Skip to content

Introducing Hopbox AI: What ML-Driven Network Analysis Actually Looks Like

Hopbox team
Hopbox team

“AI-powered” has become the most overused phrase in enterprise networking marketing. Every vendor claims it. Few explain what it means in practice. Today we are announcing Hopbox AI, and we are going to be specific about what it does, how it works, and where its limitations are.

What Hopbox AI Is

Section titled “What Hopbox AI Is”

Hopbox AI is a machine learning layer that sits on top of the network telemetry data we already collect from every Hopbox SD-WAN appliance. It analyzes link quality metrics, traffic patterns, and device health data to do three things:

  1. Detect anomalies before they become outages.
  2. Classify traffic patterns to inform capacity planning.
  3. Predict bandwidth needs based on historical trends and seasonality.

It is not a chatbot. It is not generative AI writing your firewall rules. It is statistical inference applied to time-series network data, built to make NOC teams faster and more proactive.

The Data Pipeline

Section titled “The Data Pipeline”

Every Hopbox device collects telemetry at regular intervals:

  • Link quality metrics: latency, jitter, packet loss, throughput per WAN link.
  • Traffic classification: per-application bandwidth usage via DPI (deep packet inspection).
  • Device health: CPU load, memory usage, uplink status, tunnel state.

This data flows into our analytics platform where it is stored, aggregated, and fed into ML models.

[Hopbox Device] → telemetry agent → [MQTT/gRPC] → [Ingest Service]
    → [Time-Series DB] → [ML Pipeline] → [Alert Engine]
                                        → [Dashboard API]

The pipeline is designed for scale. With over 900 managed sites, we process a substantial volume of telemetry data points daily. The ML models train on this aggregate dataset, which means they learn what “normal” looks like across a diverse set of deployment environments — urban offices, rural branches, sites with fiber, sites with LTE backup.

Section titled “Use Case 1: Anomaly Detection on Link Quality”

The most immediately valuable feature is anomaly detection on WAN link quality. Here is the problem it solves.

A typical SD-WAN deployment has 2-4 WAN links per site. Link quality degrades gradually — latency creeps up by a few milliseconds per day, packet loss ticks from 0.01% to 0.05% to 0.2%. Traditional threshold-based alerting does not catch this because no single metric crosses a hard threshold. By the time it does, users are already complaining.

Hopbox AI builds a baseline model for each link at each site. It learns the normal latency range for Monday mornings versus Friday evenings, accounts for seasonal patterns, and flags deviations that fall outside the expected envelope.

Normal baseline (learned):
    Latency: 12-18ms (weekday), 8-14ms (weekend)
    Jitter:  1-3ms
    Loss:    0.00-0.02%


Observed (anomaly detected):
    Latency: 24ms (↑ outside 3σ envelope for this time window)
    Jitter:  2ms  (normal)
    Loss:    0.08% (↑ trending upward over 72 hours)


→ Alert: "Link WAN1 at site BR-042 showing latency anomaly.
   Gradual degradation trend detected over 72 hours.
   Recommend ISP investigation."

This is not threshold math. It is a model that understands what each specific link normally looks like and flags when reality diverges from that baseline.

Use Case 2: Traffic Pattern Classification

Section titled “Use Case 2: Traffic Pattern Classification”

Understanding how traffic patterns shift over time is critical for capacity planning, but it is tedious to do manually across hundreds of sites.

Hopbox AI clusters sites by traffic profile and detects when a site’s profile shifts. For example:

  • A branch office that was 80% web traffic / 20% VoIP starts showing 40% video conferencing traffic after a policy change.
  • A retail location’s traffic doubles during a specific seasonal period compared to the baseline.

These shifts are surfaced as insights in the dashboard, giving network planners concrete data for capacity decisions rather than gut feelings.

Use Case 3: Bandwidth Prediction

Section titled “Use Case 3: Bandwidth Prediction”

Given historical data and detected seasonality patterns, Hopbox AI generates bandwidth forecasts per site and per link. This answers the question every network manager asks: “When will this link hit capacity?”

Site: HQ-001
Link: WAN1 (100 Mbps fiber)
Current avg utilization: 62% (peak: 78%)
Trend: +3.2% month-over-month
Forecast: 85% peak utilization in ~4 months


Recommendation: Begin ISP upgrade discussion for HQ-001 WAN1.

The model accounts for growth trends, weekly and seasonal cycles, and one-time events (which it learns to exclude from trend calculations after they occur).

Section titled “Example: Detecting a Degrading ISP Link”

Here is a real scenario from our deployment:

A site running dual ISP links started showing a slow increase in latency on one link. The increase was roughly 1-2ms per day — well within normal fluctuation for any single measurement, and well below any reasonable static alert threshold.

Hopbox AI flagged the trend after three days. The alert included:

  • The anomaly classification (gradual degradation, not a spike).
  • A graph showing the trend overlaid on the historical baseline.
  • The estimated time until the link would likely impact application performance.

The NOC team opened a ticket with the ISP. The provider identified a failing optical module at their aggregation point and replaced it. Without the early warning, this would have continued degrading until users reported poor call quality or application timeouts — likely a week or more later.

Integration with Alerting

Section titled “Integration with Alerting”

Hopbox AI does not replace your existing alerting. It augments it. Alerts from the ML layer are delivered through the same channels as traditional threshold alerts:

  • Dashboard notifications
  • Email and webhook integrations
  • PagerDuty, Slack, and Microsoft Teams via our integration API

Each AI-generated alert includes a confidence score and an explanation of why the model flagged it. We do not believe in black-box alerts — if the system says something is anomalous, it should be able to explain its reasoning in terms a network engineer understands.

What Hopbox AI Is Not

Section titled “What Hopbox AI Is Not”

Transparency about limitations matters:

  • It is not real-time. The ML pipeline operates on aggregated data with a delay that depends on collection intervals. It catches trends and patterns, not instantaneous failures. Traditional monitoring handles those.
  • It does not replace human judgment. The system proposes, humans decide. Every recommendation is exactly that — a recommendation.
  • It is not a general-purpose AI. It is purpose-built for network telemetry analysis. It will not write your documentation or answer questions in natural language.

What’s Next

Section titled “What’s Next”

This initial release focuses on detection and prediction — telling you what is happening and what is likely to happen. The next phase integrates AI-driven insights with automated provisioning, enabling the system to not only detect a degrading link but propose and apply a remediation. More on that in an upcoming post.

We are rolling out Hopbox AI to existing customers in a phased manner. If you are a current Hopbox customer, reach out to your account team to join the early access program.

Tags:
v1.7.9