Root-cause analysis of event occurrences
AssigneeExtreme Networks, Inc.
InventorsDonagh Horgan, Abdul Razak, Giacomo Bernardi
Life of this patent
Estimating the term…
Abstract
Provided herein are systems and methods for determining relationships between events occurring in networks. Notifications describing events occurring in networks can be received and processed to determine groups of network event types. A root-cause network can be generated based on the events, with the nodes of the root-cause network representing different event types and the edges of the root-cause network indicating directional, causal relationships between the nodes. A received network event can be processed to determine potential causes of the received network event based on the root-cause network and other events received by the network.
Claims20
A method, comprising:
- receiving a first network event and a second network event occurring in a root-cause network;
- determining a first network event type for the first network event and a second network event type for the second network event;
- determining an arrival time distribution based on a time difference between an occurrence of the first network event and an occurrence of the second network event, wherein the first network event occurs before the second network event;
- comparing the arrival time distribution to a reference distribution to determine a relationship between the first network event type and the second network event type;
- and
- updating a relationship probability for an edge in the root-cause network based on the relationship, wherein the edge connects a first node in the root-cause network representing the first network event type to a second node in the root-cause network representing the second network event type.
A system, comprising:
- one or more processors;
- and
- memory communicatively coupled to the one or more processors, wherein the memory stores instructions configured to, when executed, cause the one or more processors to:
- receive a first network event and a second network event occurring in a root-cause network;
- determine a first network event type for the first network event and a second network event type for the second network event;
- determine an arrival time distribution based on a time difference between an occurrence of the first network event and an occurrence of the second network event, wherein the first network event occurs before the second network event;
- compare the arrival time distribution to a reference distribution to determine a relationship between the first network event type and the second network event type;
- and
- update a relationship probability for an edge in the root-cause network based on the relationship, wherein the edge connects a first node in the root-cause network representing the first network event type to a second node in the root-cause network representing the second network event type.
A non-transitory computer readable storage medium having computer readable code thereon, the non-transitory computer readable storage medium including instructions configured to cause a computer system to perform operations, comprising:
- receiving a first network event and a second network event occurring in a root-cause network;
- determining a first network event type for the first network event and a second network event type for the second network event;
- determining an arrival time distribution based on a time difference between an occurrence of the first network event and an occurrence of the second network event, wherein the first network event occurs before the second network event;
- comparing the arrival time distribution to a reference distribution to determine a relationship between the first network event type and the second network event type;
- and
- updating a relationship probability for an edge in the root-cause network based on the relationship, wherein the edge connects a first node in the root-cause network representing the first network event type to a second node in the root-cause network representing the second network event type.
Dependencies are inferred from the claim text.