the matched threat intelligence feed data, in response to determining that the device should provide threat intelligence feedback to the first node.

Abstract: In one embodiment, a device in a network performs anomaly detection functions using a machine learning-based anomaly detector to detect anomalous traffic in the network. The device identifies an ability of one or more nodes in the network to perform at least one of the anomaly detection functions. The device selects a particular one of the anomaly detection functions to offload to a particular one of the nodes, based on the ability of the particular node to perform the particular anomaly detection function. The device instructs the particular node to perform the selected anomaly detection function.

Abstract: In one embodiment, a supervisory device in a network forms a virtual access point (VAP) for a node in the network. A plurality of access points (APs) in the network are mapped to the VAP as part of a VAP mapping and the node treats the APs in the VAP mapping as a single AP for purposes of communicating with the network. The supervisory device determines a traffic type of traffic associated with the node. The supervisory device assigns the node to a selected wireless channel based in part on the traffic type of the traffic associated with the node. The supervisory device controls the VAP to use the channel assigned to the node.

Abstract: In one embodiment, a method comprises identifying, by a path computation element, essential parent devices from a nonstoring destination oriented directed acyclic graph (DODAG) topology as dominating set members belonging to a dominating set; receiving, by the path computation element, an advertisement message specifying a first dominating set member having reachability to a second dominating set member, the reachability distinct from the nonstoring DODAG topology; and generating, by the path computation element based on the advertisement message, an optimized path for reaching a destination network device in the nonstoring DODAG topology via a selected sequence of dominating set members, the optimized path providing cut-through optimization across the nonstoring DODAG topology.

Abstract: In one embodiment, a method comprises determining a movable network device is moving along a repeatable sequence of access point devices in a deterministic network; and establishing a deterministic track along the repeatable sequence of access point devices, the deterministic track comprising insertion slots allocated for insertion of a data packet, by the movable network device, into the deterministic track via any one of the respective access point devices.

Abstract: In one embodiment, a network assurance service receives a first set of telemetry data captured in a first network monitored by the network assurance service. The network assurance service computes, for each of a plurality of other networks monitored by the service, a similarity score between the first set of telemetry data and a set of telemetry data captured in that other network. The service selects a machine learning-based anomaly detector trained using a particular one of the sets of telemetry data captured in one of the plurality of other networks, based on the computed similarity score between the first set of telemetry data and the particular set of telemetry data captured in one of the plurality of other networks. The service uses the selected anomaly detector to assess telemetry data from the first network, until the service has received a threshold amount of telemetry data for the first network.

Abstract: In one embodiment, a supervisory device for a software defined networking (SDN) fabric predicts a failure in the SDN fabric using a machine learning-based failure prediction model. The supervisory device identifies a plurality of traffic flows having associated leaves in the SDN fabric that would be affected by the predicted failure. The supervisory device selects a subset of the identified plurality of traffic flows and their associated leaves. The supervisory device disaggregates routes for the selected subset of traffic flows and their associated leaves, to avoid the predicted failure.

Abstract: In one embodiment, a supervisory device for a software defined networking (SDN) fabric predicts characteristics of a new traffic flow to be admitted to the fabric, based on a set of initial packets of the flow. The supervisory device predicts an impact of admitting the flow to the SDN fabric, using a heatmap-based saturation model for the SDN fabric. The supervisory device admits the flow to the SDN fabric, based on the predicted impact. The supervisory device uses reinforcement learning to adjust one or more call admission control (CAC) parameters of the SDN fabric, based on captured telemetry data regarding the admitted flow.

Abstract: In one embodiment, a network assurance system discretizes parameter values of a plurality of time series of measurements obtained from a monitored network by assigning tags to the parameter values. The network assurance system detects occurrences of a particular type of failure event in the monitored network. The network assurance system identifies a set of the assigned tags that frequently co-occur with the occurrences of the particular type of failure event. The network assurance system determines, using a Bayesian framework, rankings for the tags in the identified set based on how well each of the tags acts as a predictor of the failure event. The network assurance system initiates performance of a corrective measure for the failure event based in part on the determined rankings for the tags in the identified set.

Abstract: In one embodiment, a network assurance service that monitors a network receives a plurality of key performance indicators (KPIs) for a networking device in the network over time. The network assurance service represents relationship changes between the KPIs over time as a set of one or more KPI trajectories. The network assurance service uses a machine learning-based model to determine that a behavior of the networking device is anomalous, based on the one or more KPI trajectories. The network assurance service provides an indication of the anomalous behavior of the networking device to a user interface.

Abstract: In one embodiment, a supervisory device for a software defined networking (SDN) fabric obtains telemetry data regarding congestion levels on a plurality of links in the SDN fabric. The supervisory device predicts seasonal congestion on a particular one of the plurality of links by using the telemetry data as input to a machine learning-based model. The supervisory device identifies a period of time associated with the predicted seasonal congestion on the particular link. The supervisory device initiates, in advance of the identified period of time, re-computation of equal-cost multi-path (ECMP) weights associated with the plurality of links that prevent occurrence of the predicted seasonal congestion on the particular link during the identified period of time.