Abstract:
In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.
Abstract:
In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.
Abstract:
Various implementations disclosed herein provide a method for anonymizing data in a distributed hierarchical network. In various implementations, the method includes determining a first set of attribute hierarchy counts that indicate a number of occurrences of corresponding attributes that are stored at the first network node and have not been transmitted upstream towards the hub. In various implementations, the method includes receiving, from a second network node, a second set of attribute hierarchy counts that indicate a number of occurrences of corresponding attributes at the second network node. In various implementations, the method includes determining whether a sum based on the first and second set of attribute hierarchy counts satisfies an anonymization criterion. In some implementations, the sum indicates a total number of occurrences for a corresponding attribute that are stored at the first and second network nodes and have not been transmitted upstream towards the hub.
Abstract:
In one embodiment, a supervisory service for a software-defined wide area network (SD-WAN) detects seasonal service level agreement (SLA) violations by one or more tunnels in the SD-WAN using a machine learning-based regression model. The service identifies a root cause of the seasonal SLA violations by determining whether the root cause of the seasonal SLA violations is associated with an internal network connected to the one or more tunnels. The service further identifies the root cause by determining whether the root cause of the seasonal SLA violations is associated with a particular service provider network over which the one or more tunnels traverse by associating the seasonal SLA violations with SLA violations by tunnels in other SD-WANs that also traverse the particular service provider network. The service initiates a corrective measure based on the determined root cause of the seasonal SLA violations by the one or more tunnels.
Abstract:
Methods and apparatus for managing interruptions in a multiple communication mode environment are provided herein. For example, a method may include receiving at least first instance of communication data associated with a first communication mode; obtaining first attribute data related to the first instance of communication data; classifying the first instance of communication data into first category based on the first attribute data using the interruption management device; and determining whether to interrupt a user by delivering the first instance of communication data based on the first category. The first category may be selected from a plurality of predetermined categories using a classification algorithm.
Abstract:
In an embodiment, an improved computer-implemented method of efficiently determining actions to perform based on data from a streaming continuous queries in a distributed computer system comprises, at a central control computer, receiving a streaming continuous query and a rule-set; wherein the rule-set comprises decision data representing decisions based on attributes produced by the query, and action data representing end actions based on the decisions, wherein the attributes comprise data processed by one or more networked computers; separating the streaming continuous query into a sub-query executable at one or more edge computers; categorizing end actions from the set based on decisions requiring attributes available from the sub-query into a set of one or more edge expressions that are configured to be evaluated at an edge agent to cause an action; providing the set of edge expressions and the sub-query to at least one edge computer with instructions to process visible attributes on the edge computer and to evaluate the set of one or more edge expressions independently from the central control computer; wherein the method is performed by one or more computing devices.
Abstract:
In one embodiment, a network assurance service that monitors a network receives key performance indicators (KPIs) for a plurality of network entities in the network. The service applies clustering to the KPIs, to form KPI clusters. The service designates the network entities associated with the particular KPI cluster as belonging to a peer group, based in part on an assessment that the network entities associated with the particular KPI cluster share one or more attributes. The service uses a machine learning model to identify one of the network entities in the peer group as anomalous among the network entities in the peer group.
Abstract:
In one embodiment, a network assurance service that monitors a network calculates network frequency distributions of a performance measurement from the network over a plurality of different time periods. The service calculates entity frequency distributions of the performance measurement for a plurality of different groupings of one or more network entities in the network over the plurality of different time periods. The service determines distance measurements between the network frequency distributions and the entity frequency distributions. The service identifies a particular one of the grouping of one or more networking entities as an outlier, based on a change in distance measurements between the network frequency distributions and the entity frequency distributions for the particular grouping. The service provides an indication of the identified outlier grouping to a user interface.
Abstract:
In one embodiment, a network assurance service that monitors a network detects a pattern of network measurements from the network that are associated with a particular network problem. The network assurance service tracks characteristics of the detected pattern over time. The network assurance service uses the tracked characteristics of the detected pattern over time as input to a machine learning-based pattern analyzer. The pattern analyzer is configured to determine whether the detected pattern is a perpetual or transient pattern in the network, and the pattern analyzer is further configured to detect anomalies in the characteristics of the pattern. The network assurance service initiates a change to the network based on an output of the machine learning-based pattern analyzer.
Abstract:
In one embodiment, a network assurance service that monitors a wireless network receives data regarding connection failures of a wireless client of the wireless network. The network assurance service forms a behavioral profile for the wireless client based on the received data regarding the connection failures of the wireless client. The network assurance service uses machine learning to determine whether the behavioral profile of the wireless client is an outlier in relation to behavioral profiles of other wireless clients of the wireless network. The network assurance service causes performance of a mitigation action with respect to the wireless client, when the wireless client is determined to be an outlier.