Network Operating System Grey-Failure Detection Using Correlated Metrics

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods are inadequate for detecting grey failures in computer networks, which are difficult to identify and remediate, often leading to undetected traffic loss and critical debugging data loss due to their multi-dimensional nature and the challenge of correlating unidimensional metrics over time.

Innovation Solution

A system and method involving data collection, metric analysis, and machine learning (ML) model-based correlation to detect grey failures by analyzing metrics and patterns, using a workflow that includes event matching, trend analysis, and threshold classification to identify and correct these failures.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional monitoring methods are used to detect network failures, then simple failures can be identified, but grey failures with multi-dimensional characteristics remain undetected

Engineering Contradiction:
Improvefailure detection capabilityVSAvoiddetection of grey failures
Core Design Contradiction:
ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent transitions from monitoring single unidimensional metrics to analyzing multi-dimensional metrics by introducing a second dimension of analysis. The system collects multiple metrics (packet drops, packet captures, CPU usage, memory usage) and analyzes their temporal patterns and correlations, transforming the detection approach from one-dimensional to multi-dimensional to capture grey failures that exhibit complex, correlated behavior across multiple parameters.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

Solution Approach 2:

The patent implements preliminary action by establishing baseline patterns and thresholds for network metrics before failures occur. The system continuously monitors metric patterns, identifies deviations from normal behavior, and triggers correlation analysis before complete failure manifests, enabling proactive detection of grey failures in their early stages.

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If multiple unidimensional metrics are collected to capture grey failures, then detection coverage improves, but the complexity of correlating these metrics increases

Engineering Contradiction:
Improvefailure detection accuracyVSAvoidmetric correlation complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent applies segmentation by dividing the complex correlation task into manageable segments. The system processes metrics in temporal segments (sliding time windows) and groups related metrics together for analysis. This segmentation allows the system to handle multiple unidimensional metrics systematically by analyzing them in discrete time intervals and correlating them within structured groups, reducing the overall complexity of multi-dimensional correlation.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements feedback mechanisms that continuously monitor metric patterns and adjust detection thresholds and correlation criteria based on observed behavior. The system learns from historical data to refine its correlation models, automatically adapting to changing network conditions and reducing the manual complexity of metric correlation through data-driven feedback loops.

Inventive Principle:
Principle #23Feedback

Data Source

PatentUS20250323848A1Grey failure detection on network operating system
Publication Date: 2025.10.16 CISCO TECHNOLOGY INC
  • US20250323848A1 patent drawing
  • US20250323848A1 patent drawing
  • US20250323848A1 patent drawing

AI summary

Systems, methods, and computer-readable media are provided for detecting grey failures on a network. An example method can include receiving, by a network controller, event data for a network node, generating, by the network controller, a first metric and a second metric based on the event data, determining, by the network controller, a first pattern of growth of the first metric and a second pattern of growth of the second metric over a sliding window, determining, by the network controller, a correlation across the first metric and the second metric based on the first pattern and the second pattern, and determining, by the network controller, a grey failure of the network node based on the correlation.