Hard/soft finite state machine (FSM) resetting approach for capturing network telemetry to improve device classification

1. A method comprising:

receiving, at a device classification service, a first set of telemetry data captured by one or more networking devices in a network regarding traffic associated with an endpoint device in the network;

classifying, by the device classification service, the endpoint device as being of an unknown device type, by applying a machine learning-based classifier to the first set of telemetry data;

instructing, by the device classification service, the one or more networking devices in the network to reset a finite state machine (FSM) of the traffic associated with the endpoint device;

receiving, at the device classification service, a second set of telemetry data regarding traffic associated with the endpoint device and captured after reset of the FSM; and

reclassifying, by the device classification service, the endpoint device as being of a particular device type, by applying the machine learning-based classifier to the second set of telemetry data.

2. The method as in claim 1 , further comprising:

providing, by the device classification service, an indication of the reclassification of the endpoint device to a particular one of the networking devices, wherein the particular networking device applies a network policy to traffic of the endpoint device based on the provided indication.

3. The method as in claim 1 , wherein instructing the one or more networking devices in the network to reset a FSM of the traffic associated with the endpoint device comprises:

assigning a risk level to the endpoint device based on the first set of telemetry data; and

selecting between a hard FSM reset approach and a soft FSM reset approach, based on the risk level of the endpoint device.

4. The method as in claim 3 , wherein the service selects the hard FSM reset approach, and wherein instructing the one or more networking devices in the network to reset a FSM of the traffic associated with the endpoint device comprises:

instructing the one or more networking devices to drop the traffic associated with the endpoint device.

5. The method as in claim 1 , further comprising:

identifying, by the device classification service, telemetry data associated with a particular protocol that is missing from the first set of telemetry data, wherein the reset FSM is an FSM for the particular protocol.

6. The method as in claim 5 , wherein instructing the one or more networking devices in the network to reset a FSM of the traffic associated with the endpoint device comprises:

instructing the one or more networking devices to send a spoofed control packet for the particular protocol to the endpoint device that causes the reset of the FSM for the particular protocol.

7. The method as in claim 5 , wherein the particular protocol comprises at least one of: WiFi, Transmission Control Protocol (TCP), or Stream Control Transmission Protocol (SCTP).

8. The method as in claim 1 , further comprising:

identifying, by the device classification service, telemetry data associated with a particular application that is missing from the first set of telemetry data, wherein the reset FSM is an FSM for the particular application.

9. The method as in claim 1 , wherein instructing the one or more networking devices in the network to reset a FSM of the traffic associated with the endpoint device comprises:

selecting the one or more networking devices based on their location relative to the endpoint device according to a topology of the network.

10. The method as in claim 1 , wherein the one or more networking devices cause the endpoint device to roam to a different wireless access point or re-authenticate with the network.

11. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

receive a first set of telemetry data captured by one or more networking devices in a network regarding traffic associated with an endpoint device in the network;

classify the endpoint device as being of an unknown device type, by applying a machine learning-based classifier to the first set of telemetry data;

instruct the one or more networking devices in the network to reset a finite state machine (FSM) of the traffic associated with the endpoint device;

receive a second set of telemetry data regarding traffic associated with the endpoint device and captured after reset of the FSM; and

reclassify endpoint device as being of a particular device type, by applying the machine learning-based classifier to the second set of telemetry data.

12. The apparatus as in claim 11 , wherein the process when executed is further configured to:

provide an indication of the reclassification of the endpoint device to a particular one of the networking devices, wherein the particular networking device applies a network policy to traffic of the endpoint device based on the provided indication.

13. The apparatus as in claim 11 , wherein the apparatus instructs the one or more networking devices in the network to reset a FSM of the traffic associated with the endpoint device by:

assigning a risk level to the endpoint device based on the first set of telemetry data; and

selecting between a hard FSM reset approach and a soft FSM reset approach, based on the risk level of the endpoint device.

14. The apparatus as in claim 13 , wherein the apparatus selects the hard FSM reset approach, and wherein the apparatus instructs the one or more networking devices in the network to reset a FSM of the traffic associated with the endpoint device by:

instructing the one or more networking devices to drop the traffic associated with the endpoint device.

15. The apparatus as in claim 11 , wherein the process when executed is further configured to:

identify telemetry data associated with a particular protocol that is missing from the first set of telemetry data, wherein the reset FSM is an FSM for the particular protocol.

16. The apparatus as in claim 15 , wherein the apparatus instructs the one or more networking devices in the network to reset a FSM of the traffic associated with the endpoint device by:

instructing the one or more networking devices to send a spoofed control packet for the particular protocol to the endpoint device that causes the reset of the FSM for the particular protocol.

17. The apparatus as in claim 15 , wherein the particular protocol comprises at least one of: WiFi, Transmission Control Protocol (TCP), or Stream Control Transmission Protocol (SCTP).

18. The apparatus as in claim 11 , wherein the process when executed is further configured to:

select the FSM based on an importance of a traffic telemetry feature associated with the selected FSM to classifications by the classifier.

19. The apparatus as in claim 11 , wherein the apparatus instructs the one or more networking devices in the network to reset a FSM of the traffic associated with the endpoint device by:

selecting the one or more networking devices based on their location relative to the endpoint device according to a topology of the network.

20. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device classification service to execute a process comprising:

receiving, at the device classification service, a first set of telemetry data captured by one or more networking devices in a network regarding traffic associated with an endpoint device in the network;

classifying, by the device classification service, the endpoint device as being of an unknown device type, by applying a machine learning-based classifier to the first set of telemetry data;

instructing, by the device classification service, the one or more networking devices in the network to reset a finite state machine (FSM) of the traffic associated with the endpoint device;

receiving, at the device classification service, a second set of telemetry data regarding traffic associated with the endpoint device and captured after reset of the FSM; and

reclassifying, by the device classification service, the endpoint device as being of a particular device type, by applying the machine learning-based classifier to the second set of telemetry data.