Event-triggered machine learning for rare event forecasting in a software defined wide area Network (SD-WAN)

An apparatus, comprising:

• one or more network interfaces to communicate with a software-defined wide area network (SD-WAN);
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• identify a trigger event among a plurality of trigger event types based on a probability of a failure occurring in the SD-WAN within a time period after the trigger event occurring in the SD-WAN;
• detect that the trigger event has occurred in the SD-WAN;
• activate, in response to detecting the occurrence of the trigger event, a machine learning model to assess telemetry data regarding a first tunnel in the SD-WAN, wherein the machine learning model is configured to predict failures in the SD-WAN and trained using a training dataset that is created based at least in part on occurrences of the trigger event in the SD-WAN;
• predict a failure of the first tunnel, based on the assessment of the telemetry data regarding the first tunnel by the machine learning model;
• and
• proactively reroute at least a subset of traffic on the first tunnel onto a second tunnel in the SD-WAN, in advance of the predicted failure of the first tunnel.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a service in a software-defined wide area network (SD-WAN) to execute a process comprising:

• identifying, by the service, a trigger event among a plurality of trigger event types based on a probability of a failure occurring in the SD-WAN within a time period after the trigger event occurring in the SD-WAN;
• detecting, by the service, that the trigger event has occurred in the SD-WAN;
• activating, by the service and in response to detecting the occurrence of the trigger event, a machine learning model to assess telemetry data regarding a first tunnel in the SD-WAN, wherein the machine learning model is configured to predict failures in the SD-WAN and trained using a training dataset that is created based at least in part on occurrences of the trigger event in the SD-WAN;
• predicting, by the service, a failure of the first tunnel, based on the assessment of the telemetry data regarding the first tunnel by the machine learning model;
• and
• proactively rerouting, by the service, at least a subset of traffic on the first tunnel onto a second tunnel in the SD-WAN, in advance of the predicted failure of the first tunnel.