Inferring QoE degradation from implicit signals in user behavior
In one embodiment, a device obtains interaction data indicative of a flow of interactions performed by a user with an online application accessible via a network. The device detects an anomaly by applying an anomaly detection model to the interaction data. The device determines that the anomaly is attributable to a condition present in the network. The device causes performance of an adjustment to the network, to mitigate the condition.
1 . A method comprising:
obtaining, by a device, interaction data indicative of a flow of interactions performed by a user with an online application accessible via a network, wherein the interaction data is captured by a web browser or a browser plugin installed to an endpoint operated by the user and used to access the online application via the network;
determining, by the device, a first score indicative of an anomaly associated with the interactions performed by the user by applying an anomaly detection model to the interaction data, wherein the anomaly detection model compares the interaction data to a user activity graph to detect the anomaly;
inputting, by the device, network telemetry and the first score indicative of the anomaly as input to a prediction model;
generating, by the device, through executing the prediction model, and based on the network telemetry and the first score indicative of the anomaly, a second score indicative of a presence of a network performance condition in the network; and
causing, by the device and based on the first score indicative of the anomaly associated with the interactions performed by the user and the second score indicative of the presence of the network performance condition, performance of an adjustment to the network to mitigate the network performance condition.
2 . The method as in claim 1 , wherein the adjustment to the network comprises rerouting application traffic sent between an endpoint of the user and the online application via a first path in the network to a second path in the network.
3 . The method as in claim 1 , wherein the network telemetry is indicative of at least one of path loss, latency, or jitter in the network.
4 . The method as in claim 1 , wherein the interaction data is based on browser waterfall data that is captured by the web browser or the browser plugin.
5 . The method as in claim 4 , wherein the browser waterfall data indicates resource requests sent by the web browser during a session with the online application, protocol information for the resource requests, and timing information for the resource requests.
6 . The method as in claim 1 , wherein the anomaly detection model is specific to a geographic location or employment information associated with the user.
7 . The method as in claim 1 , wherein the anomaly detection model computes a probability of the user performing a particular action within the online application over time as the first score, and the first score indicates a Quality of Experience (QoE) of the user with the online application.
8 . The method as in claim 1 , further comprising:
providing, by the device, the interaction data to a user interface for display.
9 . The method as in claim 1 , wherein the interaction data comprises a graph of user actions within the online application.
10 . An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
obtain interaction data indicative of a flow of interactions performed by a user with an online application accessible via a network, wherein the interaction data is captured by a web browser or a browser plugin installed to an endpoint operated by the user and used to access the online application via the network;
determine a first score indicative of an anomaly associated with the interactions performed by the user, by applying an anomaly detection model to the interaction data, wherein the anomaly detection model compares the interaction data to a user activity graph to detect the anomaly;
input network telemetry and the first score indicative of the anomaly to a prediction model;
generate, through executing the prediction model, and based on the network telemetry and the first score indicative of the anomaly, a second score indicative of a presence of a network performance condition in the network; and
cause, based on the first score indicative of the anomaly associated with the interactions performed by the user and the second score indicative of the presence of the network performance condition, a performance of an adjustment to the network to mitigate the network performance condition.
11 . The apparatus as in claim 10 , wherein the adjustment to the network comprises rerouting application traffic sent between an endpoint of the user and the online application via a first path in the network to a second path in the network.
12 . The apparatus as in claim 10 , wherein the network telemetry is indicative of at least one of path loss, latency, or jitter in the network.
13 . The apparatus as in claim 10 , wherein the interaction data is based on browser waterfall data captured by the web browser or the browser plugin.
14 . The apparatus as in claim 13 , wherein the browser waterfall data indicates resource requests sent by the web browser during a session with the online application, protocol information for the resource requests, and timing information for the resource requests.
15 . The apparatus as in claim 10 , wherein the anomaly detection model is specific to a geographic location or employment information associated with the user.
16 . The apparatus as in claim 10 , wherein the anomaly detection model computes a probability of the user performing a particular action within the online application over time as the first score, and the first score indicates a Quality of Experience (QoE) of the user with the online application.
17 . The apparatus as in claim 10 , wherein the process when executed is further configured to:
provide the interaction data to a user interface for display.
18 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
obtaining, by the device, interaction data indicative of a flow of interactions performed by a user with an online application accessible via a network, wherein the interaction data is captured by a web browser or a browser plugin installed to an endpoint operated by the user and used to access the online application via the network;
determining, by the device, a first score indicative of an anomaly associated with the interactions performed by the user, by applying an anomaly detection model to the interaction data, wherein the anomaly detection model compares the interaction data to a user activity graph to detect the anomaly;
inputting, by the device, network telemetry and the first score indicative of the anomaly to a prediction model;
generating, by the device, through executing the prediction model, and based on the network telemetry and the first score indicative of the anomaly, a second score indicative of a presence of a network performance condition in the network; and
causing, by the device and based on the first score indicative of the anomaly associated with the interactions performed by the user and the second score indicative of the presence of the network performance condition, performance of an adjustment to the network to mitigate the network performance condition.
19 . The method of claim 1 , wherein causing, by the device and based on the first score indicative of the anomaly associated with the interactions performed by the user and the second score indicative of the presence of the network performance condition, performance of an adjustment to the network to mitigate the network performance condition, further comprises:
comparing, by the device, the first score with the second score; and
determining, by the device and based on a difference between the first score and the second score, that the anomaly is caused by the network performance condition.
20 . The method of claim 1 , wherein the anomaly detection model includes a machine learning model that is trained by performing:
classifying training data into classes based at least in part on labels associated with the training data; and
minimizing a cost function associated with the machine learning model.