Abstract: In one embodiment, a service computes a data fidelity metric for network telemetry data used by a machine learning model to monitor a computer network. The service detects unacceptable performance of the machine learning model. The service determines a correlation between the data fidelity metric and the unacceptable performance of the machine learning model. The service adjusts generation of the network telemetry data for input to the machine learning model, based on the determined correlation between the data fidelity metric and the unacceptable performance of the machine learning model.

Abstract: In one embodiment, a device makes a first determination as to whether a time series of a performance metric for a first network path exhibits seasonality. The device makes a second determination as to whether the time series exhibits a trend. The device predicts, based on the first determination and on the second determination, the performance metric for the first network path during a future time period. The device assesses, based on the performance metric predicted for the first network path, whether a measure of application experience will degrade for application traffic sent via the first network path. The device causes the application traffic to be proactively switched to a second network path, when the measure of application experience is expected to degrade.

Abstract: In various embodiments, a device classification service uses an initial device classification rule to label each of a set of endpoint devices in a network as being of a particular device type. The device classification service identifies a particular attribute exhibited by at least a portion of the set of endpoint devices and was not previously used to generate the initial device classification rule. The device classification service generates one or more new device classification rules based in part on the particular attribute. The device classification service switches from using the initial device classification rule to label endpoint devices in the network to using the one or more new device classification rules to label endpoint devices in the network.

Abstract: In one embodiment, a networking device reroutes traffic in a network from a first path to a second path, based on a prediction that the first path will not satisfy a service level agreement associated with the traffic. The networking device enters a fast monitoring state during which the networking device performs fast probing of the first path and of the second path onto which the traffic was rerouted. The networking device makes, based on the fast probing, a determination as to whether the first path would have violated the service level agreement and whether the second path violates the service level agreement. The networking device enacts a routing decision for the traffic by applying a routing policy to the determination.

Abstract: In one embodiment, a device obtains traffic telemetry data regarding a first path in a network and an alternate path in the network. The device predicts, based on the traffic telemetry data, an amount of traffic for an application that is expected at a particular time. The device makes, based on the traffic telemetry data and on the amount of traffic for the application that is predicted to be expected at the particular time, a counterfactual prediction as to whether the alternate path would violate a service level agreement associated with the traffic, should the traffic be routed via the alternate path at the particular time. The device causes, based on the counterfactual prediction, the traffic for the application to be rerouted from the first path in the network to the alternate path, prior to the particular time.

Abstract: In one embodiment, a network assurance service that monitors a network maps time series of values of key performance indicator (KPIs) measured from the network to lists of unique values from the time series. The service sets a target alarm rate for anomaly detection alarms raised by the network assurance service. The service uses an optimization function to identify a set of thresholds for the KPIs. The optimization function is based on: a comparison between the target alarm rate and a fraction of network issues flagged by the service as outliers, KPI thresholds selected based on the lists of unique values from the time series, and a number of thresholds that the KPIs must cross for the service to raise an alarm. The service raises an anomaly detection alarm for the monitored network based on the identified set of thresholds for the KPIs.

Abstract: In one embodiment, a device forms a telemetry cluster by applying clustering to telemetry data regarding a plurality of network connections over an access network between a plurality of entities and a remote application. The device applies anomaly detection to the telemetry cluster, to identify one or more anomalies. The device makes a determination as to whether the one or more anomalies are attributable to the remote application or to the access network. The device initiates a corrective measure, based on the determination as to whether the one or more anomalies are attributable to the remote application or to the access network.

Abstract: In one embodiment, a network assurance service that monitors one or more networks identifies changes in a key performance indicator for each of a plurality of network entities in the one or more networks. The service forms a peer group of network entities from the plurality of network entities whose changes in the key performance indicator are correlated. The service monitors the key performance indicator for network entities in the peer group of network entities. The service, based on the monitoring, detects an anomalous change in the key performance indicator for a particular network entity in the peer group of network entities relative to other network entities in the peer group of network entities.

Abstract: In one embodiment, a device of a software defined wide area network (SD-WAN) predicts characteristics of a new traffic flow to be admitted to the SD-WAN, based on a set of initial packets of the flow. The device predicts an impact of admitting the flow to the SD-WAN, based in part on extrinsic or exogenous data regarding the SD-WAN. The device admits the flow to the SD-WAN, based on the predicted impact. The supervisory device uses reinforcement learning to adjust one or more call admission control (CAC) parameters of the SD-WAN, based on captured telemetry data regarding the admitted flow.

Abstract: In one embodiment, a device obtains, from a plurality of routers in a network, a set of routing patches that collectively specify a first set of paths in the network, a second set of paths in the network, and time periods during which traffic is to be rerouted from one of the first set of paths to one of the second set of paths in the network. The device identifies overlapping path segments of the second set of paths in the network. The device makes, based in part on the overlapping path segments, a prediction that two or more of the set of routing patches will cause congestion along paths with overlapping path segments. The device adjusts, based on the prediction, the set of routing patches, to avoid causing the congestion.

Abstract: In one embodiment, a device calculates one or more distributions of bitrates associated with an application whose traffic is conveyed via one or more paths in a network. The device detects throughput modes of the application, based on the one or more distributions of bitrates associated with the application. The device associates each throughput mode with a quality of experience label, to form a plurality of pairs of throughput modes and quality of experience labels. The device estimates a quality of experience metric for the application, based on a bitrate of the application and the plurality of pairs of throughput modes and quality of experience labels.

Abstract: In one embodiment, a device predicts a range of bitrates expected to be required by one or more applications associated with traffic conveyed via a particular path in a network. The device obtains telemetry data indicative of observed bitrates associated with the traffic conveyed via the particular path in the network. The device identifies, a presence of congestion along the particular path in the network, by comparing the observed bitrates to the range of bitrates expected to be required by the one or more applications. The device causes at least a portion of the traffic to be re-routed from the particular path to a second path in the network, when the device identifies the presence of congestion along the particular path.

Abstract: In one embodiment, a method comprises receiving, by a transport layer executed by a processor circuit in an apparatus, an identifiable grouping of data; storing, by the transport layer, the data as transport layer packets in a buffer circuit in the apparatus, the storing including inserting into each transport layer packet a grouping identifier that identifies the transport layer packets as belonging to the identifiable grouping; and causing, by the transport layer, a plurality of transmitting deterministic network interface circuits to deterministically retrieve the transport layer packets from the buffer circuit for deterministic transmission across respective deterministic links, the grouping identifier enabling receiving deterministic network interface circuits to group the received transport layer packets, regardless of deterministic link, into a single processing group for a next receiving transport layer.

Abstract: In various embodiments, a device classification service makes a determination that an endpoint device in a network is eligible for expedited device classification based on a policy. The device classification service obtains, after making the determination that the endpoint device in the network is eligible for expedited device classification, telemetry data regarding the endpoint device generated by actively probing the endpoint device. The device classification service determines whether the telemetry data regarding the endpoint device matches any existing device classification rules. The device classification service generates, based on the telemetry data, a device classification rule that assigns a device type to the endpoint device, when the telemetry data does not match any existing device classification rules.

Abstract: In various embodiments, a device classification service obtains traffic telemetry data for a plurality of devices in a network. The service applies clustering to the traffic telemetry data, to form device clusters. The service generates a device classification rule based on a particular one of the device clusters. The service receives feedback from a user interface regarding the device classification rule. The service adjusts the device classification rule based on the received feedback.

Abstract: In one embodiment, a device in a network obtains tunnel flappiness metrics associated with a particular tunnel in the network exhibiting flapping. The device makes, based on the tunnel flappiness metrics, a prediction that the particular tunnel is going to flap. The prediction is made using a machine learning model. The device proactively reroutes, based on the prediction, traffic from the particular tunnel onto an alternate tunnel, prior to the particular tunnel flapping. The device evaluates performance of the alternate tunnel, after proactively rerouting the traffic from the particular tunnel onto the alternate tunnel.

Abstract: In one embodiment, a service tracks performance of a machine learning model over time. The machine learning model is used to monitor one or more computer networks based on data collected from the one or more computer networks. The service also tracks performance metrics associated with training of the machine learning model. The service determines that a degradation of the performance of the machine learning model is anomalous, based on the tracked performance of the machine learning model and performance metrics associated with training of the model. The service initiates a corrective measure for the degradation of the performance, in response to determining that the degradation of the performance is anomalous.

Abstract: In one embodiment, a device classification service forms a device cluster by applying clustering to telemetry data associated with a plurality of devices. The service obtains device type labels for the device cluster. The service generates a device type classification rule using the device type labels and the telemetry data. The service determines whether the device type classification rule should be revalidated by applying a revalidation policy to the device type classification rule. The service revalidates the device type classification rule, based on a determination that the device type classification rule should be revalidated.

Abstract: In one embodiment, a service receives a plurality of device type classification rules, each rule comprising a device type label and one or more device attributes used as criteria for application of the label to a device in a network. The service estimates, across a space of the device attributes, device densities of devices having device attributes at different points in that space. The service uses the estimated device densities to identify two or more of the device type classification rules as having overlapping device attributes. The service determines that the two or more device type classification rules are in conflict, based on the two or more rules having different device type labels. The service generates a rule conflict resolution that comprises one of the device type labels from the conflicting two or more device type classification rules.

Abstract: In one embodiment, a device obtains characteristics of a first anomaly detection model executed by a first distributed learning agent in a network. The device receives a query from a second distributed learning agent in the network that requests identification of a similar anomaly detection to that of a second anomaly detection model executed by the second distributed learning agent. The device identifies, after receiving the query from the second distributed learning agent, the first anomaly detection model as being similar to that of the second anomaly detection model, based on the characteristics of the first anomaly detection model. The device causes the first anomaly detection model to be sent to the second distributed learning agent for execution.