Using raw network telemetry traces to generate predictive insights using machine learning
In one embodiment, a service receives telemetry data collected from a plurality of different networks. The service combines the telemetry data into a synthetic input trace. The service inputs the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), each of the models having been trained to assess telemetry data from an associated network in the plurality of different networks and predict a KPI for that network. The service compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.
1. A method comprising:
receiving, at a service, telemetry data collected from a plurality of different networks;
combining, by the service, the telemetry data into a synthetic input trace;
inputting, by the service, the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), the models comprising at least a first machine learning model trained to assess telemetry data captured in a first network of the plurality of different networks and predict a KPI for the first network and a second machine learning model trained to assess telemetry data captured in a second network of the plurality of different networks and predict the KPI for the second network; and
comparing, by the service, the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.
2. The method as in claim 1 , further comprising:
providing, by the service, an indication of the identified network as exhibiting an abnormal behavior to a user interface.
3. The method as in claim 2 , further comprising:
receiving, at the service and via the user interface, one or more parameters that specify the telemetry data to be combined into the synthetic input trace.
4. The method as in claim 1 , wherein comparing, by the service, the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior comprises:
determining that the predicted KPI for the identified network is a statistical outlier among the predicted KPIs for the plurality of different networks.
5. The method as in claim 1 , further comprising:
retrieving, by the service, the first machine learning model from the first network and the second machine learning model from the second network, wherein the service is a cloud-based service in communication with the first and second networks.
6. The method as in claim 1 , wherein combining, by the service, the telemetry data into the synthetic input trace comprises:
performing clustering on the telemetry data received from the plurality of different networks using a defined similarity metric.
7. The method as in claim 1 , further comprising:
splitting, by the service, the telemetry data into sub-sections representative of different network conditions.
8. The method as in claim 7 , wherein the different network conditions are associated with at least one of: a particular timeframe or a number of network clients.
9. An apparatus, comprising:
one or more network interfaces;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive telemetry data collected from a plurality of different networks;
combine the telemetry data into a synthetic input trace;
input the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), the models comprising at least a first machine learning model trained to assess telemetry data captured in a first network of the plurality of different networks and predict a KPI for the first network and a second machine learning model trained to assess telemetry data captured in a second network of the plurality of different networks and predict the KPI for the second network; and
compare the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.
10. The apparatus as in claim 9 , wherein the process when executed is further configured to:
provide an indication of the identified network as exhibiting an abnormal behavior to a user interface.
11. The apparatus as in claim 10 , wherein the process when executed is further configured to:
receive via the user interface, one or more parameters that specify the telemetry data to be combined into the synthetic input trace.
12. The apparatus as in claim 9 , wherein the apparatus compares the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior by:
determining that the predicted KPI for the identified network is a statistical outlier among the predicted KPIs for the plurality of different networks.
13. The apparatus as in claim 9 , wherein the process when executed is further configured to:
retrieve the plurality of machine learning models from the plurality of different networks.
14. The apparatus as in claim 9 , wherein the apparatus combines the telemetry data into the synthetic input trace by:
performing clustering on the telemetry data received from the plurality of different networks using a defined similarity metric.
15. The apparatus as in claim 9 , wherein the process when executed is further configured to:
split the telemetry data into sub-sections representative of different network conditions.
16. The apparatus as in claim 15 , wherein the different network conditions are associated with at least one of: a particular timeframe or a number of network clients.
17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a service to execute a process comprising:
receiving, at the service, telemetry data collected from a plurality of different networks;
combining, by the service, the telemetry data into a synthetic input trace;
inputting, by the service, the synthetic input trace into a plurality of machine learning models to generate a plurality of predicted key performance indicators (KPIs), the models comprising at least a first machine learning model trained to assess telemetry data captured in a first network of the plurality of different networks and predict a KPI for the first network and a second machine learning model trained to assess telemetry data captured in a second network of the plurality of different networks and predict the KPI for the second network; and
comparing, by the service, the plurality of predicted KPIs to identify one of the plurality of different networks as exhibiting an abnormal behavior.
18. The computer-readable medium as in claim 17 , wherein the process further comprises:
providing, by the service, an indication of the identified network as exhibiting an abnormal behavior to a user interface.