Random Forest Anomaly Detection for Network Causation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network assurance systems face challenges in effectively identifying and addressing network anomalies due to the complexity of large-scale distributed networks and the high dimensionality of network metrics, which hinders efficient causation analysis and proactive issue remediation.
Innovation Solution
A network assurance service employs machine learning-based anomaly detection using random forests to identify anomaly patterns as collections of unidimensional cutoffs in a multi-dimensional feature space, enabling the generation of rules for causation analysis and initiating changes to the network based on these patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning-based anomaly detection is applied to high-dimensional network metrics, then anomaly detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex high-dimensional anomaly detection problem into multiple unidimensional cutoff analyses. The random forest model divides the multi-dimensional feature space into separate dimensional slices, analyzing each dimension independently to identify cutoff thresholds. This segmentation reduces the complexity of analyzing the entire high-dimensional space at once while maintaining detection accuracy.
Solution Approach 2:
The patent introduces random forests as an intermediary computational tool between the raw high-dimensional network metrics and the anomaly detection results. The random forest model acts as a mediator that processes the complex multi-dimensional data through ensemble decision trees, transforming it into interpretable unidimensional cutoff rules that indicate anomaly thresholds for each feature dimension.
2Productivity
If random forests are used to generate causation rules, then causation analysis efficiency is improved, but computational resources increase
Solution Approach 1:
The patent performs preliminary action by pre-training the random forest model on historical network data to learn normal patterns and anomaly characteristics. This preliminary training phase captures the essential causation relationships and stores them in the form of unidimensional cutoff rules. When actual anomaly detection is needed, the system only needs to evaluate against these pre-computed rules rather than performing full computational analysis, significantly improving real-time causation analysis efficiency.
3Measurement precision
If multi-dimensional feature space analysis is performed, then anomaly detection accuracy is improved, but rule interpretability decreases
Solution Approach 1:
The patent applies dimensionality change by transforming the complex multi-dimensional anomaly detection results into a different representational dimension - unidimensional cutoff rules. Instead of presenting users with complex multi-dimensional decision boundaries that are hard to interpret, the system projects the anomaly conditions onto individual feature dimensions, creating simple threshold-based rules for each dimension. This maintains the accuracy benefits of multi-dimensional analysis while improving interpretability through dimensional transformation.
Data Source
AI summary
In one embodiment, a network assurance service receives one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space. The network assurance service applies machine learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous. The network assurance service identifies, based on the labeled one or more sets of network characteristics, an anomaly pattern as a collection of unidimensional cutoffs in the feature space. The network assurance service initiates a change to the network based on the identified anomaly pattern.