Learning robust and accurate rules for device classification from clusters of devices

An apparatus, comprising:

• one or more network interfaces to communicate with one or more networks;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• obtain traffic telemetry data for a plurality of devices in a network;
• apply clustering to the traffic telemetry data, to form device clusters;
• generate a device classification rule based on a particular one of the device clusters, the device classification comprising one or more conditions needed to be met to assign a device label to a device in the network;
• receive feedback from a user interface regarding the device classification rule, the feedback indicative of whether the one or more conditions accurately assign the device label to the device;
• and
• adjust the device classification rule based on the received feedback, wherein adjusting the device classification rule based on the received feedback comprises:
• determining that the rule refers to the same device type as that of another device type classification rule;
• and
• merging the two rules into a combined device type classification rule.

A method, comprising:

• applying, by a device classification service, a first clustering approach to the traffic telemetry data, to form a first set of device clusters;
• providing, by the service, data regarding one of the device clusters in the first set to a user interface;
• receiving, at the service, feedback from an end user via the user interface regarding the device cluster in the first set that indicates that the cluster should be broken up;
• and
• applying, by the service, a second clustering approach to the traffic telemetry data, to form a second set of clusters, wherein the second set of clusters comprises more device clusters than that of the first set.