Abstract: In one embodiment, a device trains, using feedback from a reference cohort of users of an online application, a prediction model to predict a quality of experience metric for the online application based on network telemetry. The device uses the prediction model to predict quality of experience metrics for different cohorts of users of the online application. The device makes one or more comparisons between performance metrics for the prediction model for the different cohorts of users, based on the quality of experience metrics predicted for the different cohorts of users. The device retrains, based on the one or more comparisons, the prediction model using feedback from the reference cohort and a particular cohort from among the different cohorts of users.

Abstract: In various embodiments, a device obtains a set of device classification rules. Each device classification rule specifies one or more attributes from a set of attributes and being configured to assign a device type to an endpoint in a network when the endpoint exhibits the one or more attributes specified by that rule. The device forms a graphical representation of the set of attributes. The device performs an analysis of the graphical representation of the set of attributes. The device provides a result of the analysis to a user interface.

Abstract: In one embodiment, a device associates one or more performance metrics with a particular session of an online application. The device makes a determination that a user of the online application associated with the particular session should be queried for feedback regarding their application experience. The device obtains, based on the determination, feedback from the user regarding their application experience, by causing a chatbot to be presented to the user and query the user for feedback regarding their application experience. The device associates the feedback from the user regarding their application experience with the one or more performance metrics.

Abstract: In one embodiment, a device obtains a first set of measurements of a path metric for a path in a network that are measured using periodic probing of the path. The device obtains a second set of measurements of the path metric for the path that are measured using fine-grained probing of the path at a higher frequency than that of the periodic probing. The device generates a predictive model that predicts values of the path metric, based on the first set of measurements and on the second set of measurements. The device causes, based on a value of the path metric predicted by the predictive model, traffic to be rerouted from the path to another path in the network.

Abstract: In one embodiment, a device obtains an indication of a network event predicted by a routing engine for a network. The device initiates monitoring of one or more network paths associated with the network event, to determine one or more states of the network. The device makes a comparison between the one or more states of the network and a set of one or more constraints. The device provides a prediction cancelation notification to the routing engine, based on the comparison.

Abstract: In one embodiment, a device classification service receives telemetry data indicative of behavioral characteristics of a plurality of devices in a network. The service obtains side information for the telemetry data. The service applies metric learning to the telemetry data and side information, to construct a distance function. The service uses the distance function to cluster the telemetry data into device clusters. The service associates a device type label with a particular device cluster.

Abstract: In one embodiment, a device receives observed access point (AP) features of one or more APs in a monitored network. The device clusters the observed AP features within a latent space to form AP feature clusters. The device applies labels to the AP feature clusters within the latent space. The device uses the applied labels to the AP feature clusters to describe future behaviors of the one or more APs in the monitored network.

Abstract: In one embodiment, a device classification service uses feature vectors that represent how frequently one or more traffic features were observed in a network during different time windows to train a cascade of machine learning classifiers to label one or more devices in the network with a device type. The service receives traffic features of traffic associated with a particular device in the network, and then uses the cascade of machine learning classifiers to assign a device type label to the particular device based on the traffic features of the traffic associated with the particular device. The service initiates enforcement of a network policy regarding the device based on its device type based on the device type label assigned to the particular device.

Abstract: In one embodiment, a device obtains behavioral metrics for application traffic in a network for a plurality of applications. The device identifies a first application and a second application from among the plurality of applications as fate sharing applications, based on a correlation between the behavioral metrics for their application traffic. The device generates a configuration change for the network that would prevent the first application and the second application from being fate sharing applications, when application traffic for the first application negatively affects the behavioral metrics for the application traffic of the second application. The device causes the configuration change to be implemented in the network.

Abstract: In one embodiment, a device receives application experience metrics for a software-as-a-service application served by a plurality of application endpoints. The device generates, based on the application experience metrics, a predictive model that predicts application experience scores for connections between a service provider network and the plurality of application endpoints. The device selects a particular application endpoint for the service provider network, based on an application experience score predicted by the predictive model. The device sends an indication an indication of the particular application endpoint selected by the device to the software-as-a-service application. The indication is used to assign a connection between the service provider network and the particular application endpoint.

Abstract: In various embodiments, a device classification service obtains device telemetry data indicative of declarative attributes of a device in a network and indicative of behavioral attributes of that device. The device classification service labels the device with a device type, based on the device telemetry data. The device classification service detects device type spoofing exhibited by the device using a model that models a relationship between the declarative attributes and the behavioral attributes. The device classification service initiates, based on the device type spoofing, a mitigation action regarding the device.

Abstract: In one embodiment, a device uses a classification model to determine whether implementation of a routing change suggested by a predictive routing engine for a network will result in a violation of one or more network policies. The device computes a trust score, based on performance metrics for the classification model. The device causes, based in part on the trust score, implementation of the routing change in the network, when the classification model determines that application of the routing change will not result in a violation of the one or more network policies.

Abstract: In one embodiment, a device obtains user experience metrics for a plurality of sessions with an online application. The device detects a plurality of anomalies from among the user experience metrics. The device determines, based on a correlation between the plurality of anomalies, that a particular path entity is a root cause of the plurality of anomalies. The particular path entity comprises an egress service provider or data center of the online application. The device provides an indication of the particular path entity being the root cause of the plurality of anomalies.

Abstract: In one embodiment, a network element in a network receives one or more machine learning models configured to make an inference about the network. The network element requests, according to a predefined peering plan, telemetry attribute data from one or more peer network elements specified by the peering plan. The network element receives the telemetry attribute data from the one or more peer network elements. The network element makes, using the one or more machine learning models, an inference about the network based in part on the received telemetry attribute data.

Abstract: In one embodiment, a device computes an efficiency metric regarding ingestion of telemetry data from a particular portion of a network by a predictive routing engine used to make predictive routing decisions for that portion of the network. The device makes a comparison between the efficiency metric and one or more control rules. The device determines, based on the comparison, whether ingestion of the telemetry data from the particular portion of the network by the predictive routing engine should be disabled. The device causes the predictive routing engine to stop ingesting telemetry data from the particular portion of the network.

Abstract: In one embodiment, a device obtains metadata for routing decisions made by a predictive routing service for a plurality of network deployments. The device identifies a network topology for a network deployment that does not use the predictive routing service. The device estimates, based on the metadata for routing decisions made by the predictive routing service, performance metrics for the predictive routing service were it to be used to make routing decisions for the network topology. The device sends, to a user interface, report data indicative of the performance metrics estimated for the predictive routing service were it to be used to make routing decisions for the network topology.

Abstract: In one embodiment, a service receives software version data regarding versions of software executed by devices in a network. The service detects a version change in the version of software executed by one or more of the devices, based on the received software version data. The service makes a determination that a drop in data quality of input data for a machine learning model used to monitor the network is associated with the detected version change. The service reverts the one or more devices to a prior version of software, based on the determination that the drop in quality of the input data for the machine learning model used to monitor the network is associated with the detected version change.

Abstract: In one embodiment, a label stability analyzer service receives classification data indicative of device type labels assigned to endpoints in a network by a device classification service. The label stability analyzer service counts device type label changes made by the device classification service to the endpoints. The label stability analyzer service computes variability metrics for the device type labels, wherein the variability metric for a device type label is based on a count of the device type label changes associated with that label. The label stability analyzer service determines, based on one of the variability metrics for a particular one of the device type labels exceeding a threshold value, a configuration change for the device classification service that adjusts how the device classification service applies the particular label to endpoints. The label stability analyzer service provides the configuration change to the device classification service.

Abstract: In one embodiment, a device uses a multi-armed bandit model to select different network paths over time via which traffic associated with an online application is routed. The device obtains, from a provider of the online application, application experience metrics associated with the different network paths and indicative of user satisfaction with the online application. The device learns, by the multi-armed bandit model, which of the different network paths will provide satisfactory application experience metrics, based on the application experience metrics associated with the different network paths. The device causes the traffic associated with the online application to be routed via a set of one or more paths expected by the multi-armed bandit model to provide satisfactory application experience metrics for the online application.

Abstract: In one embodiment, a device obtains information regarding temporary routing patches applied to a network. Each temporary routing patch implements a routing change in the network for a specified amount of time to avoid or mitigate against a service level agreement violation. The device evaluates, using the information regarding the temporary routing patches applied to the network, a plurality of replay scenarios for the network. The device determines, based on the plurality of replay scenarios, a long-term configuration change for the network. The device provides an indication of the long-term configuration change for display.