Probabilistic Root Cause Correlation in Network Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large-scale network monitoring systems face challenges in real-time root cause correlation due to complexity, noisy data, and the need to process vast amounts of inter-dependent network entity data, with existing solutions failing to accurately determine root causes amidst uncertainty and noise.
Innovation Solution
A system and method for real-time probabilistic root cause correlation using a real-time topology collector, causality modeler, event collector, and correlator, which generates a cross-layer network topology, applies domain knowledge to derive event models, and employs Bayesian inference to identify likely root causes despite noisy or missing data, scalable through distributed architecture and parallel processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time root cause correlation is performed in large-scale networks, then network reliability and decision-making quality improve, but system complexity and computational burden increase significantly
Solution Approach 1:
The patent segments the large-scale network into multiple sub-networks or regions, and performs root cause correlation separately in each segment. This division reduces the computational complexity by avoiding global analysis of the entire network at once, while still achieving accurate local root cause identification that contributes to overall network reliability.
Solution Approach 2:
The patent pre-computes and stores network topology information, component relationships, and historical failure data before actual root cause correlation is needed. This preliminary preparation creates reusable knowledge bases and pre-established analytical frameworks that speed up real-time root cause identification without requiring complex computations during actual failure events.
2Measurement precision
If comprehensive network entity data is collected for root cause analysis, then analysis accuracy improves, but data processing time and computational resources increase
Solution Approach 1:
The patent extracts and focuses only on the most relevant data elements and relationships needed for root cause correlation, rather than processing all available network data. By identifying and extracting key topological relationships, component dependencies, and critical failure indicators, the system achieves accurate root cause analysis with reduced data processing requirements and faster execution time.
Solution Approach 2:
The patent implements a multi-level analysis approach where initial root cause identification uses a subset of critical data for rapid results, and only performs more comprehensive data analysis when needed for complex or ambiguous failure scenarios. This partial action strategy provides timely root cause information for most cases while maintaining the option for deeper analysis when necessary.
3Productivity
If real-time correlation is performed across millions of network entities, then root cause identification speed improves, but computational complexity and resource requirements worsen
Solution Approach 1:
The patent divides the network entity space into manageable segments or clusters based on topological relationships and functional groupings. Root cause correlation is performed independently within each segment using localized computational resources, enabling parallel processing that speeds up overall root cause identification while avoiding the computational burden of analyzing all millions of entities simultaneously in a single complex computation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various aspects of the subject technology related to systems and methods for performing real-time probabilistic root cause correlation. A system may be configured to receive network topology data from a plurality of external sources and generate a cross-layer network topology. The system may generate an event model based on the cross-layer network topology. The event model models the causal relationship between root causes and one or more observed failure events that are associated with one or more network entities. The system may receive a plurality of network event data for one or more network entities identified in the cross-layer network topology. The system may infer, using a trained Bayesian network, a root cause of at least one failure event indicated in the plurality of network event data based on the plurality of network event data and the generated event model. The system output the inferred root cause correlated to the failure event indicated in the plurality of network event data.