Network Assurance Service Root Cause Analysis via Cross-Signal Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network assurance systems face challenges in efficiently identifying the root cause of anomalies in complex computer networks due to the high dimensionality of data and the need for real-time adaptation, as traditional methods often rely on predefined rules and lack effective cross-signal correlation analysis.
Innovation Solution
A network assurance service that associates target key performance indicators (tKPIs) with causation key performance indicators (cKPIs) using machine learning-based anomaly detection, calculating cross-correlation scores across multiple time windows to select the root cause of anomalies, incorporating a spike detector and adaptive threshold mechanisms for improved accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional predefined rules are used for anomaly detection, then the system is simple to implement, but it cannot effectively identify root causes in high-dimensional network data
Solution Approach 1:
The patent replaces traditional rule-based mechanical systems with machine learning models that automatically learn patterns from network data. The anomaly detector uses unsupervised learning to identify anomalies without predefined rules, and the root cause analyzer uses supervised learning to predict root causes from historical data, significantly improving accuracy while managing complexity through automated model training.
Solution Approach 2:
The patent transforms the approach by changing from fixed rule parameters to dynamic learned parameters. The system learns optimal detection thresholds and correlation weights from data, allowing the parameters to adapt to different network conditions and anomaly types, thereby improving measurement precision without requiring manual tuning of complex rules.
2Measurement precision
If cross-signal correlation analysis is performed across multiple time windows, then the accuracy of root cause identification is improved, but the computational time and complexity increase
Solution Approach 1:
The patent performs preliminary actions by pre-calculating and storing statistical features (mean, standard deviation) of KPIs across different time windows. This allows the cross-correlation analysis to use pre-processed data rather than computing from raw data, significantly reducing the computational time required for real-time root cause identification while maintaining accurate multi-time-window analysis.
3Adaptability or versatility
If multiple causation KPIs are monitored simultaneously, then the coverage of potential root causes is improved, but the difficulty of identifying the actual root cause increases
Solution Approach 1:
The patent implements feedback mechanisms where the anomaly detector continuously monitors KPIs and provides feedback to the root cause analyzer. The system uses cross-correlation scores as feedback to rank potential root causes, and the supervised learning model refines its predictions based on historical feedback, enabling the system to handle multiple cKPIs effectively by prioritizing the most likely candidates.
Data Source
AI summary
In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.