Abstract: In one embodiment, a device forms clusters of network paths via which traffic for an online application is conveyed by applying clustering to time series of quality of experience metrics for the online application. The device calculates, for a particular cluster of network paths among the clusters of network paths, correlation metrics between path features of those network paths of that cluster. The device selects, based on the correlation metrics, a particular path feature from among the path features as a root cause of poor quality of experience metrics for the online application along the network paths of the particular cluster of network paths. The device provides, to a user interface, an indication of the particular path feature as being the root cause of poor quality of experience metrics for the online application.

Abstract: In one embodiment, a method comprises: receiving, by a constrained wireless network device comprising a local clock, a plurality of messages from respective neighboring wireless network devices advertising as available parent devices in a directed acyclic graph of a time-synchronized network that is synchronized to a master clock device; determining, by the constrained wireless network device, a corresponding timing error of the local clock relative to each message output by the corresponding available parent device; and executing, by the constrained wireless network device, a distributed time synchronization of the local clock with the master clock device based on correlating the respective timing errors relative to the local clock.

Abstract: In one embodiment, a device classification service uses feature vectors that represent how frequently one or more traffic features were observed in a network during different time windows to train a cascade of machine learning classifiers to label one or more devices in the network with a device type. The service receives traffic features of traffic associated with a particular device in the network, and then uses the cascade of machine learning classifiers to assign a device type label to the particular device based on the traffic features of the traffic associated with the particular device. The service initiates enforcement of a network policy regarding the device based on its device type based on the device type label assigned to the particular device.

Abstract: In one embodiment, a device obtains behavioral metrics for application traffic in a network for a plurality of applications. The device identifies a first application and a second application from among the plurality of applications as fate sharing applications, based on a correlation between the behavioral metrics for their application traffic. The device generates a configuration change for the network that would prevent the first application and the second application from being fate sharing applications, when application traffic for the first application negatively affects the behavioral metrics for the application traffic of the second application. The device causes the configuration change to be implemented in the network.

Abstract: In one embodiment, a device receives application experience metrics for a software-as-a-service application served by a plurality of application endpoints. The device generates, based on the application experience metrics, a predictive model that predicts application experience scores for connections between a service provider network and the plurality of application endpoints. The device selects a particular application endpoint for the service provider network, based on an application experience score predicted by the predictive model. The device sends an indication an indication of the particular application endpoint selected by the device to the software-as-a-service application. The indication is used to assign a connection between the service provider network and the particular application endpoint.

Abstract: In various embodiments, a device classification service obtains device telemetry data indicative of declarative attributes of a device in a network and indicative of behavioral attributes of that device. The device classification service labels the device with a device type, based on the device telemetry data. The device classification service detects device type spoofing exhibited by the device using a model that models a relationship between the declarative attributes and the behavioral attributes. The device classification service initiates, based on the device type spoofing, a mitigation action regarding the device.

Abstract: In one embodiment, a device uses a classification model to determine whether implementation of a routing change suggested by a predictive routing engine for a network will result in a violation of one or more network policies. The device computes a trust score, based on performance metrics for the classification model. The device causes, based in part on the trust score, implementation of the routing change in the network, when the classification model determines that application of the routing change will not result in a violation of the one or more network policies.

Abstract: In one embodiment, a supervisory service for a software-defined wide area network (SD-WAN) obtains telemetry data from one or more edge devices in the SD-WAN. The service trains, using the telemetry data as training data, a machine learning-based model to predict tunnel failures in the SD-WAN. The service receives feedback from the one or more edge devices regarding failure predictions made by the trained machine learning-based model. The service retrains the machine learning-based model, based on the received feedback.

Abstract: In one embodiment, a device obtains user experience metrics for a plurality of sessions with an online application. The device detects a plurality of anomalies from among the user experience metrics. The device determines, based on a correlation between the plurality of anomalies, that a particular path entity is a root cause of the plurality of anomalies. The particular path entity comprises an egress service provider or data center of the online application. The device provides an indication of the particular path entity being the root cause of the plurality of anomalies.

Abstract: In one embodiment, a device computes states of a network path associated with an online application by representing time series of telemetry data regarding the network path as discrete values. The device generates state trajectories from the states of the network path computed by the device. The device selects one or more sub-sequences of the state trajectories based on prediction performance metrics that represent how well the one or more sub-sequences are able to predict a failure condition of the network path. The device causes a networking entity to use the one or more sub-sequences of the state trajectories to perform predictive routing for the network path.

Abstract: In one embodiment, a device receives, via a user interface, an indication of what is considered noise within a time series of a path performance metric. The device selects, based on the indication, a particular denoising filter to be applied to telemetry data obtained from one or more network paths regarding the path performance metric. The device forms model training data by applying the particular denoising filter to telemetry data obtained from one or more network paths regarding the path performance metric. The device trains, using the model training data, a prediction model to predict when a given network path will experience a failure condition.

Abstract: In one embodiment, a network element in a network receives one or more machine learning models configured to make an inference about the network. The network element requests, according to a predefined peering plan, telemetry attribute data from one or more peer network elements specified by the peering plan. The network element receives the telemetry attribute data from the one or more peer network elements. The network element makes, using the one or more machine learning models, an inference about the network based in part on the received telemetry attribute data.

Abstract: In one embodiment, a device obtains telemetry data for a path in a network that is used to convey traffic associated with an online application. The device identifies, based on the telemetry data, oscillations of the path between a first state in which the path provides acceptable user experience for the online application and a second state in which the path does not provide acceptable user experience for the online application. The device determines a stability metric that quantifies the oscillations of the path. The device provides an indication of the oscillations of the path, based in part on the stability metric.

Abstract: In one embodiment, a device obtains quality of experience metrics for an online application. The device obtains network metrics for one or more network paths over which traffic for the online application was routed. The device identifies a lack of correlation between the quality of experience metrics for the online application and the network metrics for the one or more network paths over which traffic for the online application was routed. The device disables, based on the lack of correlation, explicit probing of the one or more network paths.

Abstract: In one embodiment, a method comprises causing, by a network controller device, a first access point (AP) device to initiate a reverse sounding operation comprising wireles sly requesting a mobile constrained network device to transmit a null data packet (NDP) at a first transmission interval, wirelessly receiving the NDP at the first transmission interval, and generating a reception report describing reception of the NDP and including beamforming information; causing, by the network controller device, a second AP device to generate a corresponding reception report describing a corresponding wireless detection of the NDP at the first transmission interval; and causing, by the network controller device, the mobile constrained network device to connect to a selected one of the first AP device or the second AP device for an identified data flow based on the respective reception reports from the first and second AP devices.

Abstract: In one embodiment, a device clusters traffic characteristics of traffic associated with a plurality of online applications into one or more clusters. The device determines representative traffic characteristics for a particular cluster in the one or more clusters. The device generates, based on the representative traffic characteristics, a probing strategy for the plurality of online applications associated with the particular cluster. The device causes path probes to be sent along one or more network paths in accordance with the probing strategy.

Abstract: In one embodiment, a device forms a plurality of clusters of network paths used to convey traffic for an online application by applying clustering to telemetry data for those network paths. The device determines a predictability metric for a particular cluster in the plurality of clusters. The device provides an indication of the predictability metric for the particular cluster for display. The device enables, based in part on the predictability metric, predictive routing for the network paths in the particular cluster.

Abstract: In one embodiment, a supervisory device in a network notifies, via an access point of the network, a node as to an ability of the network to support virtual access points. The supervisory device receives, in response to notifying the node, information from the node regarding characteristics of the node. The supervisory device selects, based on the characteristics of the node, a plurality of access points in the network to form a virtual access point with which the node may communicate. The supervisory device configures the plurality of access points to function as the virtual access point, wherein the node communicates with the network via the virtual access point.

Abstract: In one embodiment, a device obtains telemetry data for a path in a network that is used to convey traffic associated with an online application. The device identifies, based on the telemetry data, oscillations of the path between a first state in which the path provides acceptable user experience for the online application and a second state in which the path does not provide acceptable user experience for the online application. The device determines a stability metric that quantifies the oscillations of the path. The device provides an indication of the oscillations of the path, based in part on the stability metric.

Abstract: In one embodiment, a device identifies a plurality of paths between a pair of network addresses, wherein one of the pair of network addresses is associated with an online application. The device obtains telemetry data from the plurality of paths for the online application. The device computes, based on the telemetry data, fate sharing metrics for the plurality of paths. The device controls routing of application traffic between the pair of network addresses, based on the fate sharing metrics for the plurality of paths.