Abstract: Techniques are described for monitoring network performance and managing network faults in a computer network. A cloud-based network management system stores path data received from a plurality of network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices for one or more logical paths of a physical interface from the network device over a wide area network (WAN). The network management system determines, based on the path data, one or more WAN link health assessments, wherein the one or more WAN link health assessments include a success or failure state associated with one or more of service provider reachability, physical interface operation, or logical path performance; and in response to determining the at least one failure state, outputs a notification including identification of a root cause of the at least one failure state.

Abstract: Techniques are disclosed for a network management system (NMS) that performs quality of service (QoS) monitoring and troubleshooting of user experience issues occurring outside of a network managed by the NMS using data obtained from third-party sources. For example, an NMS obtains third-party data of a third-party application server or third-party service provider server from a third-party monitoring vendor. The NMS identifies a user experience issue indicated by the third-party data and stitches the third-party data to network data received from network devices. The NMS determines a root cause or a remedial action of the user experience issue based at least on the network data received from the one or more network devices. The NMS generates a notification for presentation to an administrator device which identifies the root cause or the remedial action of the user experience issue.

Abstract: An example method includes receiving, by an SD-WAN system, WAN link characterization data for a plurality of WAN links of the SD-WAN system over a time period; and for each site of a plurality of sites of the SD-WAN system, generating, by the SD-WAN system, a local policy for the site, wherein generating the local policy is based on a machine learning model trained with the WAN link characterization data for the plurality of WAN links, and providing the local policy to an SD-WAN edge device of the site.

Abstract: Systems, devices and techniques for an adaptive application-specific probing scheme are disclosed. An example network device includes memory configured to store a network address and probe protocol usable for probing a first network device associated with a source of an application, and one or more processors configured to determine a network address and probe protocol usable for probing the first network device, wherein the first network device comprises a server that is responsive to the probing, the server executing the application for the data flow, or a closest network device, to the server, that is responsive to the probing. The one or more processors are also configured to send to a second network device at a location serviced by the application, a message specifying the network address and probe protocol usable for probing the first network device.

Abstract: Disclosed is a network management system that provides an interface to enable diagnostics and troubleshoot of a remotely managed multi-site network. Some embodiments provide a natural language interface, while other embodiments provide a chatbot type interface that communicates with a technician via traditional text information on a display screen. The diagnostic and troubleshooting capabilities search a central data store that receives device property information from each site of the multi-site network. Based on devices or users that match portions of the entity, queries to the data store are initiated to obtain additional data on the devices. A response to the query is then provided based on the properties of the devices.

Abstract: Techniques are described for monitoring application performance in a computer network. For example, a network management system (NMS) includes a memory storing path data received from a plurality of network devices, the path data reported by each network device of the plurality of network devices for one or more logical paths of a physical interface from the given network device over a wide area network (WAN). Additionally, the NMS may include processing circuitry in communication with the memory and configured to: determine, based on the path data, one or more application health assessments for one or more applications, wherein the one or more application health assessments are associated with one or more application time periods for a site, and in response to determining at least one failure state, output a notification including identification of a root cause of the at least one failure state.

Abstract: An example system includes access point (AP) devices configured to provide a wireless network at a site; and a network management system that stores network data received from the AP devices, the network data collected by the AP devices or client devices associated with the wireless network, and one or more processors configured to: receive a time series of SLE metrics based on the network data, determine, based on the time series, whether a network event has occurred, in response to a determination that a network event has occurred, determine a root cause for the network event, and in response to a determination that the root cause of the network event is associated with an AP device, determine a classification of the AP device, and determine a network management action for the AP device based on the network event and the classification of the AP device.

Abstract: Techniques are described for monitoring application performance in a computer network. For example, a network management system (NMS) includes a memory storing path data received from a plurality of network devices, the path data reported by each network device of the plurality of network devices for one or more logical paths of a physical interface from the given network device over a wide area network (WAN). Additionally, the NMS may include processing circuitry in communication with the memory and configured to: determine, based on the path data, one or more application health assessments for one or more applications, wherein the one or more application health assessments are associated with one or more application time periods for a site, and in response to determining at least one failure state, output a notification including identification of a root cause of the at least one failure state.

Abstract: A behavior analytics method for detecting and preventing different types of API based threats and attacks is disclosed. The method includes collecting request and response data of API calls from plurality of user sessions and storing it in a data lake. The method further includes extracting and combining features of the collected request and response data. The features may be associated with login behavior, API request content and behavior, API object accessing content and behavior, and API response content and behavior. The method also includes encoding the combined features via a neural network model to create a behavior fingerprint of each of the user sessions. Also, the method includes clustering the created behavior fingerprint to detect normal or abnormal user behavior. Thereafter, the method includes reporting the detected abnormal user behavior.

Abstract: Techniques are described for monitoring application performance in a computer network. For example, a network management system (NMS) includes a memory storing path data received from a plurality of network devices, the path data reported by each network device of the plurality of network devices for one or more logical paths of a physical interface from the given network device over a wide area network (WAN). Additionally, the NMS may include processing circuitry in communication with the memory and configured to: determine, based on the path data, one or more application health assessments for one or more applications, wherein the one or more application health assessments are associated with one or more application time periods for a site, and in response to determining at least one failure state, output a notification including identification of a root cause of the at least one failure state.

Abstract: An example system includes access point (AP) devices configured to provide a wireless network at a site; and a network management system that stores network data received from the AP devices, the network data collected by the AP devices or client devices associated with the wireless network, and one or more processors configured to: receive a time series of SLE metrics based on the network data, determine, based on the time series, whether a network event has occurred, in response to a determination that a network event has occurred, determine a root cause for the network event, and in response to a determination that the root cause of the network event is associated with an AP device, determine a classification of the AP device, and determine a network management action for the AP device based on the network event and the classification of the AP device.

Abstract: Disclosed is a network management system that provides an interface to enable diagnostics and troubleshoot of a remotely managed multi-site network. Some embodiments provide a natural language interface, while other embodiments provide a chatbot type interface that communicates with a technician via traditional text information on a display screen. The diagnostic and troubleshooting capabilities search a central data store that receives device property information from each site of the multi-site network. Based on devices or users that match portions of the entity, queries to the data store are initiated to obtain additional data on the devices. A response to the query is then provided based on the properties of the devices.

Abstract: A method includes receiving, by a network management system, network data from a plurality of network devices configured to provide a network at a site; receiving, by the processing circuitry, user impact data from a plurality of client devices that access the network at the site; determining, based on the network data, a pattern of one or more network events occurring over time; correlating in time the pattern of the one or more network events to an adverse user impact event indicated by the user impact data received from the plurality of client devices; and determining, in response to the correlating, an instance of overwhelming network traffic having an adverse user impact. In some examples, the network data includes network traffic impact data, such as a number of packets dropped at a switch port due to congestion.

Abstract: An example system is configured to: identify, using network data for a plurality of network devices, a first network device of the plurality of network devices with which a network connection has a connectivity issue; identify, based on a network representation generated from the network data, one or more second network devices from the plurality of network devices that are connected to the first network device; identify a root cause of the connectivity issue based on analysis of the network connection with the first network device using the network data; and send, based on the identified root cause of the connectivity issue, to at least one of the one or more second network devices, instructions for the first network device to perform an action to remediate the connectivity issue, wherein the at least one of the one or more second network devices communicates the instructions to the first network device.

Abstract: Disclosed are embodiments for automatically resolving faults in a complex network system. Some embodiments monitor one or more of system operational parameter values and message exchanges between network components. A machine learning model detects a fault in the complex network system, and an action is selected based on a cause of the fault. After the action is applied to the complex network system, additional monitoring is performed to either determine the fault has been resolved or additional actions are to be applied to further resolve the fault.

Abstract: An example method includes receiving, by a software-defined networking in a wide area network (SD-WAN) system having a first WAN link and a second WAN link for an SD-WAN service, WAN link characterization data for the first WAN link over a time period; determining, by the SD-WAN system based on processing the WAN link characterization data for the first WAN link using a machine learning model trained with historical WAN link characterization data for one or more WAN links, an indicator of a predicted performance metric of the first WAN link at a future time; and reassigning, by the SD-WAN system based on the indicator, an application from the first WAN link to the second WAN link.

Abstract: This disclosure describes a network management system (NMS) configured to determine a particular network device of a plurality of network devices based on a first user input in a conversational assistant. The one or more processors are further configured to identify a set of actionable insights for the particular network device based on network data received from the plurality of network devices and determine a set of views of a dashboard based at least on the set of actionable insights, wherein each view of the set of views displays a portion of the network data received from the plurality of network devices. The one or more processors are further configured to select a view of the set of views of the dashboard based on a second user input in the conversational assistant and cause the dashboard to display the selected view.

Abstract: Techniques are described for detecting that a client device physically connected to a network device is “stuck,” that is, the client device is not sending or receiving network packets with the network device. A network management system (NMS) receives current network statistics of ports of network devices with respect to client devices physically connected to the ports. The NMS identifies a candidate client device connected to a particular port of a particular network device for which the current network statistics indicate an issue. The NMS detects anomalous behavior of the candidate client device based on one or more features of the current network statistics, historical baseline statistics associated with the candidate client device, and peer statistics associated with one or more peer client devices of a same device type as the candidate client device. The NMS outputs a notification of the anomalous behavior.

Abstract: Techniques are disclosed for a network management system (NMS) that performs quality of service (QOS) monitoring and troubleshooting of user experience issues occurring outside of a network managed by the NMS using data obtained from third-party sources. For example, an NMS obtains third-party data of a third-party application server or third-party service provider server from a third-party monitoring vendor. The NMS identifies a user experience issue indicated by the third-party data and stitches the third-party data to network data received from network devices. The NMS determines a root cause or a remedial action of the user experience issue based at least on the network data received from the one or more network devices. The NMS generates a notification for presentation to an administrator device which identifies the root cause or the remedial action of the user experience issue.

Abstract: A method includes receiving, by a network management system, network data from a plurality of network devices configured to provide a network at a site; receiving, by the processing circuitry, user impact data from a plurality of client devices that access the network at the site; determining, based on the network data, a pattern of one or more network events occurring over time; correlating in time the pattern of the one or more network events to an adverse user impact event indicated by the user impact data received from the plurality of client devices; and determining, in response to the correlating, an instance of overwhelming network traffic having an adverse user impact. In some examples, the network data includes network traffic impact data, such as a number of packets dropped at a switch port due to congestion.