Abstract: In one embodiment, a first device in a network receives traffic flow data from a plurality of devices in the network. The traffic flow data from at least one of the plurality of devices comprises raw packets of a traffic flow. The first device selects a set of reporting devices from among the plurality of devices based on the received traffic flow data. The first device provides traffic flow reporting instructions to the selected set of reporting devices. The traffic flow reporting instructions cause each reporting device to provide sampled traffic flow data to an anomaly detection device.

Abstract: In one embodiment, a state tracking engine (STE) defines one or more classes of elements that can be tracked in a network. A set of elements to track is determined from the one or more classes, and the set of elements is tracked in the network. Access to the tracked set of elements then provided via one or more corresponding application programming interfaces (APIs). In another embodiment, a metric computation engine (MCE) defines one or more network metrics to be tracked in the network. One or more tracked elements are received from the STE. The one or more network metrics are tracked in the network based on the received one or more tracked elements. Access to the tracked network metrics is then provided via one or more corresponding APIs.

Abstract: In one embodiment, network data is received at a Learning Machine (LM) in a network. It is determined whether the LM recognizes the received network data based on information available to the LM. When the LM fails to recognize the received network data: a connection to a central management node is established, a request is sent for information relating to the unrecognized network data to the central management node, and information is received from the central management node in response to the request. The received information assists the LM in recognizing the unrecognized network data.

Abstract: In one embodiment, data is received at a device regarding a network-monitoring process in which one or more nodes in a network export network metrics to one or more collector nodes. A change to the network-monitoring process is determined based on the received data. The device also adjusts the network-monitoring process to implement the determined change.

Abstract: In one embodiment, techniques are shown and described relating to a point-to-multipoint communication infrastructure for expert-based knowledge feed-back using learning machines. A learning machine may communicate an expert discovery request into a network to discover one or more experts, and then receive from the one or more experts, one or more expert discovery responses. Based on the one or more received expert discovery responses, the learning machine may then build a dynamic multicast tree of experts to assist the learning machine in a computer network.

Abstract: In one embodiment, techniques are shown and described relating to learning machine based detection of abnormal network performance. In particular, in one embodiment, a border router receives a set of network properties xi and network performance metrics Mi from a network management server (NMS), and then intercepts xi and Mi transmitted from nodes in a computer network of the border router. As such, the border router may then build a regression function F based on xi and Mi, and can detect one or more anomalies in the intercepted xi and Mi based on the regression function F. In another embodiment, the NMS, which instructed the border router, receives the detected anomalies from the border router.

Abstract: In one embodiment, a device in a network maintains information regarding anomaly detection models used in the network and applications associated with traffic analyzed by the anomaly detection models. The device receives an indication of a planned application deployment in the network. The device adjusts an anomaly detection strategy of a particular anomaly detector in the network based on the planned application deployment and on the information regarding anomaly detection models used in the network and the applications associated with the traffic analyzed by the anomaly detection models.

Abstract: In one embodiment, a device in a network analyzes data indicative of a behavior of a network using a supervised anomaly detection model. The device determines whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data. The device trains an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.

Abstract: In one embodiment, a capable node in a low power and lossy network (LLN) may monitor the authentication time for one or more nodes in the LLN. The capable node may dynamically correlate the authentication time with the location of the one or more nodes in the LLN in order to identify one or more authentication-delayed nodes. The node may then select, based on the location of the one or more authentication-delayed nodes, one or more key-delegation nodes to receive one or more network keys so that the key-delegation nodes may perform localized authentication of one or more of the authentication-delayed nodes. The capable node may then distribute the one or more network keys to the one or more key-delegation nodes.

Abstract: In one embodiment, a device in a network receives an indication of a traffic shaping rate adjustment by a node due to a network condition. The device identifies a set of network nodes that are associated with the network condition. The device detects a traffic shaping rules violation by an offending node in the set of network nodes. The device sends an instruction that causes the offending node to use a different traffic shaping rate.

Abstract: In one embodiment, a triggered reboot of a field area router (FAR) of a computer network is initiated, and gathered states of the FAR are saved. The nodes in the computer network are informed of the triggered reboot, and then feedback may be collected from the nodes in response to the triggered reboot. As such, it can be determined whether to complete the triggered reboot based on the feedback, and the FAR is rebooted in response to determining to complete the triggered reboot. In another embodiment, a node receives information about the initiated triggered reboot of the FAR, and determines whether it has critical traffic. If not, the node buffers non-critical traffic and indicates positive feedback in response to the triggered reboot, but if so, then the node continues to process the critical traffic and indicates negative feedback in response to the triggered reboot.

Abstract: In one embodiment, techniques are shown and described relating to a mixed centralized/distributed algorithm for risk mitigation in sparsely connected networks. In particular, in one embodiment, a management node determines one or more weak point nodes in a shared-media communication network, where a weak point node is a node traversed by a relatively high amount of traffic as compared to other nodes in the network. In response to determining that a portion of the traffic can be routed over an alternate acceptable node, the management node instructs the portion of traffic to reroute over the alternate acceptable node.

Abstract: In one embodiment, techniques are shown and described relating to learning machine based computation of network join times. In particular, in one embodiment, a device computes a join time of the device to join a computer network. During joining, the device sends a configuration request to a server, and receives instructions whether to provide the join time. The device may then provide the join time to a collector in response to instructions to provide the join time. In another embodiment, a collector receives a plurality of join times from a respective plurality of nodes having one or more associated node properties. The collector may then estimate a mapping between the join times and the node properties and determines a confidence interval of the mapping. Accordingly, the collector may then determine a rate at which nodes having particular node properties report their join times based on the confidence interval.

Abstract: In one embodiment, a device in a network identifies a set of one or more destination addresses for which traffic shaping is to be performed by controlling the data rate at which traffic is sent to the one or more destination addresses. The device sends the traffic to one of the destination addresses along a communication path in the network and at a particular data rate. The device identifies a change in a performance characteristic for the communication path. The device adjusts the data rate at which the traffic is sent along the communication path, in response to identifying the change in the performance characteristic for the communication path.

Abstract: In one embodiment, techniques are shown and described relating to dynamically determining node locations to apply learning machine based network performance improvement. In particular, a degree of significance of nodes in a network, respectively, is calculated based on one or more significance factors. One or more significant nodes are then determined based on the calculated degree of significance. Additionally, a nodal region in the network of deteriorated network health is determined, and the nodal region of deteriorated network health is correlated with a significant node of the one or more significant nodes.

Abstract: In one embodiment, a committed information rate (CIR) prediction is received from a machine learning model that corresponds to a predicted average traffic rate supported by a network connection. A traffic shaping strategy is adjusted based on the CIR prediction. A rate at which data is communicated over the network connection may be based on the traffic shaping policy. The effects of the adjusted traffic shaping strategy are also monitored. Feedback is further provided to the machine learning model based on the monitored effects of the adjusted traffic shaping strategy.

Abstract: In one embodiment, nodes are polled in a network for Quality of Service (QoS) measurements, and a QoS anomaly that affects a plurality of potentially faulty nodes is detected based on the QoS measurements. A path, which traverses the plurality of potentially faulty nodes, is then computed from a first endpoint to a second endpoint. Also, a median node that is located at a point along the path between the first endpoint and the second endpoint is computed. Time-stamped packets are received from the median node, and the first endpoint and the second endpoint of the path are updated based on the received time-stamped packets, such that an amount of potentially faulty nodes is reduced. Then, the faulty node is identified from a reduced amount of potentially faulty nodes.

Abstract: In one embodiment, a message is received at a caching node in a network including an indication of the message's urgency. The message is transmitted to child nodes of the caching node, and upon transmitting the message, a retransmission timer is initiated when the message is urgent, based on the indication of the message's urgency. Then, one or more acknowledgements of receipt of the transmitted message are received from one or more of the child nodes, respectively. Upon expiration of the retransmission timer, when it is determined that one or more of the child nodes did not receive the transmitted message based on the received acknowledgements, the message is retransmitted to the child nodes.

Abstract: In one embodiment, a capable node in a low power and lossy network (LLN) may monitor the authentication time for one or more nodes in the LLN. The capable node may dynamically correlate the authentication time with the location of the one or more nodes in the LLN in order to identify one or more authentication-delayed nodes. The node may then select, based on the location of the one or more authentication-delayed nodes, one or more key-delegation nodes to receive one or more network keys so that the key-delegation nodes may perform localized authentication of one or more of the authentication-delayed nodes. The capable node may then distribute the one or more network keys to the one or more key-delegation nodes.

Abstract: In one embodiment, a device determines a topological profile of individual nodes in a shared-media communication network, and also determines a respective likelihood of the nodes in the network to become a root of a floating topology based on the topological profiles. Accordingly, the device may provide instructions to particular nodes in the network based on the respective likelihoods.