Continuous validation of active labeling for device type classification

1. A method comprising:

forming, by a device classification service, a device cluster by applying clustering to telemetry data associated with a plurality of devices;

obtaining, by the service, device type labels for the device cluster from one or more user interfaces;

generating, by the service, a device type classification rule that assigns a particular one of the device type labels to a device using the device type labels and the telemetry data;

determining, by the service, whether the device type classification rule should be revalidated by applying a revalidation policy to the device type classification rule; and

revalidating, by the service, the device type classification rule, based on a determination that the device type classification rule should be revalidated.

2. The method as in claim 1 , wherein the revalidation policy is based on one or more characteristics of the rule comprising one or more of: a degree of consensus among the device type labels used to generate the device type classification rule, a number of conflicts between the rule and one or more other rules, or a number of times devices matched the device type classification rule.

3. The method as in claim 2 , wherein determining whether the device type classification rule should be revalidated by applying the revalidation policy to the device type classification rule comprises:

applying a machine learning anomaly detector to the one or more characteristics of the obtained device type labels.

4. The method as in claim 3 , further comprising:

adjusting a sensitivity level of the anomaly detector, based on a rate at which the device type labels are reconfirmed during revalidation of the device type classification rule.

5. The method as in claim 1 , further comprising:

reducing authorization of devices assigned the particular one of the device type labels by the device type classification rule, after determining that the device type classification rule should be revalidated.

6. The method as in claim 1 , further comprising:

moving devices assigned the particular one of the device type labels by the device type classification rule to a pending state, after determining that the device type classification rule should be revalidated; and

labeling the devices in the pending state as being of an unknown device type, when the device type classification rule is not revalidated in a threshold amount of time.

7. The method as in claim 1 , wherein the device type classification rule is configured to assign the particular one of the device type labels to the device, based on its associated telemetry data.

8. The method as in claim 1 , wherein revalidating the device type classification rule comprises:

re-obtaining device type labels for the device type cluster.

9. The method as in claim 1 , wherein revalidating the device type classification rule comprises:

selecting a subset of the plurality of devices based on their distance to a centroid of the device cluster; and

re-obtaining device type labels for the selected subset of the plurality of devices.

10. The method as in claim 1 , wherein revalidating the device type classification rule comprises:

obtaining feedback regarding the device type classification rule from the one or more user interfaces.

11. The method as in claim 1 , further comprising:

deploying the device type classification rule to a plurality of networks; and

notifying at least one of the plurality of networks when the device type classification rule fails revalidation.

12. An apparatus, comprising:

one or more network interfaces to communicate with one or more networks;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

form a device cluster by applying clustering to telemetry data associated with a plurality of devices;

obtain device type labels for the device cluster from one or more user interfaces;

generate a device type classification rule that assigns a particular one of the device type labels to a device using the device type labels and the telemetry data;

determine whether the device type classification rule should be revalidated by applying a revalidation policy to the device type classification rule; and

revalidate the device type classification rule, based on a determination that the device type classification rule should be revalidated.

13. The apparatus as in claim 12 , wherein the revalidation policy is based on one or more characteristics of the rule comprising one or more of: a degree of consensus among the device type labels used to generate the device type classification rule, a number of conflicts between the rule and one or more other rules, or a number of times devices matched the device type classification rule.

14. The apparatus as in claim 13 , wherein the apparatus determines whether the device type classification rule should be revalidated by applying the revalidation policy to the device type classification rule by:

applying a machine learning anomaly detector to the one or more characteristics of the obtained device type labels.

15. The apparatus as in claim 14 , wherein the process when executed is further configured to:

adjust a sensitivity level of the anomaly detector, based on a rate at which the device type labels are reconfirmed during revalidation of the device type classification rule.

16. The apparatus as in claim 12 , wherein the process when executed is further configured to:

reduce authorization of devices assigned the particular one of the device type labels by the device type classification rule, after determining that the device type classification rule should be revalidated.

17. The apparatus as in claim 12 , wherein the process when executed is further configured to:

move devices assigned the particular one of the device type labels by the device type classification rule to a pending state, after determining that the device type classification rule should be revalidated; and

label the devices in the pending state as being of an unknown device type, when the device type classification rule is not revalidated in a threshold amount of time.

18. The apparatus as in claim 12 , wherein the apparatus revalidates the device type classification rule by:

obtaining feedback regarding the device type classification rule from one or more the user interfaces.

19. The apparatus as in claim 12 , wherein the process when executed is further configured to:

deploy the device type classification rule to a plurality of networks; and

notify at least one of the plurality of networks when the device type classification rule fails revalidation.

20. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device classification service to execute a process comprising:

forming, by the device classification service, a device cluster by applying clustering to telemetry data associated with a plurality of devices;

obtaining, by the service, device type labels for the device cluster from one or more user interfaces;

generating, by the service, a device type classification rule that assigns a particular one of the device type labels to a device using the device type labels and the telemetry data;

determining, by the service, whether the device type classification rule should be revalidated by applying a revalidation policy to the device type classification rule; and

revalidating, by the service, the device type classification rule, based on a determination that the device type classification rule should be revalidated.