Abstract: Some embodiments of the invention provide a method of remediating anomalies in an SD-WAN implemented by multiple forwarding elements (FEs) located at multiple sites connected by the SD-WAN. The method determines that a particular anomaly detected in the SD-WAN requires remediation to improve performance for a set of one or more flows traversing through the SD-WAN. The method identifies a set of two or more remedial actions for remediating the particular anomaly in the SD-WAN. For each identified remedial action in the set, the method selectively implements the identified remedial action for a subset of the set of flows for a duration of time in order to collect a set of performance metrics associated with SD-WAN performance during the duration of time for which the identified remedial action is implemented.

Abstract: Some embodiments of the invention provide a method for remediating anomalies in an SD-WAN implemented by multiple forwarding elements (FEs) located at multiple sites connected by the SD-WAN. The method is performed for each particular FE in a set of one or more FEs. The method identifies a set of metrics associated with each application of multiple applications for which the particular FE forwards traffic flows. For each particular application of the multiple applications, the method generates a distribution graph that shows the identified set of metrics associated with the particular application for the particular FE over a first duration of time.

Abstract: Some embodiments of the invention provide a method of detecting and remediating anomalies in an SD-WAN implemented by multiple forwarding elements (FEs) located at multiple sites connected by the SD-WAN. The method receives, from the multiple FEs, multiple sets of flow data associated with application traffic that traverses the multiple FEs. The method uses a first set of machine-trained processes to analyze the multiple sets of flow data in order to identify at least one anomaly associated with at least one particular FE in the multiple FEs. The method uses a second set of machine-trained processes to identify at least one remedial action for remediating the identified anomaly. The method implements the identified remedial action by directing an SD-WAN controller deployed in the SD-WAN to implement the identified remedial action.

Abstract: Some embodiments of the invention provide a method of remediating anomalies in an SD-WAN implemented by multiple forwarding elements (FEs) located at multiple sites connected by the SD-WAN. The method is performed iteratively. The method receives multiple performance metrics that over a duration of time express a performance of the SD-WAN for at least one particular application associated with flows that traverse the SD-WAN during the time duration. The method uses the received performance metrics to update generated weight values for a topology graph that includes (1) multiple nodes representing the multiple FEs and (2) multiple edges between the multiple nodes representing paths traversed between the FEs by the flows associated with the particular application, said generated weight values associated with said paths.

Abstract: Some embodiments of the invention provide a method of dynamically scaling a hub cluster in a software-defined wide area network (SD-WAN) based on particular traffic statistics, the hub cluster being located in a datacenter of the SD-WAN and allowing branch sites of the SD-WAN to access resource of the datacenter by connecting to the hub cluster. A controller of the SD-WAN receives, from the hub cluster, traffic statistics centrally captured at the hub cluster. The controller then analyzes these statistics to identify traffic load fluctuations, and determines that a number of hubs in the hub cluster should be adjusted based on the identified fluctuations. The controller adjusts the number of hubs in the hub cluster based on the determination.

Abstract: A system and method is disclosed of extracting information from real-time network packet data to analyze connectivity data for client devices in a network. The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to either reach or fail to reach a network connected state; after waiting a period of time, recording connectivity event information; and sending the recorded connectivity event information to an analytics system for network incident and/or network congestion analysis.

Abstract: A system and method is disclosed of extracting information from real-time network packet data to analyze connectivity data for client devices in a network. The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to either reach or fail to reach a network connected state; after waiting a period of time, recording connectivity event information; and sending the recorded connectivity event information to an analytics system for network incident and/or network congestion analysis.

Abstract: A method for analyzing network incidents within a network and providing prioritized remediation recommendations is disclosed. The method includes: receiving network data and computing a plurality of network incidents from the network data, collecting network incidents related to a particular network issue over a time period and grouping the network incidents according to root-cause symptoms, generating a network incident graph by superimposing groups of network incidents over a network graph, analyzing the network incident graph to identify localized areas with systemic issues; and based on the analysis of the network incident graph, generating and displaying a list of remediation recommendations. Each remediation recommendation includes a systemic issue in the network, a remediation to resolve the issue, and a quantified expected benefit from implementing the remediation.

Abstract: A method for analyzing network incidents within a network and providing prioritized remediation recommendations is disclosed. The method includes: receiving network data and computing a plurality of network incidents from the network data, collecting network incidents related to a particular network issue over a time period and grouping the network incidents according to root-cause symptoms, generating a network incident graph by superimposing groups of network incidents over a network graph, analyzing the network incident graph to identify localized areas with systemic issues; and based on the analysis of the network incident graph, generating and displaying a list of remediation recommendations. Each remediation recommendation includes a systemic issue in the network, a remediation to resolve the issue, and a quantified expected benefit from implementing the remediation.

Abstract: Some embodiments of the invention provide a method of dynamically scaling a hub cluster in a software-defined wide area network (SD-WAN) based on particular traffic statistics, the hub cluster being located in a datacenter of the SD-WAN and allowing branch sites of the SD-WAN to access resource of the datacenter by connecting to the hub cluster. A controller of the SD-WAN receives, from the hub cluster, traffic statistics centrally captured at the hub cluster. The controller then analyzes these statistics to identify traffic load fluctuations, and determines that a number of hubs in the hub cluster should be adjusted based on the identified fluctuations. The controller adjusts the number of hubs in the hub cluster based on the determination.

Abstract: Some embodiments of the invention provide a method for proactively optimizing network performance for a software-defined wide area network (SD-WAN), which connects multiple devices operating in multiple network segments, during an active network flow. The method monitors the SD-WAN for network events related to the active network flow. The method detects a particular network event at a first device in a first segment in the SD-WAN traversed by the active network flow. Based on the particular network event, the method performs a proactive action on at least a second device in a second network segment in the SD-WAN that will be traversed by the active network flows in order to mitigate a potential negative impact of the particular network event on the performance of the SD-WAN to improve overall network performance.

Abstract: Some embodiments provide a method for managing a network. Based on a first set of flow statistics received from network elements in the network, the method identifies a data message flow with degraded performance. The data message flow follows a path, between a first endpoint and a second endpoint through a set of the network elements in the network, that includes multiple segments. The method uses a second set of flow statistics received from the set of network elements to identify a particular segment of the path as a most likely contributor to the degraded performance of the particular flow. The method initiates a corrective action to resolve the degraded performance for the data message flow based on the identification of the particular segment.

Abstract: Some embodiments provide a novel method that performs an automated process that identifies features of an IoT device connected to a network, and based on the identified features specifies, without an administrator input, one or more network policies (e.g., security policies) to apply to packets sent or received by the IoT device. The method of some embodiments also performs automated processes that (1) analyze packet flows to and from the IoT devices to identify dynamic network behavior of these devices, and then (2) specify network policies based on the identified dynamic network behavior.

Abstract: Some embodiments provide a novel method that performs an automated process that identifies features of an IoT device connected to a network, and based on the identified features specifies, without an administrator input, one or more network policies (e.g., security policies) to apply to packets sent or received by the IoT device. The method of some embodiments also performs automated processes that (1) analyze packet flows to and from the IoT devices to identify dynamic network behavior of these devices, and then (2) specify network policies based on the identified dynamic network behavior.

Abstract: A system and method is disclosed of extracting information from real-time network packet data to analyze connectivity data for client devices in a network. The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to either reach or fail to reach a network connected state; after waiting a period of time, recording connectivity event information; and sending the recorded connectivity event information to an analytics system for network incident and/or network congestion analysis.

Abstract: A system and method is disclosed of extracting information from real-time network packet data to analyze connectivity data for client devices in a network. The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to either reach or fail to reach a network connected state; after waiting a period of time, recording connectivity event information; and sending the recorded connectivity event information to an analytics system for network incident and/or network congestion analysis.

Abstract: A method, system and computer program product for adaptive system monitoring. In one embodiment, the method comprises generating time-varying correlation graphs indicating correlations between a multitude of parameters of the system, and using the correlation graphs to identify monitoring logic for monitoring the system. In an embodiment, the correlation graphs are used to select a group of the parameters as monitoring parameters, and these monitoring parameters are dynamically changed. In one embodiment, the monitoring parameters form sets of monitoring parameters, and each set of monitoring parameters is used to monitor the system for an associated period of time. The lengths of these monitoring periods are changed based on the rate of change of the correlation graphs. In an embodiment, the rate at which the monitoring parameters are changed is itself changed based on the rate of change of the correlation graphs.

Abstract: A method for analyzing network incidents within a network and providing prioritized remediation recommendations is disclosed. The method includes: receiving network data and computing a plurality of network incidents from the network data, collecting network incidents related to a particular network issue over a time period and grouping the network incidents according to root-cause symptoms, generating a network incident graph by superimposing groups of network incidents over a network graph, analyzing the network incident graph to identify localized areas with systemic issues; and based on the analysis of the network incident graph, generating and displaying a list of remediation recommendations. Each remediation recommendation includes a systemic issue in the network, a remediation to resolve the issue, and a quantified expected benefit from implementing the remediation.

Abstract: A system and method is disclosed of extracting information from real-time network packet data to analyze connectivity data for client devices in a network. The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to either reach or fail to reach a network connected state; after waiting a period of time, recording connectivity event information; and sending the recorded connectivity event information to an analytics system for network incident and/or network congestion analysis.

Abstract: A method, system and computer program product for adaptive system monitoring. In one embodiment, the method comprises generating time-varying correlation graphs indicating correlations between a multitude of parameters of the system, and using the correlation graphs to identify monitoring logic for monitoring the system. In an embodiment, the correlation graphs are used to select a group of the parameters as monitoring parameters, and these monitoring parameters are dynamically changed. In one embodiment, the monitoring parameters form sets of monitoring parameters, and each set of monitoring parameters is used to monitor the system for an associated period of time. The lengths of these monitoring periods are changed based on the rate of change of the correlation graphs. In an embodiment, the rate at which the monitoring parameters are changed is itself changed based on the rate of change of the correlation graphs.