Network Root Cause Analysis via Change Event Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying the root cause of anomalous network behavior in complex data center environments is challenging due to the numerous network components and frequent change events, making it time-consuming for administrators to resolve issues.
Innovation Solution
A triaging system that monitors network components, assigns likelihood scores based on recent change events using a scoring policy, and ranks suspected root causes to quickly identify prime suspects, thereby reducing the time to issue resolution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If administrators manually analyze all network components and change events to identify root causes, then they can thoroughly investigate all possible causes, but the time required to resolve issues increases significantly
Solution Approach 1:
The patent introduces an intermediary system (root cause analysis system) that acts as a mediator between network monitoring data and administrators. This system automatically correlates change events with network anomalies, scores potential root causes, and presents prioritized results to administrators, thereby reducing manual analysis time while maintaining identification accuracy
Solution Approach 2:
The patent replaces the manual mechanical process of administrators reviewing all change events and network components with an automated computational system. The system uses algorithms to score and rank potential root causes based on correlations between change events and network anomalies, substituting human manual analysis with automated information processing
2Reliability
If the system monitors and analyzes all network components and change events, then comprehensive root cause identification is achieved, but the system complexity increases
Solution Approach 1:
The patent extracts and focuses only on the most relevant information for root cause identification by scoring change events based on their correlation with network anomalies. Instead of presenting all change events equally, the system extracts and prioritizes only those with high likelihood scores, reducing information overload while maintaining detection reliability
Solution Approach 2:
The patent applies different scoring criteria and weights to different types of change events and network components based on their specific characteristics and importance. Rather than using a uniform analysis approach, the system tailors its analysis to local conditions, assigning higher scores to more critical changes and adjusting correlation thresholds based on component importance
3Measurement precision
If administrators review all change events to identify root causes, then no potential cause is missed, but the ease of operation decreases
Solution Approach 1:
The patent implements partial action by presenting to administrators only the top-scoring potential root causes rather than requiring review of all change events. The system performs excessive analysis internally to score and rank all possibilities, then presents a filtered subset that achieves near-complete identification with reduced administrative burden
Data Source
AI summary
Determining suspected root causes of anomalous network behavior includes identifying anomalous components in a network exhibiting anomalous behavior from a plurality of network components, assigning a likelihood score to network components based on a scoring policy that considers recent change events affecting the anomalous components, and identifying a subset of the network components that are suspected to be root causes based on the likelihood score.