Encrypted traffic analysis control mechanisms

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• monitor collection of telemetry data by a telemetry exporter in a network, wherein the telemetry exporter collects the telemetry data from a plurality of interfaces via which a plurality of encrypted traffic flows flow, and wherein the telemetry exporter sends the collected telemetry data to a traffic analysis service for analysis;
• determine that a cost associated with the collection of the telemetry data by the telemetry exporter exceeds a cost threshold;
• select a subset of the interfaces from which telemetry data is to be captured by the telemetry exporter, based in part on a determination that the cost associated with the collection of the telemetry data exceeds the cost threshold;
• and
• control the telemetry exporter to collect telemetry data to for a subset of the plurality of encrypted traffic flows using the selected subset of interfaces.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

• monitoring collection of telemetry data by a telemetry exporter in a network, wherein the telemetry exporter collects the telemetry data from a plurality of interfaces via which a plurality of encrypted traffic flows flow, and wherein the telemetry exporter sends the collected telemetry data to a traffic analysis service for analysis;
• determining that a cost associated with the collection of the telemetry data by the telemetry exporter exceeds a cost threshold;
• selecting a subset of the interfaces from which telemetry data is to be captured by the telemetry exporter, based in part on a determination that the cost associated with the collection of the telemetry data exceeds the cost threshold;
• and
• controlling the telemetry exporter to collect telemetry data to for a subset of the plurality of encrypted traffic flows using the selected subset of interfaces.