Wireless throughput issue detection using coarsely sampled application activity

1. A method, comprising:

sampling, by a service, application traffic throughputs for a set of applications present in a network;

generating, by the service, application throughput distributions for the set of applications based on the sampled application throughputs, wherein the application throughput distributions are indicative a probability of an application having a specific throughput value;

generating, by the service, a throughput model based on the sampled application throughputs, wherein the throughput model is indicative of a probability of application traffic for the set of applications occurring in the network, wherein the sampled application throughputs comprise a number of application throughput samples, for each application of the set of applications, that are obtained based on the application throughput distributions;

performing, by the service, anomaly detection on wireless throughput measurements from the network to determine whether throughput associated with a particular application of the set of applications is anomalous by comparing the wireless throughput measurements to the generated throughput model associated with the sampled application traffic throughputs; and

sending, by the service, an anomaly detection notification based on a determination that the wireless throughput measurements from the network are anomalous, the anomaly detection notification indicative of the throughput associated with the particular application being anomalous.

2. The method as in claim 1 , wherein sampling the application traffic throughputs comprises:

determining, for each of the set of applications, the probability of application traffic for the application occurring in the network; and

obtaining, for each of the set of applications, the number of application throughput samples for the application in proportion to the probability of application traffic for the application occurring in the network.

3. The method as in claim 2 , wherein generating the throughput model based on the sampled application throughputs for the set of applications comprises:

combining the obtained application throughput samples to form a total application throughput distribution for the set of applications, wherein the throughput model comprises the total application throughput distribution.

4. The method as in claim 3 , wherein performing anomaly detection on the wireless throughput measurements from the network by comparing the wireless throughput measurements to the generated throughput model comprises:

generating, by the service, a distribution of the wireless throughput measurements; and

determining, by the service, whether a distance between the distribution of the wireless throughput measurements and the total application throughput distribution exceeds a threshold.

5. The method as in claim 1 , further comprising:

receiving, from a user interface, a user selection of the set of applications.

6. The method as in claim 1 , further comprising:

selecting, by the service, the set of applications from among all applications present in the network based on the set of applications being the most active in the network.

7. The method as in claim 1 , further comprising:

dynamically adjusting an anomaly threshold for the anomaly detection based on data indicative of performance degradation derived from packets of the application traffic.

8. The method as in claim 1 , wherein generating the throughput model based on the sampled application throughputs for the set of applications comprises:

generating the throughput model for a set of one or more device types associated with the set of applications.

9. The method as in claim 1 , further comprising:

adjusting, by the service, the set of applications based on feedback from a user interface regarding relevancy of the anomaly detection notification.

10. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

sample application traffic throughputs for a set of applications present in a network;

generate application throughput distributions for the set of applications based on the sampled application throughputs, wherein the application throughput distributions are indicative a probability of an application having a specific throughput value;

generate a throughput model based on the sampled application throughputs, wherein the throughput model is indicative of a probability of application traffic for the set of applications occurring in the network, wherein the sampled application throughputs comprise a number of application throughput samples, for each application of the set of applications, that are obtained based on the application throughput distributions;

perform anomaly detection on wireless throughput measurements from the network to determine whether throughput associated with a particular application of the set of applications is anomalous by comparing the wireless throughput measurements to the generated throughput model associated with the sampled application traffic throughputs; and

send an anomaly detection notification based on a determination that the wireless throughput measurements from the network are anomalous, the anomaly detection notification indicative of the throughput associated with the particular application being anomalous.

11. The apparatus as in claim 10 , wherein the apparatus samples the application traffic throughputs by:

determining, for each of the set of applications, the probability of application traffic for the application occurring in the network; and

obtaining, for each of the set of applications, the number of application throughput samples for the application in proportion to the probability of application traffic for the application occurring in the network.

12. The apparatus as in claim 11 , wherein the apparatus generates the throughput model based on the sampled application throughputs for the set of applications by:

combining the obtained application throughput samples to form a total application throughput distribution for the set of applications, wherein the throughput model comprises the total application throughput distribution.

13. The apparatus as in claim 12 , wherein the apparatus performs anomaly detection on the wireless throughput measurements from the network by comparing the wireless throughput measurements to the generated throughput model by:

generating a distribution of the wireless throughput measurements; and

determining whether a distance between the distribution of the wireless throughput measurements and the total application throughput distribution exceeds a threshold.

14. The apparatus as in claim 10 , wherein the process when executed further comprises:

receiving, from a user interface, a user selection of the set of applications.

15. The apparatus as in claim 10 , wherein the process when executed is further configured to:

select the set of applications from among all applications present in the network based on the set of applications being the most active in the network.

16. The apparatus as in claim 10 , wherein the process when executed is further configured to:

dynamically adjust an anomaly threshold for the anomaly detection based on data indicative of performance degradation derived from packets of the application traffic.

17. The apparatus as in claim 10 , wherein the apparatus generates the throughput model based on the sampled application throughputs for the set of applications by:

generating the throughput model for a set of one or more device types associated with the set of applications.

18. The apparatus as in claim 10 , wherein the process when executed is further configured to:

adjust the set of applications based on feedback from a user interface regarding relevancy of the anomaly detection notification.

19. The apparatus as in claim 10 , wherein the anomaly detection notification is sent to a user interface via the network.

20. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

sampling application traffic throughputs for a set of applications present in a network;

generating application throughput distributions for the set of applications based on the sampled application throughputs, wherein the application throughput distributions are indicative a probability of an application having a specific throughput value;

generating a throughput model based on the sampled application throughputs, wherein the throughput model is indicative of a probability of application traffic for the set of applications occurring in the network, wherein the sampled application throughputs comprise a number of application throughput samples, for each application of the set of applications, that are obtained based on the application throughput distributions;

performing anomaly detection on wireless throughput measurements from the network to determine whether throughput associated with a particular application of the set of applications is anomalous by comparing the wireless throughput measurements to the generated throughput model associated with the sampled application traffic throughputs; and

sending an anomaly detection notification based on a determination that the wireless throughput measurements from the network are anomalous, the anomaly detection notification indicative of the throughput associated with the particular application being anomalous.