Abstract: In one embodiment, a primary root node may detect one or more neighboring root nodes based on information received from a first-hop node and may select a backup root node among the neighboring root nodes. Once selected, the backup root node may send the primary root node a networking identification and a corresponding group mesh key which the primary root node may forward to the first-hop nodes to cause the first-hop nodes to migrate to the backup root node when connectivity to the primary root node fails. In addition, the first-hop root nodes may migrate back to the primary root node when connectivity to the primary root node is restored.

Abstract: In one embodiment, a targeted node in a computer network receives a probe generation request (PGR), and in response, generates a link-local multicast PGR (PGR-Local) carrying instructions for generating probes based on the PGR. The targeted node then transmits the PGR-Local to neighbors of the targeted node to cause one or more of the neighbors to generate and transmit probes to a collection device in the computer network according to the PGR-Local instructions. In another embodiment, a particular node in a computer network receives a link-local multicast probe generation request (PGR-Local) from a targeted node in the computer network, the targeted node having received the PGR-Local from a remote device, and determines how to generate probes based on instructions carried within the PGR-Local before sending one or more probes to a collection device in the computer network according to the PGR-Local instructions.

Abstract: In one embodiment, techniques are shown and described relating to dynamically adjusting a set of monitored network properties using distributed learning machine feedback. In particular, in one embodiment, a learning machine (or distributed learning machines) determines a plurality of monitored network properties in a computer network. From this, a subset of relevant network properties of the plurality of network properties may be determined, such that a corresponding subset of irrelevant network properties based on the subset of relevant network properties may also be determined. Accordingly, the computer network may be informed of the irrelevant network properties to reduce a rate of monitoring the irrelevant network properties.

Abstract: In one embodiment, a node receives a request to initiate a shadow joining operation to shadow join a field area router (FAR) of a computer network, and preserves its data structures and soft states. The shadow joining operation may then be initiated to shadow join the FAR, wherein shadow joining comprises preforming join operations without leaving a currently joined-FAR, and the node measures one or more joining metrics of the shadow joining operation, and reports them accordingly. In another embodiment, a FAR (or other management device) determines a set of nodes to participate in a shadow joining operation, and informs the set of nodes of the shadow joining operation to shadow join the FAR. The device (e.g., FAR) participates in the shadow joining operation, and receives reports of one or more joining metrics of the shadow joining operation measured by the set of nodes.

Abstract: In one embodiment, a message is received at a node in a network indicating that the node is classified as a critical node, and requesting the node to proactively time-stamp data packets. Data packets are received from one or more child nodes of the node, and the node selects a data packet of the received data packets to time-stamp. Then, the node proactively inserts a time-stamp in the selected data packet. The time-stamped data packet is sent toward a central management node.

Abstract: In one embodiment, network data is received at a Learning Machine (LM) in a network. It is determined whether the LM recognizes the received network data based on information available to the LM. When the LM fails to recognize the received network data: a connection to a central management node is established, a request is sent for information relating to the unrecognized network data to the central management node, and information is received from the central management node in response to the request. The received information assists the LM in recognizing the unrecognized network data.

Abstract: In one embodiment, techniques are shown and described relating to learning machine based detection of abnormal network performance. In particular, in one embodiment, a border router receives a set of network properties xi and network performance metrics Mi from a network management server (NMS), and then intercepts xi and Mi transmitted from nodes in a computer network of the border router. As such, the border router may then build a regression function F based on xi and Mi, and can detect one or more anomalies in the intercepted xi and Mi based on the regression function F. In another embodiment, the NMS, which instructed the border router, receives the detected anomalies from the border router.

Abstract: In one embodiment, techniques are shown and described relating to a Hidden Markov Model based architecture to monitor network node activities and predict relevant periods. In particular, in one embodiment, a device determines a statistical model for each of one or more singular-node traffic profiles (e.g., based on one or more Hidden Markov Models (HMMs) each corresponding to a respective one of the one or more traffic profiles). By analyzing respective traffic from individual nodes in a computer network, and matching the respective traffic against the statistical model for the one or more traffic profiles, the device may detecting a matching traffic profile for the individual nodes in a computer network. In addition, the device may predict relevant periods of traffic for the individual nodes by extrapolating a most-likely future sequence based on prior respective traffic of the individual nodes and the corresponding matching traffic profile.

Abstract: In one embodiment, variables maintained by each of a plurality of Learning Machines (LMs) are determined. The LMs are hosted on a plurality of Field Area Routers (FARs) in a network, and the variables are sharable between the FARs. A plurality of correlation values defining a correlation between the variables is calculated. Then, a cluster of FARs is computed based on the plurality of correlation values, such that the clustered FARs are associated with correlated variables, and the cluster allows the clustered FARs to share their respective variables.

Abstract: In one embodiment, techniques are shown and described relating to traffic-based inference of influence domains in a network by using learning machines. In particular, in one embodiment, a management device computes a time-based traffic matrix indicating traffic between pairs of transmitter and receiver nodes in a computer network, and also determines a time-based quality parameter for a particular node in the computer network. By correlating the time-based traffic matrix and time-based quality parameter for the particular node, the device may then determine an influence of particular traffic of the traffic matrix on the particular node.

Abstract: In one embodiment, a state tracking engine (STE) defines one or more classes of elements that can be tracked in a network. A set of elements to track is determined from the one or more classes, and the set of elements is tracked in the network. Access to the tracked set of elements then provided via one or more corresponding application programming interfaces (APIs). In another embodiment, a metric computation engine (MCE) defines one or more network metrics to be tracked in the network. One or more tracked elements are received from the STE. The one or more network metrics are tracked in the network based on the received one or more tracked elements. Access to the tracked network metrics is then provided via one or more corresponding APIs.

Abstract: In one embodiment, network data is processed using a Learning Machine (LM) algorithm in a network, and results of the processing of network data are determined. A reliability checking algorithm is selected to determine a reliability level of the results. The reliability checking algorithm may be a local reliability checking algorithm or an external reliability checking algorithm. The reliability level of the results is determined using the reliability checking algorithm. Then, the LM algorithm is adjusted based on the determined reliability level.

Abstract: In one embodiment, nodes are polled in a network for Quality of Service (QoS) measurements, and a QoS anomaly that affects a plurality of potentially faulty nodes is detected based on the QoS measurements. A path, which traverses the plurality of potentially faulty nodes, is then computed from a first endpoint to a second endpoint. Also, a median node that is located at a point along the path between the first endpoint and the second endpoint is computed. Time-stamped packets are received from the median node, and the first endpoint and the second endpoint of the path are updated based on the received time-stamped packets, such that an amount of potentially faulty nodes is reduced. Then, the faulty node is identified from a reduced amount of potentially faulty nodes.

Abstract: In one embodiment, techniques are shown and described relating to dynamically determining node locations to apply learning machine based network performance improvement. In particular, a degree of significance of nodes in a network, respectively, is calculated based on one or more significance factors. One or more significant nodes are then determined based on the calculated degree of significance. Additionally, a nodal region in the network of deteriorated network health is determined, and the nodal region of deteriorated network health is correlated with a significant node of the one or more significant nodes.

Abstract: In one embodiment, a request is received from a requesting node in a network to assist in distributing a task of the requesting node. Upon receiving the message, a capability to perform the task of one or more helping nodes in the network is evaluated, and a helping node of the one or more helping nodes is selected to perform the task based on the evaluated capability of the selected helping node. The distribution of the task is then authorized from the requesting node to the selected helping node.

Abstract: In one embodiment, techniques are shown and described relating to a distributed architecture for layered Hidden Markov Models. In particular, in one embodiment, a Hidden Markov Model (HMM) at a layer i receives a sequence of hidden state produced by an HMM at a layer i?1, and uses the sequence of hidden state produced by the HMM at layer i?1 as input to the HMM at layer i, where the HMM at layer i?1 uses first time period bins, and the HMM at layer i uses second time period bins that are greater in length than the first time period bins. In another embodiment, the HMM at layer i originates the input (e.g., from measured properties), and produces the sequence of hidden state to output it to an HMM at a layer i+1 for use as its input.

Abstract: In one embodiment, a triggered reboot of a field area router (FAR) of a computer network is initiated, and gathered states of the FAR are saved. The nodes in the computer network are informed of the triggered reboot, and then feedback may be collected from the nodes in response to the triggered reboot. As such, it can be determined whether to complete the triggered reboot based on the feedback, and the FAR is rebooted in response to determining to complete the triggered reboot. In another embodiment, a node receives information about the initiated triggered reboot of the FAR, and determines whether it has critical traffic. If not, the node buffers non-critical traffic and indicates positive feedback in response to the triggered reboot, but if so, then the node continues to process the critical traffic and indicates negative feedback in response to the triggered reboot.

Abstract: In one embodiment, techniques are shown and described relating to learning machine based computation of network join times. In particular, in one embodiment, a device computes a join time of the device to join a computer network. During joining, the device sends a configuration request to a server, and receives instructions whether to provide the join time. The device may then provide the join time to a collector in response to instructions to provide the join time. In another embodiment, a collector receives a plurality of join times from a respective plurality of nodes having one or more associated node properties. The collector may then estimate a mapping between the join times and the node properties and determines a confidence interval of the mapping. Accordingly, the collector may then determine a rate at which nodes having particular node properties report their join times based on the confidence interval.

Abstract: In one embodiment, techniques are shown and described relating to a mixed centralized/distributed algorithm for risk mitigation in sparsely connected networks. In particular, in one embodiment, a management node determines one or more weak point nodes in a shared-media communication network, where a weak point node is a node traversed by a relatively high amount of traffic as compared to other nodes in the network. In response to determining that a portion of the traffic can be routed over an alternate acceptable node, the management node instructs the portion of traffic to reroute over the alternate acceptable node.

Abstract: In one embodiment, a capable node in a computer network may host a path computation element, receive one or more neighborhood discovery messages including neighborhood information from a plurality of nodes in the computer network, and compute a minimum spanning tree (MinTree) for the computer network based on the neighborhood information. The MinTree may divide the plurality of nodes in the computer network into a first subset of routing nodes and a second subset of host nodes. The first subset of routing nodes may form one or more interconnected paths of routing nodes within the MinTree, and each host node within the second subset of host nodes may be located within one hop of at least one routing node. The capable node may then communicate a MinTree message to the plurality of nodes in the computer network to build the MinTree by enabling routing on each routing node.