Root Cause Detection via Network Causal Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional root cause analysis in large networks is inefficient and prone to false alarms, as it often relies on detecting the first or last error event, which may not be severe or temporary, and is difficult to trace code paths to understand failures effectively.
Innovation Solution
A system that correlates alerts across the network based on causal relationships and metadata, using machine learning to identify the probable root cause of anomalous events and generate incident tickets for the responsible entities, while avoiding false positives by recognizing non-causal relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional root cause analysis is performed by detecting the first or last error event, then the analysis process is simple, but the precision and reliability of root cause identification deteriorates
Solution Approach 1:
The patent segments the network into multiple hierarchical levels (core network, access network, end devices) and analyzes errors at each level separately. This segmentation allows the system to identify root causes more precisely by examining dependencies between levels rather than treating the network as a monolithic system, thus resolving the contradiction between simple analysis and precise identification.
Solution Approach 2:
The patent introduces an intermediary analysis mechanism that correlates errors across different network levels and identifies causal relationships. This intermediary layer processes the complexity of multi-level dependencies and presents simplified root cause information, enabling both easy operation and high precision in root cause identification.
2Device complexity
If traditional error detection methods are used, then the system complexity is low, but the time required to trace code paths and understand failures increases
Solution Approach 1:
The patent performs preliminary actions by pre-establishing dependency relationships between network components at different levels. This preliminary mapping of dependencies allows the system to quickly trace failure paths during actual error detection without performing complex real-time analysis, thus reducing time loss while maintaining manageable system complexity.
Solution Approach 2:
The patent replaces manual code path tracing with automated correlation algorithms that process error information across network levels. This substitution of mechanical manual tracing with automated computational methods significantly reduces the time required to understand failures while keeping the overall system complexity manageable through structured algorithms.
3Ease of operation
If alerts are correlated based on temporal proximity only, then the correlation process is simple, but false alarms increase due to non-causal relationships
Solution Approach 1:
The patent changes the correlation parameters from temporal proximity alone to a multi-parameter approach including temporal relationships, dependency relationships between network components, and causal analysis. This parameter transformation enables the system to distinguish between correlated and causally related events, reducing false alarms while maintaining operational simplicity through automated multi-parameter evaluation.
Data Source
AI summary
This disclosure describes systems, devices, and techniques for determining a root cause of anomalous events in a networked computing environment. A node detects an alert corresponding to an anomalous event during a time period. The alert is correlated with previously detected alerts occurring within the time period and a causal relationship associated with nodes in the networked computing environment. The node may then recursively identify a root cause of the anomalous event detected in the networked computing environment based on a set of correlated alerts. An incident ticket may then be sent to the node identified as the root cause of the anomalous event, and the node may notify other nodes in the network having a causal relationship with the node of the anomalous event.