Network Root Cause Analysis Using Anomaly Duration Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional root cause analysis systems for computer networks are inefficient in identifying anomalies in real-time due to their reliance on static models and excessive device-server communication, leading to delayed issue resolution and high computational complexity.
Innovation Solution
An apparatus and method that estimate the duration of anomalous events to generate adaptive root cause information, leveraging past event data and reducing the need for additional device communication, allowing for scalable and low-complexity analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static root cause models are used to identify root causes from the whole anomalous event, then comprehensive analysis is achieved, but the resolution time is delayed because the system must wait until the end of the anomalous event
Solution Approach 1:
The system transitions from static root cause models that analyze complete anomalous events to dynamic models that continuously update root cause identification as events unfold. The dynamic root cause model processes streaming telemetry data in real-time, allowing the system to identify and respond to anomalies during their progression rather than waiting for completion, thereby reducing resolution time while maintaining accuracy through continuous adaptation.
Solution Approach 2:
The system performs preliminary root cause analysis by evaluating available telemetry data at each timestamp before the anomalous event completes. This preliminary action enables early identification of potential root causes and triggers appropriate responses in advance, reducing the overall time to resolve anomalies while maintaining comprehensive analysis through subsequent updates as more data becomes available.
2Productivity
If the system communicates with devices at each timestamp to get regular updates, then real-time anomaly status is obtained, but incessant back-and-forth communication between devices and server occurs which is undesirable
Solution Approach 1:
The system extracts and processes only the most relevant dimensions from the streaming telemetry data (reducing from hundreds to tens of KPIs) rather than analyzing all available data at each timestamp. This extraction approach enables real-time root cause identification with minimal communication overhead, as the system focuses on critical anomaly-indicating metrics while ignoring redundant information.
Solution Approach 2:
Devices autonomously detect anomalies locally using embedded anomaly detection systems and generate anomalous events with extracted relevant KPIs. This self-service capability eliminates the need for the server to initiate continuous communication with devices, as devices proactively report only when anomalies are detected, significantly reducing communication overhead while maintaining real-time detection capability.
3Loss of time
If root cause is identified only from the start of the anomaly, then real-time response is enabled, but all anomalous events are considered only from the first instant perspective losing temporal evolution information
Solution Approach 1:
The system implements feedback mechanisms where root cause identification results are continuously updated as new telemetry data arrives during the anomalous event. The dynamic root cause model incorporates feedback from evolving event patterns, allowing the system to refine its root cause determination over time while maintaining real-time responsiveness. This feedback loop preserves temporal evolution information without delaying the initial response.
Solution Approach 2:
The system employs dynamic root cause models that adapt to the evolving temporal patterns of anomalous events. Rather than using fixed analysis from the start timestamp, the dynamic model continuously adjusts its assessment based on how the anomaly progresses, preserving temporal information while enabling real-time response through streaming data processing that updates conclusions as new information becomes available.
Data Source
AI summary
An apparatus for root cause analysis of anomalous events in a computer network is configured to receive event information related to the anomalous event from a set of devices in the computer network. Further, the apparatus is configured to estimate a total duration of the anomalous event based on the received event information. Then, the apparatus is configured to generate root cause information for the anomalous event based on the estimation of the total duration of the anomalous event.