System and methods to validate issue detection and classification in a network assurance system

1. A computer-implemented method comprising:

identifying event sequences within network traffic data;

filtering out a subset of the event sequences based on characteristics of the subset of the event sequences;

generating definition groups by performing clustering on the subset of the event sequences, the definition groups comprising event sequence characteristics associated with one or more network issues;

first simulating the subset of the event sequences;

generating, based on results of the first simulating, a first issue identification;

second simulating a most recent one of the identified event sequences;

generating, based on results of the second simulating and the generated definition groups, a second issue identification; and

validating the first issue identification with the second issue identification.

2. The method of claim 1 , wherein the issue simulation engine includes a client simulation for simulating a portion of the event sequences from a client device perspective.

3. The method of claim 1 , wherein the definition groups are associated with onboarding failures.

4. The method of claim 3 , wherein the onboarding failures comprise an excess onboarding transaction.

5. The method of claim 1 , wherein the network traffic data is generated by network devices comprising one of a wireless local area network controller (WLC) or an access point (AP).

6. The method of claim 1 , wherein the network traffic data comprises a data model including one of a wireless client state, client statistics, AP radio frequency (RF) statistics, an over air packet capture, a network services key performance indicator (KPI), or a device health KPI.

7. The method of claim 1 , further comprising generating a first issue identification by applying a rules-based issue identification process to the simulated event sequences.

8. A non-transitory media storing instructions that when executed by a processor of a system cause the system to perform operations comprising:

identify event sequences within network traffic data;

filter out a subset of the event sequences based on characteristics of the subset of the event sequences;

generate definition groups by performing clustering on the subset of the event sequences, the definition groups comprising event sequence characteristics associated with one or more network issues;

first simulate the subset of the event sequences

generate, based on results of the first simulating, a first issue identification;

second simulate a most recent one of the identified event sequences;

generate, based on results of the second simulating and the generated definition groups, a second issue identification; and

validate the first issue identification with the second issue identification.

9. The non-transitory media of claim 8 , wherein the issue simulation engine includes a client simulation for simulating a portion of the event sequences from a client device perspective.

10. The non-transitory media of claim 8 , wherein the definition groups are associated with onboarding failures.

11. The non-transitory media of claim 10 , wherein the onboarding failures comprise an excess onboarding transaction.

12. The non-transitory media of claim 8 , wherein the network traffic data is generated by network devices comprising one of a wireless local area network controller (WLC) or an access point (AP).

13. The non-transitory media of claim 8 , wherein the network traffic data comprises a data model including one of a wireless client state, client statistics, AP radio frequency (RF) statistics, an over air packet capture, a network services key performance indicator (KPI), or a device health KPI.

14. The non-transitory media of claim 8 , the operations further comprising generate a first issue identification by applying a rules-based issue identification process to the simulated event sequences.

15. A system, comprising:

a processor:

a non-transitory media storing instructions that when executed by a processor of a system cause the system to perform operations comprising:

identify event sequences within network traffic data;

filter out a subset of the event sequences;

generate definition groups by performing clustering on the subset of the event sequences, the definition groups comprising event sequence characteristics associated with one or more network issues;

first simulate the subset of the event sequences

generate, based on results of the first simulating, a first issue identification;

second simulate a most recent one of the identified event sequences;

generate, based on results of the second simulating and the generated definition groups, a second issue identification; and

validate the first issue identification with the second issue identification.

16. The system of claim 15 , wherein the issue simulation engine includes a client simulation for simulating a portion of the event sequences from a client device perspective.

17. The system of claim 15 , wherein the definition groups are associated with onboarding failures.

18. System of claim 17 , wherein the onboarding failures comprise an excess onboarding transaction.

19. The system of claim 15 , wherein the network traffic data is generated by network devices comprising one of a wireless local area network controller (WLC) or an access point (AP).

20. The system of claim 15 , wherein the network traffic data comprises a data model including one of a wireless client state, client statistics, AP radio frequency (RF) statistics, an over air packet capture, a network services key performance indicator (KPI), or a device health KPI.