UC Santa Barbara

Machine learning promises to help networks monitor, diagnose, secure, and optimize themselves under conditions that increasingly exceed the reach of static rules and manual operation. Yet this promise in academia is limited by a credibility crisis: many network ML systems report excellent benchmark performance while remaining opaque, brittle under deployment shifts, and dependent on artifacts of the data-collection or evaluation pipeline. This dissertation argues that credible machine learning for networking requires treating diagnosis, data collection, and model design as a connected problem rather than as isolated stages.The dissertation studies this problem through three complementary methods. First, it develops diagnostic techniques for scrutinizing what network ML models learn. Trustee extracts high-fidelity, low-complexity decision-tree explanations and trust reports from black-box models, and the Intrinsic Evaluation Framework probes network foundation models through embedding geometry, alignment with domain-expert traffic features, and controlled sensitivity tests. Second, it builds data-collection infrastructure for realistic and reusable experimentation: PINOT combines passive monitoring and active measurements on the UCSB production network, while netUnicorn provides a thin-waist, intent-based platform for closed-loop data collection across heterogeneous physical and virtual environments. Third, it translates the diagnostic findings into model design through netFound, a network-native foundation model with protocol-aware tokenization, operational context embeddings, burst-flow hierarchical attention, and privacy-by-construction inputs, and explores context-grounded LLMs for interpreting network measurements.Together, these studies show that benchmark accuracy alone is a poor proxy for deployment credibility. Published network ML models can learn shortcuts, spurious correlations, and out-of-distribution vulnerabilities; existing network foundation models often exhibit collapsed embeddings, inconsistent alignment with expert features, and unwanted payload dependence. The systems contributions show that realistic, iterative data collection can expose and reduce these failures, improving generalization across environments and attack variants while reducing experiment implementation effort. Finally, netFound demonstrates that diagnostics-informed design yields more reusable traffic representations, stronger intrinsic behavior, and competitive or superior downstream performance across diverse networking tasks. Overall, the dissertation establishes credibility as the organizing principle for evaluating, collecting data for, and designing machine learning systems for networking.