Access point performance monitoring and anomaly detection based on temporal and spatial anomalies

A non-transitory computer-readable storage medium for use in conjunction with a computer, the computer-readable storage medium storing program instructions, wherein, when executed by the computer, the program instructions cause the computer to perform operations comprising:

• monitoring values of at least one performance metric associated with packet communication associated with access points in a network;
• comparing the values of at least the one performance metric for the access points in multiple temporal contexts with historical values of at least the one performance metric to determine one or more temporal anomalies for one or more of the access points, wherein a given temporal anomaly comprises a deviation that is statistically significant based at least in part on a moment of a distribution of at least the one performance metric and a threshold value;
• comparing the values of at least the one performance metric for the access points having a spatial context to determine one or more spatial anomalies for one or more of the access points, wherein a given spatial anomaly comprise a second deviation that is statistically significant based at least in part on a second moment of a second distribution associated with spatial locations of the access points and a second threshold value;
• generating one or more temporal anomaly events based at least in part on the one or more temporal anomalies;
• generating one or more spatial anomaly events based at least in part on the one or more spatial anomalies;
• calculating one or more complex events based at least in part on two or more of the one or more temporal anomalies and the one or more spatial anomalies;
• evaluating the one or more temporal anomaly events, the one or more spatial anomaly events, and the one or more complex events to determine one or more insights about a problem in the network;
• and
• performing a remedial action associated with the problem based at least in part on the one or more insights.

A method for performing a remedial action, comprising:

• monitoring, by a computer, values of at least one performance metric associated with packet communication associated with access points in a network;
• comparing, by the computer, the values of at least the one performance metric for the access points in multiple temporal contexts with historical values of at least the one performance metric to determine one or more temporal anomalies for one or more of the access points, wherein a given temporal anomaly comprises a deviation that is statistically significant based at least in part on a moment of a distribution of at least the one performance metric and a threshold value;
• comparing, by the computer, the values of at least the one performance metric for the access points having a spatial context to determine one or more spatial anomalies for one or more of the access points, wherein a given spatial anomaly comprise a second deviation that is statistically significant based at least in part on a second moment of a second distribution associated with spatial locations of the access points and a second threshold value;
• generating, by the computer, one or more temporal anomaly events based at least in part on the one or more temporal anomalies;
• generating, by the computer, one or more spatial anomaly events based at least in part on the one or more spatial anomalies;
• calculating, by the computer, one or more complex events based at least in part on two or more of the one or more temporal anomalies and the one or more spatial anomalies;
• evaluating, by the computer, the one or more temporal anomaly events, the one or more spatial anomaly events, and the one or more complex events to determine one or more insights about a problem in the network;
• and
• performing, by the computer, the remedial action associated with the problem based at least in part on the one or more insights.