Network Event Root-Cause Modeling Without Fixed Time Windows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing root-cause analysis systems for network events face computational complexity and accuracy issues due to the large number of event types, complex interactions, and varying occurrence frequencies, leading to inefficient identification of causal relationships.
Innovation Solution
A system and method that generate or update a root-cause network by comparing arrival time distributions of network events, considering factors like network topology and policy, to determine causal relationships without time-windowing, thereby reducing computational complexity and improving accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If correlation calculations are performed between all event types to determine root cause, then accuracy of causal relationship identification is improved, but computational complexity increases significantly
Solution Approach 1:
The patent segments the computational task by dividing event pairs into frequent and infrequent categories. Frequent event pairs are processed using efficient correlation calculations, while infrequent event pairs are handled separately using alternative methods such as arrival time distribution comparison. This segmentation reduces the overall computational complexity while maintaining accuracy for all event types.
Solution Approach 2:
The system performs self-service by automatically learning causal relationships from historical event data and building a root cause model without requiring manual configuration. The model adapts to the specific characteristics of the network events being monitored, performing its own optimization and adjustment based on observed patterns.
2Reliability
If traditional correlation methods are used for all event types, then comprehensive analysis is achieved, but processing time increases for less frequent events
Solution Approach 1:
The patent changes the analytical parameters used for different event types. For frequent events, traditional correlation coefficients are calculated. For infrequent events, the system uses arrival time distribution comparisons and other parameters that are more efficient to compute with limited data points. This parameter adaptation maintains comprehensive analysis while reducing processing time for rare events.
3Productivity
If time-windowing is applied to limit analysis scope, then computational efficiency is improved, but accuracy for events with large time differences deteriorates
Solution Approach 1:
The patent implements dynamic time-window adjustment based on the specific event types being analyzed. Rather than using a fixed time window, the system adapts the analysis scope according to the characteristics of each event pair, allowing it to capture causal relationships that occur over varying time scales while maintaining computational efficiency for each specific case.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Provided herein are systems and methods for determining relationships between events occurring in networks. Notifications describing events occurring in networks can be received and processed to determine groups of network event types. A root-cause network can be generated based on the events, with the nodes of the root-cause network representing different event types and the edges of the root-cause network indicating directional, causal relationships between the nodes. A received network event can be processed to determine potential causes of the received network event based on the root-cause network and other events received by the network.