Network Event Detection for Near-Real-Time Root Cause Identification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network monitoring relies heavily on manual analysis, which is time-consuming, resource-intensive, and requires specialized expertise, often leading to delayed response times and increased operational costs due to missed or misdiagnosed issues, especially with user-configured tests providing arbitrary or suboptimal coverage and the presence of noise.

Innovation Solution

A system that automatically detects network events and identifies the root cause in near-real-time using user-defined tests through a multi-step approach of processing, filtering, and grouping test outcomes, enabling cross-layer, cross-test, and cross-account root-cause analysis, independent of user-configured alerts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If manual analysis of test results is used to pinpoint root causes, then specialized expertise can be applied to diagnose issues, but the process becomes time-consuming and resource-intensive

Engineering Contradiction:

Improvediagnosis accuracyVSAvoidresponse time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs self-diagnosis by automatically analyzing test results and identifying root causes without requiring manual expert intervention. The automated root cause analysis engine processes test outcomes, correlates failures across multiple tests, and determines probable root causes, enabling the system to serve itself in the diagnostic process while maintaining high accuracy.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the mechanical process of manual expert analysis with an automated computational system. The root cause analysis engine uses algorithmic processing to correlate test failures, analyze patterns, and identify root causes, substituting human expert mechanics with automated computational mechanics that operate faster and without fatigue.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Adaptability or versatility

If user-configured tests are used for network monitoring, then specific user needs can be addressed, but coverage becomes arbitrary or suboptimal leading to missed issues

Engineering Contradiction:

Improveuser configuration flexibilityVSAvoiddetection accuracy

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system dynamically adjusts test configuration based on observed failures and correlations. When test failures occur, the root cause analysis engine automatically determines which additional tests should be run to gather more diagnostic information, making the monitoring system adaptive and self-optimizing rather than static and arbitrarily configured.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system implements feedback loops where test results are continuously analyzed and used to inform subsequent testing decisions. The root cause analysis engine uses outcomes from initial tests to determine what additional tests are needed, creating a closed-loop system that learns from results and improves coverage dynamically, ensuring reliable detection without requiring perfect upfront configuration.

Inventive Principle:

Principle #23Feedback

3Measurement precision

If extensive manual analysis is performed to distinguish meaningful data from noise, then accurate diagnosis can be achieved, but operational costs increase

Engineering Contradiction:

Improvesignal detection accuracyVSAvoidoperational cost

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The system applies partial action by selectively analyzing only the most relevant test failures and correlations rather than performing exhaustive manual analysis of all data. The root cause analysis engine identifies and focuses on the subset of test outcomes that are most likely to contain meaningful diagnostic information, avoiding waste of resources on obvious noise while maintaining detection accuracy.

Inventive Principle:

Principle #16Partial or excessive action

4Ease of operation

If user-configured tests with arbitrary intervals are used, then user preferences are respected, but baselines fail to yield usable data for anomaly detection

Engineering Contradiction:

Improveuser controlVSAvoidbaseline quality

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The system dynamically determines appropriate test intervals and baseline parameters based on the specific network conditions and failure patterns observed. Rather than relying on fixed user-configured intervals that may be arbitrary, the system adapts the monitoring rhythm to match actual network behavior, ensuring baselines are of sufficient quality for anomaly detection while still respecting user-defined test configurations.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS20260046234A1Event detection and problem domain identification using user-configured network measurements

Publication Date: 2026.02.12 CISCO TECHNOLOGY INC

AI summary

In one implementation, a device obtains test results from a plurality of performance monitoring tests performed in a computer network. The device identifies a set of components of the computer network as potential causes of the test results. The device determines that a particular component from among the set of components caused the test results based on its health metrics. The device raises an alert indicative of the particular component having caused the test results.