Learning stable representations of devices for clustering-based device classification systems

1. A method, comprising:

obtaining, by a device classification service, telemetry data captured by one or more intermediate network nodes for a plurality of devices in a network;

repeatedly assigning, by the device classification service, the devices to device clusters by applying clustering to the obtained telemetry data;

determining, by the device classification service, a measure of stability loss associated with the cluster assignments, wherein the measure of stability loss is based in part on whether a device is repeatedly assigned to the same device cluster;

determining, by the device classification service and based on the measure of stability loss, that the cluster assignments have stabilized; and

obtaining, by the device classification service, device type labels for the device clusters, after determining that the cluster assignments have stabilized when a number or percentage of devices repeatedly assigned to the same device cluster exceeds a threshold during the assigning of the devices to the device clusters.

2. The method as in claim 1 , wherein the obtained telemetry data is indicative of traffic features of traffic associated with the devices and observed in the network.

3. The method as in claim 1 , wherein repeatedly assigning the devices to device clusters by applying clustering to the obtained telemetry data comprises:

using the telemetry data as input to an autoencoder, to learn a lower dimensional representation of the telemetry data; and

using the lower dimensional representation of the telemetry data as input to a clustering process.

4. The method as in claim 3 , wherein the device classification service is a cloud-based service, the method further comprising:

deploying the autoencoder to the network, to send the lower dimensional representation of the telemetry data to the cloud-based service.

5. The method as in claim 3 , further comprising:

using the cluster assignments as classification loss labels for the autoencoder.

6. The method as in claim 1 , wherein the device type labels are indicative of a device operating system, a device manufacturer, a device make, a device model, or a device function.

7. The method as in claim 1 , wherein the device type labels are obtained through active labeling by requesting labels from one or more expert users.

8. The method as in claim 1 , further comprising:

determining that a particular device belongs to a particular one of the device clusters; and

assigning device type label for the particular device cluster to the particular device.

9. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

obtain telemetry data captured by one or more intermediate network nodes for a plurality of devices in a network;

repeatedly assign the devices to device clusters by applying clustering to the obtained telemetry data;

determine a measure of stability loss associated with the cluster assignments, wherein the measure of stability loss is based in part on whether a device is repeatedly assigned to the same device cluster;

determine, based on the measure of stability loss, that the cluster assignments have stabilized; and

obtain device type labels for the device clusters, after determining that the cluster assignments have stabilized when a number or percentage of devices repeatedly assigned to the same device cluster exceeds a threshold during the assigning of the devices to the device clusters.

10. The apparatus as in claim 9 , wherein the obtained telemetry data is indicative of traffic features of traffic associated with the devices and observed in the network.

11. The apparatus as in claim 9 , wherein the apparatus repeatedly assigning the devices to device clusters by applying clustering to the obtained telemetry data by:

using the telemetry data as input to an autoencoder, to learn a lower dimensional representation of the telemetry data; and

using the lower dimensional representation of the telemetry data as input to a clustering process.

12. The apparatus as in claim 11 , wherein the process when executed is further configured to:

deploy the autoencoder to the network of the devices, to send the lower dimensional representation of the telemetry data to the apparatus.

13. The apparatus as in claim 11 , wherein the process when executed is further configured to:

use the cluster assignments as classification loss labels for the autoencoder.

14. The apparatus as in claim 9 , wherein the device type labels are indicative of a device operating system, a device manufacturer, a device make, a device model, or a device function.

15. The apparatus as in claim 9 , wherein the device type labels are obtained through active labeling by requesting labels from one or more expert users.

16. The apparatus as in claim 9 , wherein the process when executed is further configured to:

determine that a particular device belongs to a particular one of the device clusters; and

assign device type label for the particular device cluster to the particular device.

17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device classification service to execute a process comprising:

obtaining, by the device classification service, telemetry data captured by one or more intermediate network nodes for a plurality of devices in a network;

repeatedly assigning, by the device classification service, the devices to device clusters by applying clustering to the obtained telemetry data;

determining, by the device classification service, a measure of stability loss associated with the cluster assignments, wherein the measure of stability loss is based in part on whether a device is repeatedly assigned to the same device cluster;

determining, by the device classification service and based on the measure of stability loss, that the cluster assignments have stabilized; and

obtaining, by the device classification service, device type labels for the device clusters, after determining that the cluster assignments have stabilized when a number or percentage of devices repeatedly assigned to the same device cluster exceeds a threshold during the assigning of the devices to the device clusters.

18. The computer-readable medium as in claim 17 , wherein repeatedly assigning the devices to device clusters by applying clustering to the obtained telemetry data comprises:

using the telemetry data as input to an autoencoder, to learn a lower dimensional representation of the telemetry data; and

using the lower dimensional representation of the telemetry data as input to a clustering process.

19. The computer-readable medium as in claim 18 , wherein the device classification service is a cloud-based service, the process further comprising:

deploying the autoencoder to the network, to send the lower dimensional representation of the telemetry data to the cloud-based service.

20. The computer readable medium as in claim 18 , wherein the process further comprises:

using the cluster assignments as classification loss labels for the autoencoder.