# US 12,015,517 B2 · Root cause analysis for operational issues using a rules mining algorithm > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,517 B2 - Document ID: US12015517B2 - Status: Granted - Kind: B2 - Application number: 18/339,117 - Filed: 2023-06-21 - Published: 2023-10-19 - Granted: 2024-06-18 - Earliest claimed: 2022-03-03 - Assignees: Arista Networks, Inc. - Applicants: Arista Networks, Inc. - Inventors: Karan Gupta; Rikith Reddy Bachu; Abhishek Singh - Web page: https://patentgrep.com/patent/US12015517B2 ## CPC - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - G06N 5/025: Extracting rules from data - H04L 41/142: using statistical or mathematical methods - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In general, embodiments relate to a method, for managing a network, that includes determining an occurrence of an operational issue on a network device of the network, based on the determining, executing an encoding phase and a causal feature identification phase on a feature database, wherein the feature database is associated with the operational issue, identifying a plurality of potential root causes using the encoding phase and the causal feature identification phase, and performing an action based on the plurality of potential root causes. ## Claims ### Claim 1 A method for managing a network, the method comprising: obtaining a standardized database, wherein the standardized database comprises standardized entries corresponding to an occurrence of an operational issue, each standardized entry is associated with a corresponding network device and comprises standard values for each feature of that standardized entry, and the standard value for a feature is generated by comparison of a raw value associated with that standardized entry for that feature to a condition associated with that feature; identifying a potential root cause for the operational issue on a network device based on the standardized database; and performing an action based on the identified potential root causes. ### Claim 2 (depends on 1) The method of claim 1, wherein each standardized entry comprises a symptomatic feature having a value assigned based on an occurrence of the operational issue in the network device corresponding to that standardized entry. ### Claim 3 (depends on 1) The method of claim 1, further comprising detecting the operational issue on the network device and identifying the potential root cause based on the detection of the operational issue. ### Claim 4 (depends on 1) The method of claim 1, wherein each of the features is a behavioral feature or a configuration feature. ### Claim 5 (depends on 1) The method of claim 1, wherein identifying a potential root cause on the network device comprises performing rule mining on the standardized database. ### Claim 6 (depends on 5) The method of claim 5, wherein the rule mining comprises association rule mining. ### Claim 7 A system, comprising: a processor; and a non-transitory computer readable medium, comprising instructions for: obtaining a standardized database, wherein the standardized database comprises standardized entries corresponding to an occurrence of an operational issue, each standardized entry is associated with a corresponding network device and comprises standard values for each feature of that standardized entry, and the standard value for a feature is generated by comparison of a raw value associated with that standardized entry for that feature to a condition associated with that feature; identifying a potential root cause for the operational issue on a network device based on the standardized database; and performing an action based on the identified potential root causes. ### Claim 8 (depends on 7) The system of claim 7, wherein each standardized entry comprises a symptomatic feature having a value assigned based on an occurrence of the operational issue in the network device corresponding to that standardized entry. ### Claim 9 (depends on 7) The system of claim 7, wherein the instructions are further for: detecting the operational issue on the network device and identifying the potential root cause based on the detection of the operational issue. ### Claim 10 (depends on 7) The system of claim 7, wherein each of the features is a behavioral feature or a configuration feature. ### Claim 11 (depends on 7) The system of claim 7, wherein identifying a potential root cause on the network device comprises performing rule mining on the standardized database. ### Claim 12 (depends on 11) The system of claim 11, wherein the rule mining comprises association rule mining. ### Claim 13 A non-transitory computer readable medium, comprising instructions for: obtaining a standardized database, wherein the standardized database comprises standardized entries corresponding to an occurrence of an operational issue, each standardized entry is associated with a corresponding network device and comprises standard values for each feature of that standardized entry, and the standard value for a feature is generated by comparison of a raw value associated with that standardized entry for that feature to a condition associated with that feature; identifying a potential root cause for the operational issue on a network device based on the standardized database; and performing an action based on the identified potential root causes. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein each standardized entry comprises a symptomatic feature having a value assigned based on an occurrence of the operational issue in the network device corresponding to that standardized entry. ### Claim 15 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the instructions are further for: detecting the operational issue on the network device and identifying the potential root cause based on the detection of the operational issue. ### Claim 16 (depends on 13) The non-transitory computer readable medium of claim 13, wherein each of the features is a behavioral feature or a configuration feature. ### Claim 17 (depends on 13) The non-transitory computer readable medium of claim 13, wherein identifying a potential root cause on the network device comprises performing rule mining on the standardized database. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, wherein the rule mining comprises association rule mining.