Cisco Technology, Inc.

Pierre-André Savalle

Jean-Philippe Vasseur

Grégory Mermoud

Vinay Kumar Kolar

David Tedaldi

Laurent Sartran

Javier Cruz Mota

Eduard Schornig

Sébastien Gay

Alexandre Honoré

Michal Wladyslaw Garcarz

Jürg Nicolaus Diemand

Andrea Di Pietro

Fabien Flacher

Sukrit Dasgupta

Kevin Gagnon

Sharon Shoshana Wulff

Romain Kakko-Chiloff

Stéphane Bernard Martin

Jean-Phillippe Vasseur

In one implementation, a device receives an input request for a large language model-based network troubleshooting agent regarding an issue in a network. The large language model-based network troubleshooting agent performs a lookup of a recipe based on the input request, wherein the recipe comprises contextual information for the issue. The device generates, by the large language model-based network troubleshooting agent, a prompt for a large language model based on the input request and on the recipe. The device provides, by the large language model-based network troubleshooting agent, the prompt to the large language model to troubleshoot the issue in the network.

LLM-based network troubleshooting using expert-curated recipes

In one embodiment, a device uses a multi-armed bandit model to select different network paths over time via which traffic associated with an online application is routed. The device obtains, from a provider of the online application, application experience metrics associated with the different network paths and indicative of user satisfaction with the online application. The device learns, by the multi-armed bandit model, which of the different network paths will provide satisfactory application experience metrics, based on the application experience metrics associated with the different network paths. The device causes the traffic associated with the online application to be routed via a set of one or more paths expected by the multi-armed bandit model to provide satisfactory application experience metrics for the online application.

Avoiding user experience disruptions using contextual multi-armed bandits

In one implementation, a troubleshooting agent executed by a device receives an indication of an anomaly detected in a network by an anomaly detection agent. The troubleshooting agent uses a language model to determine a root cause of the anomaly. The troubleshooting agent determines whether automated remediation for the root cause is allowed by a policy. The troubleshooting agent provides a remediation request to a remediation agent in the network to remediate the root cause of the anomaly, when the policy allows automated remediation for the root cause.

Multi-agent coordination for network anomaly detection, troubleshooting, and remediation using language models

In one embodiment, a device obtains data regarding routing decisions made by a machine learning-based predictive routing engine for a network. The device determines, based on the data regarding the routing decisions, a behavior of the machine learning-based predictive routing engine. The device compares the behavior of the machine learning-based predictive routing engine to a behavioral policy for the machine learning-based predictive routing engine. The device adjusts operation of the machine learning-based predictive routing engine, when the behavior of the machine learning-based predictive routing engine violates the behavioral policy.

Safety net engine for machine learning-based network automation

In one embodiment, a supervisory service for a network obtains quality of experience metrics for application sessions of an online application. The supervisory service maps the application sessions to paths that traverse a plurality of autonomous systems. The supervisory service identifies, based in part on the quality of experience metrics, a particular autonomous system from the plurality of autonomous systems associated with a decreased quality of experience for the online application. The supervisory service causes application traffic for the online application to avoid the particular autonomous system.

Autonomous system bottleneck detection

In one embodiment, a service tracks performance of a machine learning model over time. The machine learning model is used to monitor one or more computer networks based on data collected from the one or more computer networks. The service also tracks performance metrics associated with training of the machine learning model. The service determines that a degradation of the performance of the machine learning model is anomalous, based on the tracked performance of the machine learning model and performance metrics associated with training of the model. The service initiates a corrective measure for the degradation of the performance, in response to determining that the degradation of the performance is anomalous.

Anomaly detection of model performance in an MLOps platform

In one embodiment, a device obtains characteristics of a first anomaly detection model executed by a first distributed learning agent in a network. The device receives a query from a second distributed learning agent in the network that requests identification of a similar anomaly detection to that of a second anomaly detection model executed by the second distributed learning agent. The device identifies, after receiving the query from the second distributed learning agent, the first anomaly detection model as being similar to that of the second anomaly detection model, based on the characteristics of the first anomaly detection model. The device causes the first anomaly detection model to be sent to the second distributed learning agent for execution.

Hierarchical models using self organizing learning topologies

In one embodiment, a device obtains quality of experience labels for an online application accessible via a network. The device also obtains telemetry data from the network that is associated with quality of experience labels. The device makes, based on the quality of experience labels and telemetry data, a determination as to whether the online application is similar to a second online application for which a prediction model is already available. The device trains, based on the determination, a prediction model for the online application to predict a quality of experience metric for the online application.

Gathering labels from proprietary applications for QoE predictions

In one embodiment, a device obtains application data captured by an intermediate node in a network by inserting monitoring code into traffic associated with one or more online applications accessible via the network. The device identifies, based on the application data, a workflow of actions performed by a user of the one or more online applications. The device determines that a particular stage of the workflow is associated with a quality of experience metric for the one or more online applications being degraded. The device provides a recommended change in the network for presentation by a user interface that is expected to optimize the quality of experience metric for the one or more online applications.

Discovering multi-application workflows to identify potential qoe- impacting issues

In one embodiment, a service in a network computes an expected information gain associated with rerouting traffic from a first tunnel onto a backup tunnel in the network. The service initiates, based on the expected information gain, rerouting of the traffic from the first tunnel onto the backup tunnel. The service obtains performance measurements for the traffic rerouted onto the backup tunnel. The service uses the performance measurements to train a machine learning model to predict whether rerouting traffic from the first tunnel onto the backup tunnel will satisfy a service level agreement (SLA) of the traffic.

Adaptive stress testing of SD-WAN tunnels for what-if scenario model training

In one embodiment, a device makes a determination that user application experience is degraded for a client endpoint of an online application due to a current path in a network that conveys application traffic associated with the online application. A device identifies a bypass path in the network for the application traffic. The device provisions an optimization gateway along the bypass path to forward the application traffic from the client endpoint to the online application. The device causes an endpoint agent executed by the client endpoint to send the application traffic to the optimization gateway for forwarding to the online application via the bypass path.

Cognitive networking using a device endpoint agent

In one embodiment, a device obtains a set of one or more configuration parameters of an online application accessed by a plurality of clients via a network. The device obtains path information regarding paths in the network via which the plurality of clients accesses the online application. The device determines an updated configuration parameter predicted by a prediction model to increase application experience of the online application based on the path information and the set of one or more configuration parameters. The device provides the updated configuration parameter for use by the online application.

Feedback loop control of an online application based on network characteristics affecting user experience

In one embodiment, a device trains, using feedback from a reference cohort of users of an online application, a prediction model to predict a quality of experience metric for the online application based on network telemetry. The device uses the prediction model to predict quality of experience metrics for different cohorts of users of the online application. The device makes one or more comparisons between performance metrics for the prediction model for the different cohorts of users, based on the quality of experience metrics predicted for the different cohorts of users. The device retrains, based on the one or more comparisons, the prediction model using feedback from the reference cohort and a particular cohort from among the different cohorts of users.

Robust training of application QoE prediction models

In various embodiments, a device obtains a set of device classification rules. Each device classification rule specifies one or more attributes from a set of attributes and being configured to assign a device type to an endpoint in a network when the endpoint exhibits the one or more attributes specified by that rule. The device forms a graphical representation of the set of attributes. The device performs an analysis of the graphical representation of the set of attributes. The device provides a result of the analysis to a user interface.

Learning and assessing device classification rules

In one embodiment, a device obtains an indication of a network event predicted by a routing engine for a network. The device initiates monitoring of one or more network paths associated with the network event, to determine one or more states of the network. The device makes a comparison between the one or more states of the network and a set of one or more constraints. The device provides a prediction cancelation notification to the routing engine, based on the comparison.

Growing community of inventors

Rueil-Malmaison, France

Pierre-André Savalle