Abstract: In one embodiment, a device makes a prediction regarding service level agreement violations by a network transport available between a site and an online application. The device associates a risk metric with the prediction, based in part on a type of the network transport. The device computes a longevity metric for the prediction that indicates an expected validity period for the prediction. The device cause traffic to be routed between the site and the online application using the network transport, based on the prediction and its associated risk metric and its longevity metric.

Abstract: In various embodiments, a device classification service forms a device cluster by applying clustering to attributes of endpoint devices observed in one or more networks. The device classification service applies an initial device classification rule to the endpoint devices in the device cluster, based on one or more of the endpoint devices in the device cluster matching the initial device classification rule. The device classification service computes metrics for the initial device classification rule that quantify how well the attributes of the endpoint devices in the device cluster match the initial device classification rule. The device classification service decides, based on the metrics, whether to associate the initial device classification rule with the device cluster or generate a new device classification rule based on the device cluster.