System and method for network root cause analysis

• US 10,594,542 B2
• Filed: 10/27/2017
• Issued: 03/17/2020
• Est. Priority Date: 10/27/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Jeyakumar, Vimal, Parandehgheibi, Ali, Sloane, Andy, Kulshreshtha, Ashutosh, Yadav, Navindra, Madani, Omid
• Primary Examiner(s): Gillis, Brian J.
• Assistant Examiner(s): Ling, Chhian (Amy)
• Application Number:
  US15/796,687
• Publication Number:
  US 20190132190A1
• Time in Patent Office: 872 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

Disclosed herein is a multi-level analysis for determining a root cause of a network problem by performing a first level of the multi-level process that includes collecting data from one or more network components, generating a set of system metrics where each system metric of the set representing a portion of the data, ranking the set of system metrics based on a level of correlation of each system metric to the network problem to yield a ranked set of system metrics, and providing a visual representation of the first level of the multi-level process. A second level of the multi-level process includes receiving an input identifying one or more of the ranked set of system metrics to be excluded from analysis and performing a conditional analysis using only ones of the set of system metrics that are not identified for exclusion.

Claims

1. A method comprising:

receiving an inquiry to determine a root cause of a network problem; and

performing a multi-level process to determine the root cause, wherein

a first level of the multi-level process includes,

collecting data from one or more network components;

generating a set of system metrics, each system metric of the set representing a portion of the data, at least one system metric of the set being a target metric corresponding to the network problem;

ranking the set of system metrics based on a level of correlation of each system metric to the network problem to yield a ranked set of system metrics; and

providing a visual representation of the network problem and each of the ranked set of system metrics; and

a second level of the multi-level process includes,

receiving an input identifying one or more of the highest ranked system metrics of the set of system metrics to be excluded from analysis; and

performing a conditional analysis for determining the root cause of the network problem using only ones of the set of system metrics that are not identified for exclusion.

2. The method of claim 1, wherein ranking the set of system metrics is performed by using a machine learning model in conjunction with a cross validation or regression technique to determine a correlation level of each one of the set of system metrics to the target metric.

3. The method of claim 1, wherein the generating the set of system metrics includes

grouping the data into one or more sets;

analyzing the one or more sets to identify one or more common characteristics between two or more of the sets; and

combining the two or more sets into a single system metric of the set of system metrics.

4. The method of claim 3, further comprising:

tagging each system metric of the set, the tag being an identifier of underlying data being represented in each system metric.

5. The method of claim 1, wherein each system metric of the set is a time series representation of corresponding data in the same set.

6. The method of claim 1, further comprising:

presenting a result of the conditional analysis on a display, the result identifying the root cause.

7. The method of claim 1, wherein the data in each of the set of system metrics include one or more of a network equipment latency, one or more CPU usages, one or more disk usages, processes running on one or more servers in the network, network traffic and application specific data.

8. A system comprising:

memory configured to store computer-readable instructions therein; and

one or more processors configured to execute the computer-readable instructions to perform functions of;

receiving an inquiry to determine a root cause of a network problem; and

performing a multi-level process to determine the root cause, wherein

a first level of the multi-level process includes,

collecting data from one or more network components;

generating a set of system metrics, each system metric of the set representing a portion of the data, at least one system metric of the set being a target metric corresponding to the network problem;

ranking the set of system metrics based on a level of correlation of each system metric to the network problem to yield a ranked set of system metrics; and

providing a visual representation of the network problem and each of the ranked set of system metrics; and

a second level of the multi-level process includes,

receiving an input from identifying one or more of the highest ranked system metrics of the set of system metrics to be excluded from analysis; and

performing a conditional analysis for determining the root cause of the network problem using only ones of the set of system metrics that are not identified for exclusion.

9. The system of claim 8, wherein the system is a network analytics platform.

10. The system of claim 8, wherein the one or more processors are configured to execute the computer-readable instructions to further perform the functions of:

presenting a result of the conditional analysis;

receiving a further feedback identifying one of the set of metrics as the root cause of the network problem from among ones of the set of system metrics presented as part of the result of the conditional analysis; and

presenting a recommendation for addressing the network problem.

11. The system of claim 8, wherein the one or more processors are configured to execute the computer-readable instructions to perform the function of generating the set of system metrics by:

grouping the data into one or more sets;

analyzing the one or more sets to identify one or more common characteristics between two or more of the sets; and

combining the two or more sets into a single system metric of the set of system metrics.

12. The system of claim 11, wherein the one or more processors are configured to execute the computer-readable instructions to further perform the function of:

tagging each system metric of the set, the tag being an identifier of underlying data being represented in each system metric.

13. The system of claim 8, wherein each system metric of the set is a time series representation of corresponding data in the same set.

14. The system of claim 8, wherein the data in each of the set of system metrics include one or more of a network equipment latency, one or more CPU usages, one or more disk usages, processes running on one or more servers in the network, network traffic and application specific data.

15. One or more non-transitory computer-readable medium having computer-readable instructions stored therein, which when executed by one or more processors configure the one or more processors to perform functions of:

receiving an inquiry to determine a root cause of a network problem;

perform a multi-level process in order to;

present a ranked list of a set of system metrics that are correlated to the network problem, the ranked list being presented in accordance with a level of corresponding relevance to the network problem;

receive an input identifying one or more of the highest ranked system metrics of the ranked list of system metrics to be excluded from further analysis of the root cause of the network problem;

perform a conditional analysis of the network problem using only ones of the ranked list of the set of system metrics not identified for exclusion in the input; and

present a result of the conditional analysis.

16. The one or more non-transitory computer-readable medium of claim 15, wherein the multi-level process includes:

receive further input after presenting the result of the conditional analysis indicating one or more additional system metrics to be excluded from the analysis of the network problem; and

repeat the conditional analysis based on the further input; and

present the result of the conditional analysis performed based on the further input.

17. The one or more non-transitory computer-readable medium of claim 15, wherein the step of presenting the ranked list of system metrics includes:

collecting data from one or more network components;

generating the set of system metrics, each system metric of the set representing a portion of the data, at least one system metric of the set being a target metric corresponding to the network problem; and

ranking the set of system metrics based on a level of correlation of each system metric to the network problem to yield a ranked set of system metrics.

18. The one or more non-transitory computer-readable medium of claim 17, wherein the step of generating the set of system metrics includes:

grouping the data into one or more sets;

analyzing the one or more sets to identify one or more common characteristics between two or more of the sets;

combining the two or more sets into a single system metric of the set of system metrics; and

tagging each system metric of the set, the tag being an identifier of underlying data being represented in each system metric.

19. The one or more non-transitory computer-readable medium of claim 15, wherein data in each of the set of system metrics include one or more of a network equipment latency, one or more CPU usages, one or more disk usages, processes running on one or more servers in the network, network traffic and application specific data.

20. The one or more non-transitory computer-readable medium of claim 15, wherein each of the set of system metrics is presented as a time-series representation of the corresponding system metric.