KPI trajectory-driven outlier detection in a network assurance service

1. A method comprising:

receiving, at a network assurance service that monitors a network, a plurality of key performance indicators (KPIs) for a networking device in the network over time;

representing, by the network assurance service, relationship changes between the KPIs over time as a set of one or more KPI trajectories;

using, by the network assurance service, a machine learning-based model to determine that a behavior of the networking device is anomalous, based on the one or more KPI trajectories; and

providing, by the network assurance service, an indication of the anomalous behavior of the networking device to a user interface,

wherein using the machine learning-based model to determine that the behavior of the networking device is anomalous comprises:

mapping the one or more KPI trajectories to one or more KPI-based tensors; and

using the one or more KPI-based tensors as input to the machine learning-based model.

2. The method as in claim 1 , wherein the networking device comprises a wireless access point or wireless access point controller.

3. The method as in claim 1 , wherein the machine learning-based model determines that the behavior of the networking device is anomalous based on at least one of: a direction, magnitude, or speed of the one or more KPI trajectories.

4. The method as in claim 3 , further comprising:

using sample KPI trajectories for a plurality of networking devices as input to an anomaly detector, to obtain anomaly scores for the plurality of networking devices; and

training the machine learning-based model using the obtained anomaly scores.

5. The method as in claim 3 , further comprising:

receiving user feedback regarding sample KPI trajectories for a plurality of networking devices, wherein the user feedback comprises anomaly scores for the plurality of networking devices; and

training the machine learning-based model using the user feedback.

6. The method as in claim 1 , wherein the machine learning-based model comprises a convolutional neural network.

7. The method as in claim 1 , wherein the machine learning-based model is trained using a training dataset comprising KPI tensors associated with a plurality of networking devices and binary labels that label each of the plurality of networking devices as anomalous or non-anomalous.

8. The method as in claim 1 , wherein the plurality of KPIs comprise one or more of: utilization, client count, or throughput.

9. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

receive a plurality of key performance indicators (KPIs) for a networking device in the network over time;

represent relationship changes between the KPIs over time as a set of one or more KPI trajectories;

use a machine learning-based model to determine that a behavior of the networking device is anomalous, based on the one or more KPI trajectories; and

provide an indication of the anomalous behavior of the networking device to a user interface,

wherein the apparatus uses the machine learning-based model to determine that the behavior of the networking device is anomalous by:

mapping the one or more KPI trajectories to one or more KPI-based tensors; and

using the one or more KPI-based tensors as input to the machine learning-based model.

10. The apparatus as in claim 9 , wherein the networking device comprises a wireless access point or wireless access point controller.

11. The apparatus as in claim 9 , wherein the plurality of KPIs comprise one or more of: utilization, client count, or throughput.

12. The apparatus as in claim 9 , wherein the machine learning-based model determines that the behavior of the networking device is anomalous based on at least one of: a direction, magnitude, or speed of the one or more KPI trajectories.

13. The apparatus as in claim 12 , wherein the process when executed is further configured to:

receive user feedback regarding sample KPI trajectories for a plurality of networking devices, wherein the user feedback comprises anomaly scores for the plurality of networking devices; and

train the machine learning-based model using the user feedback.

14. The apparatus as in claim 9 , wherein the machine learning-based model is trained using a training dataset comprising KPI tensors associated with a plurality of networking devices and binary labels that label each of the plurality of networking devices as anomalous or non-anomalous.

15. The apparatus as in claim 9 , wherein the machine learning-based model comprises a convolutional neural network.

16. A tangible, non-transitory, computer-readable medium storing program instructions that cause a network assurance service to execute a process comprising:

receiving, at the network assurance service, a plurality of key performance indicators (KPIs) for a networking device in the network over time;

representing, by the network assurance service, relationship changes between the KPIs over time as a set of one or more KPI trajectories;

using, by the network assurance service, a machine learning-based model to determine that a behavior of the networking device is anomalous, based on the one or more KPI trajectories; and

providing, by the network assurance service, an indication of the anomalous behavior of the networking device to a user interface,

wherein using the machine learning-based model to determine that the behavior of the networking device is anomalous comprises:

mapping the one or more KPI trajectories to one or more KPI-based tensors; and

using the one or more KPI-based tensors as input to the machine learning-based model.

17. The computer-readable medium as in claim 16 , wherein the networking device comprises a wireless access point or wireless access point controller.

18. The computer-readable medium as in claim 16 , wherein the machine learning-based model determines that the behavior of the networking device is anomalous based on at least one of: a direction, magnitude, or speed of the one or more KPI trajectories.

19. A method comprising:

receiving, at a network assurance service that monitors a network, a plurality of key performance indicators (KPIs) for a networking device in the network over time;

representing, by the network assurance service, relationship changes between the KPIs over time as a set of one or more KPI trajectories;

using, by the network assurance service, a machine learning-based model to determine that a behavior of the networking device is anomalous, based on the one or more KPI trajectories, wherein the machine learning-based model determines that the behavior of the networking device is anomalous based on at least one of: a direction, magnitude, or speed of the one or more KPI trajectories;

providing, by the network assurance service, an indication of the anomalous behavior of the networking device to a user interface;

receiving user feedback regarding sample KPI trajectories for a plurality of networking devices, wherein the user feedback comprises anomaly scores for the plurality of networking devices; and

training the machine learning-based model using the user feedback.