Hypothesis driven diagnosis of network systems

A system comprising:

• a memory;
• and
• processing circuitry configured to:
• obtain data indicating resource dependencies between a plurality of resources in a network and event dependencies between a plurality of network events and one or more of the plurality of resources;
• generate a Bayesian model based on resource types of the plurality of resources and event types of the plurality of network events, each of the plurality of resources in the network representing an instance of one of the resource types;
• receive an indication of a fault in the network;
• collect fault data and generating, based on the Bayesian model and the fault data, a plurality of root cause hypotheses for the fault, wherein each root cause hypothesis of the plurality of root cause hypotheses is associated with a resource type of the resource types, and wherein each of the plurality of root cause hypotheses has an associated probability;
• determine, for a resource of the plurality of resources in the network, wherein the resource is an instance of a resource type associated with one of the root cause hypothesis of the plurality of root cause hypotheses, a probe associated with the resource type associated with the one of the root cause hypotheses, wherein a definition for the probe specifies one or more networking commands to be issued to at least one resource of the plurality of resources that result in receiving at least one value from the at least one resource, and wherein the probe further specifies one or more conditions for the at least one value that, when triggered by the probe, disprove the root cause hypothesis;
• execute the probe, including issuing the one or more networking commands to the at least one resource, and, in response to determining that the probe disproves the root cause hypothesis, removing the root cause hypothesis from the plurality of root cause hypotheses to form an updated plurality of root cause hypotheses;
• adjust the probabilities associated with the updated plurality of root cause hypotheses based on the probability of the root cause hypothesis that was removed;
• order the updated plurality of root cause hypotheses based on the adjusted probabilities associated with the updated plurality of root cause hypotheses to form an ordered plurality of root cause hypotheses;
• and
• output the ordered plurality of root cause hypotheses.

A non-transitory computer-readable storage medium having stored thereon instructions, that when executed, cause one or more processors to:

• obtain data indicating resource dependencies between a plurality of resources in a network and event dependencies between a plurality of network events and one or more of the plurality of resources;
• generate a Bayesian model based on resource types of the plurality of resources and event types of the plurality of network events, each of the plurality of resources in the network representing an instance of the one of the resource types;
• receive an indication of a fault in the network;
• collect fault data and generating, based on the Bayesian model and the fault data, a plurality of root cause hypotheses for the fault, wherein each root cause hypothesis of the plurality of root cause hypotheses is associated with a resource type of the resource types, and wherein each of the plurality of root cause hypotheses has an associated probability;
• determine, for a resource of the plurality of resources in the network, wherein the resource is an instance of a resource type associated with one of the root cause hypotheses of the plurality of root cause hypotheses, a probe associated with the resource type associated with the one of the root cause hypotheses, wherein a definition for the probe specifies one or more networking commands to be issued to at least one resource of the plurality of resources that result in receiving at least one value from the at least one resource, and wherein the probe further specifies one or more conditions for the at least one value that, when triggered by the probe, disprove the root cause hypothesis;
• execute the probe, including issuing the one or more networking commands to the at least one resource, and, in response to determining that the probe disproves the root cause hypothesis, removing the root cause hypothesis from the plurality of root cause hypotheses to form an updated plurality of root cause hypotheses;
• adjust the probabilities associated with the updated plurality of root cause hypotheses based on the probability of the root cause hypothesis that was removed;
• order the updated plurality of root cause hypotheses based on the adjusted probabilities associated with the updated plurality of root cause hypotheses to form an ordered plurality of root cause hypotheses;
• and
• output the ordered plurality of root cause hypotheses.