Abstract: In one embodiment, a device receives application experience metrics for a software-as-a-service application. The device generates, based on the application experience metrics, a predictive model that predicts application experience scores for a plurality of network service providers that provide connectivity to the software-as-a-service application. The device selects a particular network service provider for use by a location, based on an application experience score predicted by the predictive model. The device sends an indication of the particular network service provider to the location.

Abstract: In one embodiment, a device obtains metadata for routing decisions made by a predictive routing service for a plurality of network deployments. The device identifies a network topology for a network deployment that does not use the predictive routing service. The device estimates, based on the metadata for routing decisions made by the predictive routing service, performance metrics for the predictive routing service were it to be used to make routing decisions for the network topology. The device sends, to a user interface, report data indicative of the performance metrics estimated for the predictive routing service were it to be used to make routing decisions for the network topology.

Abstract: In one embodiment, a device in a network receives an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network. The device receives labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate scanning activity. The device trains a machine learning-based classifier using the labeled traffic data to distinguish between legitimate and illegitimate scanning activity in the network. The device deploys the trained classifier to the first node, to distinguish between legitimate and illegitimate scanning activity in the network.

Abstract: In one embodiment, a network assurance service that monitors one or more networks identifies changes in a key performance indicator for each of a plurality of network entities in the one or more networks. The service forms a peer group of network entities from the plurality of network entities whose changes in the key performance indicator are correlated. The service monitors the key performance indicator for network entities in the peer group of network entities. The service, based on the monitoring, detects an anomalous change in the key performance indicator for a particular network entity in the peer group of network entities relative to other network entities in the peer group of network entities.

Abstract: In one embodiment, a labeling service receives traffic feature data for a cluster of endpoint devices in a network. A device classification service forms the cluster of endpoint devices by applying machine learning-based clustering to the feature data. The labeling service selects a subset of the endpoint devices in the cluster, in an effort to maximize diversity of the traffic feature data of the selected endpoint devices. The labeling service sends a control command into the network, to trigger a traffic behavior by the selected subset. The labeling service receives updated traffic feature data for the selected subset associated with the triggered traffic behavior. The labeling service controls whether a label request is sent to a user interface for labeling of the cluster of endpoint devices with a device type, based on the updated traffic feature data for the subset of endpoint devices in the cluster.