Dynamic selection of models for hybrid network assurance architectures

1. A method comprising:

reporting, by a local service of a network, configuration information regarding the network to a cloud-based network assurance service;

receiving, at the local service, a classifier generated by the cloud-based network assurance service based on a plurality of modeling strategies that are selected by the cloud-based network assurance service according to the configuration information reported by the local service;

classifying, by the local service and using the received classifier, telemetry data collected from the network to select a modeling strategy for the network among the plurality of modeling strategies selected by the cloud-based network assurance service; and

installing, by the local service and based on the modeling strategy for the network, a machine learning-based model to the local service for monitoring the network.

2. The method as in claim 1 , wherein the installed machine learning-based model is a machine learning-based anomaly detector or a trained machine learning-based classifier that assesses traffic information from the network.

3. The method as in claim 1 , further comprising:

reporting, by the local service and to the cloud-based network assurance service, a set of potential input features for the classifier that are available to the local service.

4. The method as in claim 1 , further comprising:

receiving, at the local service and from the cloud-based network assurance service, the machine learning-based model, wherein the cloud-based network assurance service trained the model, and wherein the modeling strategy specifies the trained model for installation.

5. The method as in claim 1 , wherein installing, by the local service and based on the modeling strategy for the network, the machine learning-based model to the local service for monitoring the network comprises:

training, by the local service, the machine learning-based model according to the modeling strategy, wherein the modeling strategy is determined by an output of the received classifier.

6. The method as in claim 5 , wherein the modeling strategy specifies at least one of: a time window, percentile value, type of anomaly detection, or rescaling factor to be used by the machine learning-based model.

7. The method as in claim 1 , further comprising:

detecting, by the local service, a change in input features from the network for the classifier; and, in response,

requesting, by the local service, a new classifier from the cloud-based network assurance service.

8. The method as in claim 1 , further comprising:

identifying, by the local service, expiration of a reporting timer, wherein the local service reports the configuration information regarding the network to the cloud-based network assurance service after expiration of the reporting timer.

9. The method as in claim 1 , wherein classifying the telemetry data collected from the network, to select a modeling strategy for the network, further comprises:

classifying, using the received classifier, Simple Network Management Protocol (SNMP), Internet Protocol Flow Information Export (IPFIX), or Netflow information from the network.

10. The method as in claim 1 , further comprising:

using, by the local service, the installed machine learning-based model to monitor the network; and

controlling, by the local service, operation of the network based on the monitoring.

11. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

report configuration information regarding the network to a cloud-based network assurance service;

receive a classifier generated by the cloud-based network assurance service based on a plurality of modeling strategies that are selected by the cloud-based network assurance service according to the configuration information reported by the local service;

classify, using the received classifier, telemetry data collected from the network to select a modeling strategy for the network among the plurality of modeling strategies selected by the cloud-based network assurance service; and

install, based on the modeling strategy for the network, a machine learning-based model for monitoring the network.

12. The apparatus as in claim 11 , wherein the installed machine learning-based model is a machine learning-based anomaly detector or a trained machine learning-based classifier that assesses traffic information from the network.

13. The apparatus as in claim 11 , wherein the apparatus receives the classifier selected by the cloud-based network assurance service by:

receiving, from the cloud-based network assurance service, a set of input features required by the classifier.

14. The apparatus as in claim 11 , wherein the process when executed is further configured to:

receive, from the cloud-based network assurance service, the machine learning-based model, wherein the cloud-based network assurance service trained the model, and wherein the modeling strategy specifies the trained model for installation.

15. The apparatus as in claim 11 , wherein the apparatus installs, based on the modeling strategy for the network, the machine learning-based model for monitoring the network by:

training the machine learning-based model according to the modeling strategy, wherein the modeling strategy is determined by an output of the received classifier.

16. The apparatus as in claim 15 , wherein the modeling strategy specifies at least one of: a time window, percentile value, type of anomaly detection, or rescaling factor to be used by the machine learning-based model.

17. The apparatus as in claim 11 , wherein the process when executed is further configured to:

detect a change in input features from the network for the classifier; and, in response,

request a new classifier from the cloud-based network assurance service.

18. The apparatus as in claim 11 , wherein the process when executed is further configured to:

identify an expiration of a reporting timer, wherein the configuration information regarding the network is reported to the cloud-based network assurance service after expiration of the reporting timer.

19. The apparatus as in claim 11 , wherein the apparatus classifies the telemetry data collected from the network, to select a modeling strategy for the network, by:

classifying, using the received classifier, Simple Network Management Protocol (SNMP), Internet Protocol Flow Information Export (IPFIX), or Netflow information from the network.

20. A tangible, non-transitory, computer-readable medium storing program instructions that cause a local service in a network to execute a process comprising:

reporting, by the local service of the network, configuration information regarding the network to a cloud-based network assurance service;

receiving, at the local service, a generated selected by the cloud-based network assurance service based on a plurality of modeling strategies that are selected by the cloud-based network assurance service according to the configuration information reported by the local service;

classifying, by the local service and using the received classifier, telemetry data collected from the network to select a modeling strategy for the network among the plurality of modeling strategies selected by the cloud-based network assurance service; and

installing, by the local service and based on the modeling strategy for the network, a machine learning-based model to the local service for monitoring the network.