Hewlett Packard Enterprise Development LP

Gopal Gupta

Abhinesh Mishra

Isaac Theogaraj

Sumit Kumar

Gopal Agarwal

Amit Kumar Gupta

Jacob Philip Michael

Sachin Ganu

Jose Tellado

Bernd Bandemer

Ataur Rehman

Sriram Murthy

Peera Reddy Polaka

Aseem Sethi

Amit Agrawal

Nagendra Babu Rapaka

Ajay Vishwanath Bhande

Shashidhara Seetharamaiah Ganesharao

Nirmal Rajarathnam

Raghavendra Gopinath

Siddharood Halli

Charan Malyala

Avadhesh Karia

A system receives one or more ingress data packets from a client device or a user in a network. The system obtains attributes, via packet inspection, from the one or more ingress data packets, and determines one or more embedding vectors from the attributes. The one or more embedding vectors represent a status of a session during which the ingress data packets are obtained. The system transmits the one or more embedding vectors as inputs to a trained machine learning model. The system infers, using the trained machine learning mode, one or more security policies based on the embedding vectors. The system provides or implementing the one or more security policies.

Adaptive enforcement of security within a network

Examples described herein relate to generation of radio frequency (RF) plans for network deployments. Examples described herein may receive an input RF plan with modified set of features of a network deployment area. A first machine learning (ML) model generates an intermediate RF plan indicating candidate AP locations based on the modified set of features and a first set of parameters. A second ML model determines a network optimization score for the intermediate RF plan. Based on the optimization score, the first set of parameters are optimized. The first ML model generates an output RF plan indicating optimized AP locations based on the optimized first set of parameters and the modified set of features.

Radio frequency plan generation for network deployments

A forced upgrade technique for airgapped network management system (NMS) deployments utilizes a package upgrade record. The package upgrade record includes metadata about a target major version of a software package for the NMS deployment, and is generated by an update server that is airgapped from the NMS deployment. A control server of the NMS deployment determines whether the package upgrade record has been provided to the control server. Access to a user interface of the control server is denied in response to the package upgrade record not having been provided to the control server within an upgrade check window, while access to the user interface of the control server is permitted in response to the package upgrade record having been provided to the control server. Additionally, the NMS deployment may be forced to upgrade the software package to the target major.

Forced upgrade for airgapped network management system

Systems and methods are provided for optimizing resource consumption by bringing intelligence to the key allocation process for fast roaming. Specifically, embodiments of the disclosed technology use machine learning to predict which AP a wireless client device will migrate to next. In some embodiments, machine learning may also be used to select a subset of top neighbors from a neighborhood list. Thus, instead of allocating keys for each of the APs on the neighborhood list, key allocation may be limited to the predicted next AP, and the subset of top neighbors. In some embodiments, a reinforcement learning model may be used to dynamically adjust the size of the subset in order to optimize resources while satisfying variable client demand.

Optimizing key allocation during roaming using machine learning

In an example implementation consistent with the features disclosed herein, network management system deployments with a large operational footprint are given a longer grace period before they are forced to upgrade than network management system deployments with a small operational footprint. Criticality scores for the network management system deployments are calculated based on the operational footprints of the network management system deployments. The network management system deployments are grouped into criticality groups based on the criticality scores for the network management system deployments. The network management system deployments are forced to upgrade within timelines that are based on the criticality groups in which the network management system deployments are grouped.

Forced upgrade for network management system

The present disclosure describes dynamic intrusion detection and prevention in computer networks. The method includes generation of clusters of network sites based on a plurality of parameters related to operational features and network threats associated with the network sites. Data models are trained upon the clusters developed through the clustering. The data models are executed to predict a threat frequency of each network threat for each cluster. A difference between the predicted threat frequency of each network threat and corresponding baseline frequencies is determined. Dynamic rulesets are configured, based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequencies, for each cluster by integrating rules applicable to prevent each network threat.

Dynamic intrusion detection and prevention in computer networks

Systems and methods are provided for dynamic virtual private network concentrators (VPNC) gateway selection and on-demand VRF-ID configuration. A dynamic VPNC gateway selection component can dynamically route to a particular VPNC gateway based on multiple user-specific factors, including: a) behavior of users on the network; and b) performance of a destination service/device. A dynamic VPNC gateway selection component can rank a user based on one or more factors relating to the behavior of the user. Also, the dynamic VPNC gateway selection component can determine whether a VPNC gateway at a data center is healthy, and whether a destination service at the data center is healthy. The dynamic VPNC gateway selection component can dynamically select a VPNC gateway from a plurality of VPNC gateways at the data center for communicating forwarded traffic from the user based on the user's ranking if either the VPNC gateway or the service are unhealthy.

Dynamic selection of a VPNC gateway based on user behavior

Some examples relate to identifying a dynamic network parameter probe interval in an SD-WAN. In an example, a controller may define a probe profile of an uplink in the SD-WAN. The probe profile of the uplink may include a static probe interval and a probe retry value. The controller may determine the value of the network parameter for the uplink, prior to expiration of a static probe timer interval. If the value of the network parameter is in negative deviation with a baseline value of the network parameter, the controller may identify a dynamic probe interval for each successive determination of the value of the network parameter. The identification of the dynamic probe interval for a given successive determination may depend on at least one previously determined value of the network parameter. The controller may initiate duplicate network traffic on a secondary uplink in the SD-WAN.

Identifying a dynamic network parameter probe interval in an SD-WAN

Examples relate to a BC network including a plurality of network devices deployed in a network. The plurality of network devices includes an authoritative network device that generates a transaction in a distributed ledger. The transaction includes location information of a new public key certificate to be deployed in each of the network devices. In order to verify the transaction, a network device of the plurality of network devices verifies, using a smart contract, whether the new public key certificate is valid and whether the new public key certificate is different from a previously recorded public key certificate in the distributed ledger. In response to successful verification by at least a predefined number of network devices of the plurality of network devices, each of the network device record the transaction in the distributed ledger.

Updating public key certificates in network devices using a blockchain network

Some examples relate to managing multicast group traffic. In an example, a switch anchor controller receives a request for a multicast group from an associated network switch in a multicast-capable network. The associated network switch registers to the switch anchor controller in the multicast-capable network. In response to the request, the switch anchor controller selects a non-anchor controller in the multicast-capable network to serve the multicast group to the associated network switch. The switch anchor controller provides the information related to the non-anchor controller to the associated network switch, which in response creates a specific multicast tunnel between the associated network switch and the non-anchor controller to transfer multicast traffic related to the multicast group.

Managing multicast group traffic

Examples described herein provide for associating a network device to a network management system (NMS). Examples herein include determining, by a network orchestrator, a set of embeddings indicative of characteristics of the network device and each of a plurality of instances of the NMS. Examples herein include determining, by the network orchestrator for each of the plurality of instances, a probability score based on the set of embeddings, wherein the probability score is indicative of a likelihood of the network device to be associated with the instance. Examples herein further include, based on the probability score for each of the plurality of instances, selecting, by the network orchestrator, a first instance of the plurality of instances to associate with the network device. Examples herein include associating, by the network orchestrator, the network device to the first instance.

Network device association with network management system

In an example, a Dynamic Host Configuration Protocol (DHCP) lease request from a client device connected to a network is received. Based on the DHCP lease request, an Internet Protocol (IP) address is assigned to the client device for a lease time. A first lease renewal request is received. A probability of utilization for a lease time block is predicted based on a historical lease pattern, device characteristics, traffic information, and DHCP information. Based on a combination of the probability of utilization and a reward value, the lease time block is allotted for lease renewal. For each allotment, the reward value is adjusted based on deployment characteristics and traffic load in the network, and a network connection duration of the client device. A normalized reward value for the lease time block is determined based on reward values for the lease time block over multiple allotments.

Dynamic host configuration protocol lease allotment

Dynamic path steering utilizing automatic generation of user threshold profiles is described. An example of a storage medium includes instructions for obtaining a threshold policy for a first application, the threshold policy including a set of threshold values for operational parameters; generating a migration score for a first user, the migration score based at least in part on a user score for the first user; generating a set of secondary threshold values for the first user based at least in part on the migration score and the set of threshold values; enabling operation of the first application for the first user using a first network uplink; monitoring network parameter values in operation of the first application; and upon detecting an operational parameter value exceeding a secondary threshold value, migrating operation of the first application for the first user from the first network uplink to a second network uplink.

Dynamic path steering utilizing automatic generation of user threshold profiles

Systems and methods are provided for new network device provisioning without Internet access. One method may include a method of network device provisioning without Internet access, the method including entering a pre-shared key (PSK) in a dynamic host configuration protocol (DHCP) message, obtaining the PSK from a set of DHCP message options by an onboarding network device requesting to join a private network, presenting the PSK, by the onboarding network device, to a network management system (NMS) of the private network, validating the PSK by the NMS, and updating an inventory list of the NMS to include the onboarding network device in the inventory list.

Growing community of inventors

Bengaluru, India

Gopal Gupta