Cisco Technology, Inc.

Michal Wladyslaw Garcarz

Jean-Philippe Vasseur

Eduard Schornig

Grégory Mermoud

Vinay Kumar Kolar

Pierre-André Savalle

Piotr Jerzy Kupisiewicz

Guy Keinan

Paweł Tybinka

In one embodiment, a device discovers one or more network interfaces that an endpoint in a local network could use to access an online application. The device identifies a plurality of connectivity options available to the endpoint to access the online application via an external network. The device makes a prediction that a path that comprises a particular connectivity option from among the plurality of connectivity options and a particular network interface from among the one or more network interfaces will provide an optimal quality of experience metric associated with the online application. The device causes the endpoint to use the path to connect to the online application.

Predictive application-aware routing for remote work

In one embodiment, a device obtains media data captured by an endpoint of an online application that results from conducting a test in a network that subjects traffic of the online application to a particular network path degradation pattern. The device receives user feedback regarding the media data from one or more user interfaces. The device computes, based on the user feedback, a quality of experience metric for the online application associated with the particular network path degradation pattern. The device causes a configuration change to be made with respect to the online application, based on the quality of experience metric.

Quantifying application quality of experience under different path performance motifs

In one embodiment, a device identifies a plurality of online applications whose traffic is conveyed via an interface of a networking entity of a network. The device computes a relationship between a quality of experience metric for a particular online application in the plurality of online applications and a traffic volume associated with the interface for the plurality of online applications. The device makes, based on the relationship, a determination that degradation of the quality of experience metric for the particular online application is due to the traffic volume associated with the interface for the plurality of online applications. The device reconfigures, based on the determination, the networking entity to prioritize traffic for the particular online application.

Optimizing application experience in hybrid work environments

In one embodiment, a device obtains telemetry data associated with an online application accessible via a network. The device trains, based on the telemetry data, a machine learning model to determine whether a given address in the network is associated with the online application. The device uses the machine learning model to generate a listing of network addresses associated with the online application. The device provides the listing of network addresses for use by an application detection service in the network to determine that an initial packet of a traffic flow is associated with the online application based on a match between a destination address of that packet and a network address in the listing of network addresses.

Using machine learning for online application detection

In one embodiment, a device obtains client attribute data for clients of an online application that access the online application via a plurality of points of presence in a network. The device forms a performance model that models an application experience metric for the online application as a function of the client attribute data for each of the plurality of points of presence. The device selects, using the performance model, a particular point of presence from among the plurality of points of presence to be used by a particular client to access the online application, based on its client attribute data. The device causes the particular client to access the online application via the particular point of presence selected by the device using the performance model.

SASE pop selection based on client features

In one embodiment, a device obtains quality of experience labels for an online application accessible via a network. The device also obtains telemetry data from the network that is associated with quality of experience labels. The device makes, based on the quality of experience labels and telemetry data, a determination as to whether the online application is similar to a second online application for which a prediction model is already available. The device trains, based on the determination, a prediction model for the online application to predict a quality of experience metric for the online application.

Gathering labels from proprietary applications for QoE predictions

In one embodiment, a device obtains application data captured by an intermediate node in a network by inserting monitoring code into traffic associated with one or more online applications accessible via the network. The device identifies, based on the application data, a workflow of actions performed by a user of the one or more online applications. The device determines that a particular stage of the workflow is associated with a quality of experience metric for the one or more online applications being degraded. The device provides a recommended change in the network for presentation by a user interface that is expected to optimize the quality of experience metric for the one or more online applications.

Discovering multi-application workflows to identify potential qoe- impacting issues

In one embodiment, a device makes a determination that user application experience is degraded for a client endpoint of an online application due to a current path in a network that conveys application traffic associated with the online application. A device identifies a bypass path in the network for the application traffic. The device provisions an optimization gateway along the bypass path to forward the application traffic from the client endpoint to the online application. The device causes an endpoint agent executed by the client endpoint to send the application traffic to the optimization gateway for forwarding to the online application via the bypass path.

Cognitive networking using a device endpoint agent

In one embodiment, a device obtains a set of one or more configuration parameters of an online application accessed by a plurality of clients via a network. The device obtains path information regarding paths in the network via which the plurality of clients accesses the online application. The device determines an updated configuration parameter predicted by a prediction model to increase application experience of the online application based on the path information and the set of one or more configuration parameters. The device provides the updated configuration parameter for use by the online application.

Feedback loop control of an online application based on network characteristics affecting user experience

In one embodiment, a device computes, for each of a set of points of presence (PoPs) via which traffic for an online application can be sent from a location, application experience metrics predicted for the application over time. The device assigns, for each of the set of PoPs, weights to different time periods, based on measures of uncertainty associated with the predicted application experience metrics. The device generates, based on the weights assigned to the different time periods for each of the set of PoPs, schedules for probing network paths connecting the location to the online application via those PoPs. The device causes the network paths to be probed in accordance with their schedules. Results of this probing are used to select a particular PoP from among the set of PoPs via which traffic for the online application should be sent from the location during a certain time period.

Actively learning PoPs to probe and probing frequency to maximize application experience predictions

In one embodiment, a device generates an application map for an online application accessed via a network that indicates a set of network addresses at which the online application was accessed, client information for clients that accessed the online application via the network, and quality of experience metrics for the online application. The device identifies a location change of the online application by tracking changes to the application map. The device determines a correlation between the location change and a degradation in the quality of experience metrics. The device adjusts, based on the correlation, routing of traffic associated with the online application in the network.

Identifying application QoE changes due to application location migration

In one embodiment, a device identifies a potential change in user experience of an online application. The device selects, based on the potential change in user experience, a set of one or more users of the online application. The device obtains, from the set of one or more users of the online application, feedback regarding their experience with the online application. The device uses the feedback obtained from the set of one or more users of the online application to make a routing decision in a network regarding traffic of the online application.

Opportunistic user feedback gathering for application-aware routing

In one embodiment, a device obtains path probe data between one or more end-user sites and an online application. The device makes, based on the path probe data, a prediction as to whether a direct Internet access path or a backhaul path would offer better application performance for the online application. The device generates, based on the prediction, a split tunnel policy for a particular end-user site. The device causes a particular end-user site to connect to the online application in accordance with the split tunnel policy.

Dynamic AI-driven split tunneling policies for remote teleworkers

A network management system is configured to detect one or more malicious activities at one or more devices connected to a network. The network management system is configured to determine a malware root of the one or more malicious activities and generate a network-wide indicating a hierarchical relationship between the malicious activities spawned by the malware root and the malware root. The malicious activities spawned by the malware root represented in the network-wide malware include the one or more malicious activities and include a plurality of malicious activities spawned across a plurality of devices connected to the network.

Network-wide malware mapping

In one embodiment, a device obtains quality of experience metrics for an online application. The device obtains network metrics for one or more network paths over which traffic for the online application was routed. The device identifies a lack of correlation between the quality of experience metrics for the online application and the network metrics for the one or more network paths over which traffic for the online application was routed. The device disables, based on the lack of correlation, explicit probing of the one or more network paths.

Growing community of inventors

Cracow, Poland

Michal Wladyslaw Garcarz