Using random forests to generate rules for causation analysis of network anomalies

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• receive one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space;
• apply learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous;
• identify, based on the labeled one or more sets of network characteristics, a plurality of anomaly patterns, each anomaly pattern including plurality of unidimensional cutoffs in the feature space;
• and
• initiate a change to the network based on the identified plurality of anomaly patterns,
• wherein the identifying of the plurality of anomaly patterns comprises:
• identifying, by the network assurance service, a first anomaly pattern including a first plurality of unidimensional cutoffs in the feature space;
• and
• identifying, by the network assurance service, one or more subsequent anomaly patterns, each of which including a subsequent plurality of unidimensional cutoffs in the feature space that satisfy the first plurality of unidimensional cutoffs of the first anomaly pattern, until a stopping criterion is met.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a network assurance service to execute a process comprising:

• receiving, at the network assurance service, a plurality of one or more sets of network characteristics of a network, each network characteristic forming a different feature dimension in a multi-dimensional feature space;
• applying, by the network assurance service, machine learning-based anomaly detection to the one or more sets of network characteristics, to label each set of network characteristics as anomalous or non-anomalous;
• identifying, by the network assurance service and based on the labeled one or more sets of network characteristics, a plurality of anomaly patterns, each anomaly pattern including a plurality of unidimensional cutoffs in the feature space;
• and
• initiating, by the network assurance service, a change to the network based on the identified plurality of anomaly patterns,
• wherein the identifying of the plurality of anomaly patterns comprises:
• identifying, by the network assurance service, a first anomaly pattern including a first plurality of unidimensional cutoffs in the feature space;
• and
• identifying, by the network assurance service, one or more subsequent anomaly patterns, each of which including a subsequent plurality of unidimensional cutoffs in the feature space that satisfy the first plurality of unidimensional cutoffs of the first anomaly pattern, until a stopping criterion is met.