Multi KPI correlation in wireless protocols

• US 10,306,490 B2
• Filed: 01/20/2016
• Issued: 05/28/2019
• Est. Priority Date: 01/20/2016
• Status: Active Grant

• Current Assignee: NetScout Systems Texas, LLC (NetScout Systems Incorporated)
• Original Assignee: NetScout Systems Texas, LLC (NetScout Systems Incorporated)
• Inventors: Ratakonda, Balaji, Curtin, John P., Janakiraman, Vignesh
• Primary Examiner(s): Levitan, Dmitry
• Application Number:
  US15/001,987
• Publication Number:
  US 20170208487A1
• Time in Patent Office: 1,224 Days
• Field of Search: 370241, 370245, 370250, 370310, 370349
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/55 Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04W 24/04 Arrangements for maintaining operational condition

Abstract

A network monitoring system is provided that includes a processor, a memory coupled to the processor and a database that includes key performance indicator (KPI) records for monitoring a wireless communication system. The network monitoring system further includes a rules engine configured and operable to store in the memory KPI rules associated with at least one rule set. The network monitoring system also includes an analysis engine configured and operable to identify a list of root causes identifying failure events based on the at least one KPI rule in the at least one rule set.

Claims

1. A network monitoring system, the system comprising:

a processor;

a memory coupled to the processor;

a database including a plurality of key performance indicator (KPI) records for monitoring a wireless communication system, wherein the plurality of KPI records corresponds to a plurality of different protocols;

a rules engine configured and operable to store in the memory KPI rules associated with at least one rule set; and

an analysis engine configured and operable to;

identify, using the processor, one or more root causes of a failure for one or more of the transactions based on at least one KPI rule in the at least one rule set, wherein the at least one KPI rule correlates at least two of the plurality of KPI records across the plurality of different protocols and multiple interfaces;

generate a threshold excess score for each of the at least two of the plurality of KPI records, the threshold excess score indicating a number of detected failures exceeding a predefined threshold;

assign each generated threshold excess score a corresponding weight value to determine a weighted threshold excess score;

generate a KPI score for each of the one or more identified root causes based on a sum of all weighted threshold excess scores associated with the at least two of the plurality of KPI records; and

generate a probability score value for each root cause of the one or more identified root causes based on the generated KPI scores, the probability score comprising a ratio of the KPI score corresponding to the root cause to sum of all KPI scores of all of the one or more identified root causes.

2. The system as recited in claim 1, wherein the analysis engine is further configured and operable to prioritize the identified one or more root causes based on the generated probability score values.

3. The system as recited in claim 1, wherein the rules engine generates the at least one rule set using a natural language-like syntax and format.

4. The system as recited in claim 1, wherein the database is further configured and operable to export one or more of the plurality of KPI records to a data file in a predefined format based on a time period associated with the failure and/or based on one or more network elements of the wireless communication system associated with the failure.

5. The system as recited in claim 4, wherein the predefined format comprises at least one of:

a Comma Separated Values (CSV) format, eXtensible Markup Language (XML) format, binary file format and flat file format.

6. A method for automatically identifying a root cause of a failure in a wireless communication system, the method comprising:

generating rules associated with a plurality of key performance indicator (KPI) records for monitoring a wireless communication system, wherein the plurality of KPI records corresponds to a plurality of different protocols;

identifying, by a processor, one or more failures in the wireless communication system;

identifying, by a processor, one or more likely root causes associated with the identified one or more failures by correlating at least some of the plurality of KPI records across multiple interfaces and across the plurality of different protocols based on the generated rules;

generating a threshold excess score for each of the at least two of the plurality of KPI records, the threshold excess score indicating a number of detected failures exceeding a predefined threshold;

assigning each generated threshold excess score a corresponding weight value to determine a weighted threshold excess score;

generating a KPI score for each of the one or more identified root causes based on a sum of all weighted threshold excess scores associated with the at least two of the plurality of KPI records; and

generating a probability score value for each root cause of the one or more identified root causes based on the generated KPI score, the probability score comprising a ratio of the KPI score corresponding to the root cause to sum of all KPI scores of all of the one or more identified root causes.

7. The method as recited in claim 6, further comprising prioritizing the identified one or more root causes based on the generated probability score values.

8. The method as recited in claim 6, wherein generating rules comprises generating at least one rule set using a natural language-like syntax and format.

9. The method as recited in claim 6, further comprising exporting one or more of the plurality of KPI records to a data file in a predefined format a based on a time period associated with the failure and/or based on one or more network elements of the wireless communication system associated with the failure.

10. The method as recited in claim 9, wherein the predefined format comprises at least one of a Comma Separated Values (CSV) format, eXtensible Markup Language (XML) format, binary file format and flat file format.

11. A computer program product for automatically identifying a root cause of a failure in a wireless communication system, the computer program product comprising:

one or more non-transitory computer-readable storage devices and a plurality of program instructions stored on at least one of the one or more computer-readable storage devices, the plurality of program instructions comprising;

program instructions to generate rules associated with a plurality of key performance indicator (KPI) records for monitoring a wireless communication system, wherein the plurality of KPI records corresponds to a plurality of different protocols;

program instructions to identify one or more failures in the wireless communication system;

program instructions to identify one or more likely root causes associated with the identified one or more failures by correlating at least some of the plurality of KPI records across multiple interfaces and across the plurality of different protocols based on the generated rules;

program instructions to generate a threshold excess score for each of the at least two of the plurality of KPI records, the threshold excess score indicating a number of detected failures exceeding a predefined threshold;

program instructions to assign each generated threshold excess score a corresponding weight value to determine a weighted threshold excess score;

program instructions to generate a KPI score for each of the one or more identified root causes based on a sum of all weighted threshold excess scores associated with the at least two of the plurality of KPI records; and

program instructions to generate a probability score value for each root cause of the one or more identified root causes based on the generated KPI score, the probability score comprising a ratio of the KPI score corresponding to the root cause to sum of all KPI scores of all of the one or more identified root causes.