Data-driven identification of features related to a state change of a network component

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform actions comprising:

• based at least in part on a state change at a networking component, obtaining data related to values of a plurality of features of the networking component, the data being within a primary window during which the state change occurred;
• evaluating the data using a delta-average based model, the delta-average based model evaluating the data within (i) a first window of the primary window, the first window including first data of the data prior to occurrence of the state change and (ii) a second window of the primary window, the second window including second data of the data after the occurrence of the state change;
• based at least in part on the evaluating the data with the delta-average based model, determining a change in mean values of the values for each feature of the plurality of features between the first window and the second window;
• based at least in part on the determining the change in mean values of the values for each feature of the plurality of features between the first window and the second window, determining a list of the plurality of features having largest changes in mean values between the first window and the second window, wherein the list represents most likely features contributing to the state change of the networking component;
• and
• providing the list to a user.

A computer-implemented method comprising:

• obtaining data related to values of a plurality of features of a router, the data being within a primary window during which a state change occurred, the state change relating to the router;
• evaluating the data with respect to one or more of a difference in mean values of the features, a difference in variance of values of the features, a spike in values of the features, or a distance to reference data, wherein the evaluating the data comprises
• evaluating the data using a delta-average based model, the delta-average based model evaluating the data within (i) a first window of the primary window, the first window including first data of the data prior to occurrence of the state change and (ii) a second window of the primary window, the second window including second data of the data after the occurrence of the state change;
• based at least in part on the evaluating the data with the delta-average based model, determining a change in mean values of the values for each feature of the plurality of features between the first window and the second window;
• based at least in part on the evaluating the data, determining a list of the plurality of features having at least largest changes in mean values, and one or more of largest variance of values of the features, largest spike in values of the features, or largest distance to reference data, wherein the list represents most likely features contributing to the state change of the router;
• and
• providing the list of the plurality of features to a user.