Abstract:
In one embodiment, a device in a network maintains information regarding anomaly detection models used in the network and applications associated with traffic analyzed by the anomaly detection models. The device receives an indication of a planned application deployment in the network. The device adjusts an anomaly detection strategy of a particular anomaly detector in the network based on the planned application deployment and on the information regarding anomaly detection models used in the network and the applications associated with the traffic analyzed by the anomaly detection models.
Abstract:
In one embodiment, a device in a network receives an output of an anomaly detection model. The device receives state information surrounding the output of the anomaly detection model. The device determines whether the state information supports the output of the anomaly detection model. The device causes the anomaly detection model to be adjusted based on a determination that the state information does not support the output of the anomaly detection model.
Abstract:
In one embodiment, nodes are polled in a network for Quality of Service (QoS) measurements, and a QoS anomaly that affects a plurality of potentially faulty nodes is detected based on the QoS measurements. A path, which traverses the plurality of potentially faulty nodes, is then computed from a first endpoint to a second endpoint. Also, a median node that is located at a point along the path between the first endpoint and the second endpoint is computed. Time-stamped packets are received from the median node, and the first endpoint and the second endpoint of the path are updated based on the received time-stamped packets, such that an amount of potentially faulty nodes is reduced. Then, the faulty node is identified from a reduced amount of potentially faulty nodes.
Abstract:
In one embodiment, a method is disclosed in which a device receives delay information for a communication segment in a network. The device determines a predictability measurement for delays along the segment using the received delay information. The predictability measurement is advertised to one or more devices in the network and used as a routing constraint to select a routing path in the network.
Abstract:
In one embodiment, a device in a network receives fingerprints of two or more network anomalies detected in the network by different anomaly detectors. Each fingerprint comprises a hash of tags that describe a detected anomaly. The device associates the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected. The device compares the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a singular anomaly event. The device generates a notification regarding the singular anomaly event, wherein the notification includes those of the fingerprints that are associated with the singular anomaly event.
Abstract:
In one embodiment, a device (e.g., learning machine) determines a plurality of fate-sharing group (FSG) nodes in a computer network that are prone to simultaneously send an alarm upon detecting an event. As such, the device may elect one or more FSG owner nodes as a subset of the FSG nodes, and instructs the FSG group such that only FSG owner nodes send an alarm upon event detection.
Abstract:
In one embodiment, a device in a network receives traffic metrics for a plurality of applications in the network. The device populates a feature space for a machine learning-based anomaly detector. The device identifies a missing dataset in the feature space for a particular one of the plurality of applications. The device adjusts how traffic is sent in the network, to capture the missing dataset.
Abstract:
In one embodiment, a packet to be transmitted along a communication path in a network from a source to a destination is determined, the communication path having one or more hops between the source and the destination. An instruction is sent to one or more tracking nodes along the communication path to track a number of local retransmissions required to successfully transmit the packet from each tracking node to a respective next-hop destination. Then, reports indicating the number of local retransmissions are received from the one or more tracking nodes.
Abstract:
In one embodiment, a device in a network receives data indicative of traffic characteristics of traffic associated with a particular application. The device identifies one or more paths in the network via which the traffic associated with the particular application was sent, based on the traffic characteristics. The device determines a probing schedule based on the traffic characteristics. The probing schedule simulates the traffic associated with the particular application. The device sends probes along the one or more identified paths according to the determined probing schedule.
Abstract:
In one embodiment, a machine learning model for predicting one or more metrics is run in a network which includes a centralized controller device interconnected with a plurality of edge devices. A batch version of the machine learning model that operates in batch mode is hosted at the centralized controller device. Then, an incremental version of the machine learning model that operates in incremental mode is pushed to an edge device of the plurality of edge devices, such that the incremental version of the machine learning model is hosted at the edge device. As a result, the batch version and the incremental version of the machine learning model run in parallel with one another.