Systems and methods for causation analysis of network traffic anomalies and security threats

A system, comprising:

• one or more processors;
• and
• a non-transitory computer-readable storage medium containing instructions which, when executed on the one or more processors, cause the one or more processors to perform operations including:
• detecting an alarm condition at a network device, the alarm condition comprising an anomaly or increase in a traffic condition in a network;
• identifying a first dominant key from a first set of keys associated with a first traffic flow and having a first key type and a second dominant key from a second set of keys associated with a second traffic flow and having a second key type, wherein the first set of keys associated with the first traffic flow comprises one or more of a first Internet Protocol (IP) address field, a first source IP address field, a first destination port number field, a first source port number, a first application identifier, a first interface, and a first protocol field and the second set of keys associated with the second traffic flow comprises one or more of a second IP address field, a second source IP address field, a second destination port number field, a second source port number field, a second application identifier, a second interface and a second protocol field, wherein the first dominant key and the second dominant key are different key types and both contributed to the alarm condition, and wherein the first dominant key and the second dominant key each have relative higher contributions to the alarm condition that at least one other dominant key having a relative lower contribution;
• excluding the at least one other dominant key having the relative lower contribution from an aggregation of dominant keys to determine a combination of dominant keys;
• aggregating the first dominant key and the second dominant key to determine the combination of dominant keys which contributed to the alarm condition;
• and
• identifying a dominant traffic flow comprising the combination of dominant keys which contributed to the alarm condition, and traffic flows which have predominantly contributed to the alarm condition.

A non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to perform operations comprising:

• detecting an alarm condition at a network device, the alarm condition comprising an anomaly or increase in a traffic condition in a network;
• identifying a first dominant key from a first set of keys associated with a first traffic flow and having a first key type and a second dominant key from a second set of keys associated with a second traffic flow and having a second key type, wherein the first set of keys associated with the first traffic flow comprises one or more of a first Internet Protocol (IP) address field, a first source IP address field, a first destination port number field, a first source port number, a first application identifier, a first interface, and a first protocol field and the second set of keys associated with the second traffic flow comprises one or more of a second IP address field, a second source IP address field, a second destination port number field, a second source port number field, a second application identifier, a second interface and a second protocol field, wherein the first dominant key and the second dominant key are different key types and both contributed to the alarm condition, and wherein the first dominant key and the second dominant key each have relative higher contributions to the alarm condition that at least one other dominant key having a relative lower contribution;
• excluding the at least one other dominant key having the relative lower contribution from an aggregation of dominant keys to determine a combination of dominant keys;
• aggregating the first dominant key and the second dominant key to determine the combination of dominant keys which contributed to the alarm condition;
• and
• identifying a dominant traffic flow comprising the combination of dominant keys which contributed to the alarm condition and traffic flows which have predominantly contributed to the alarm condition.