Peer comparison-based outlier detection for network performance monitoring

A network management system comprising:

• a memory storing path data for a plurality of logical paths received from a plurality of network devices operating as network gateways for an enterprise network, the path data collected by each network device of the plurality of network devices for a corresponding one or more logical paths of a physical interface from a given network device over a wide area network (WAN);
• and
• one or more processors coupled to the memory and configured to compare one or more network performance metrics specified by the path data for each of the plurality of logical paths, wherein the one or more processors are configured to:
• derive, for each of the plurality of logical paths within a specified time window, a corresponding one or more features of each of the one or more network performance metrics specified by the path data for each of the plurality of logical paths, and
• compare the corresponding one or more features of each of the one or more network performance metrics specified by the path data for each of the plurality of logical paths to determine one or more logical paths having a baseline distribution of features that deviate from a global distribution of features of the plurality of logical paths as one or more outlier logical paths out of the plurality of logical paths;
• and
• based on determining the one or more outlier logical paths, output a notification indicative of the one or more outlier logical paths out of the plurality of logical paths.

A method comprising:

• receiving, by one or more processors of a network management system from plurality of network devices operating as network gateways for an enterprise network, path data for a plurality of logical paths collected by each network device of the plurality of network devices for a respective one or more logical paths of a physical interface from a given network device over a wide area network (WAN);
• comparing, by the one or more processors, one or more network performance metrics specified by the path data for each of the plurality of logical, including:
• deriving, for each of the plurality of logical paths within a specified time window, a corresponding one or more features of each of the one or more network performance metrics specified by the path data for each of the plurality of logical paths, and
• comparing the corresponding one or more features of each of the one or more network performance metrics specified by the path data for each of the plurality of logical paths to determine one or more logical paths having a baseline distribution of features that deviate from a global distribution of features of the plurality of logical paths as one or more outlier logical paths out of the plurality of logical paths;
• and
• based on determining the one or more outlier logical paths, outputting, by the one or more processors, a notification indicative of the one or more outlier logical paths out of the plurality of logical paths.

A computer-readable storage medium comprising instructions that, when executed, cause one or more processors of a network management system to:

• receive, from plurality of network devices operating as network gateways for an enterprise network, path data for a plurality of logical paths collected by each network device of the plurality of network devices for a respective one or more logical paths of a physical interface from a given network device over a wide area network (WAN);
• compare one or more network performance metrics specified by the path data for each of the plurality of logical paths, wherein the instructions cause the one or more processors to:
• derive, for each of the plurality of logical paths within a specified time window, a corresponding one or more features of each of the one or more network performance metrics specified by the path data for each of the plurality of logical paths, and
• compare the corresponding one or more features of each of the one or more network performance metrics specified by the path data for each of the plurality of logical paths to determine one or more logical paths having a baseline distribution of features that deviate from a global distribution of features of the plurality of logical paths as one or more outlier logical paths out of the plurality of logical paths;
• and
• based on determining the one or more outlier logical paths, output a notification indicative of the one or more outlier logical paths out of the plurality of logical paths.