# US 12,015,518 B2 · Network-based mining approach to root cause impactful timeseries motifs > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,518 B2 - Document ID: US12015518B2 - Status: Granted - Kind: B2 - Application number: 17/979,341 - Filed: 2022-11-02 - Published: 2024-05-02 - Granted: 2024-06-18 - Earliest claimed: 2022-11-02 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Sambarta Dasgupta; Grégory Mermoud; Jean-Philippe Vasseur; Mukund Yelahanka Raghuprasad - Web page: https://patentgrep.com/patent/US12015518B2 ## CPC - H04L 41/064: {involving time analysis} - H04L 41/0677: Localisation of faults - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/067: using time frame reporting - H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a device identifies a timeseries motif present in a plurality of timeseries of performance metrics for a plurality of paths in a network. The device retrieves, based on the timeseries motif, device-level telemetry data from networking devices along the plurality of paths. The device determines a root cause of the timeseries motif by correlating the timeseries motif with the device-level telemetry data. The device provides an indication of the timeseries motif and its root cause for display by a user interface. ## Claims ### Claim 1 A method comprising: identifying, by a device, a timeseries motif present in a plurality of timeseries of performance metrics for a plurality of paths in a network; retrieving, by the device and based on the timeseries motif, device-level telemetry data from networking devices along the plurality of paths; determining, by the device, a root cause of the timeseries motif by correlating the timeseries motif with the device-level telemetry data; and providing, by the device, an indication of the timeseries motif and its root cause for display by a user interface. ### Claim 2 (depends on 1) The method as in claim 1, wherein the performance metrics comprise at least one of: packet loss, jitter, delay, or throughput. ### Claim 3 (depends on 1) The method as in claim 1, wherein the networking devices comprise one or more routers. ### Claim 4 (depends on 1) The method as in claim 1, wherein determining the root cause comprises: receiving, at the device and from the user interface, a metadata tag for the root cause. ### Claim 5 (depends on 1) The method as in claim 1, wherein identifying the timeseries motif comprises: extracting portions of a particular timeseries in the plurality of timeseries; and grouping a subset of the portions of the particular timeseries into the timeseries motif based on their similarities. ### Claim 6 (depends on 5) The method as in claim 5, wherein grouping the subset of the portions of the particular timeseries into the timeseries motif based on their similarities comprises: computing distances between portions of the particular timeseries in the subset and one or more other portions outside of the subset. ### Claim 7 (depends on 1) The method as in claim 1, wherein determining the root cause of the timeseries motif further comprises: correlating the timeseries motif with a particular portion of the network. ### Claim 8 (depends on 1) The method as in claim 1, wherein the device-level telemetry data is indicative of at least one of: control plane, interface, or data path metrics. ### Claim 9 (depends on 1) The method as in claim 1, wherein the device-level telemetry data is indicative of at least one of: wireless controller metrics, cellular metrics, or digital subscriber line (DSL) metrics. ### Claim 10 (depends on 1) The method as in claim 1, wherein the device-level telemetry data is indicative of at least one of: system resource metrics. ### Claim 11 An apparatus, comprising: one or more network interfaces; a processor coupled to the one or more network interfaces and configured to execute one or more processes; and a memory configured to store a process that is executable by the processor, the process when executed configured to: identify a timeseries motif present in a plurality of timeseries of performance metrics for a plurality of paths in a network; retrieve, based on the timeseries motif, device-level telemetry data from networking devices along the plurality of paths; determine a root cause of the timeseries motif by correlating the timeseries motif with the device-level telemetry data; and provide an indication of the timeseries motif and its root cause for display by a user interface. ### Claim 12 (depends on 11) The apparatus as in claim 11, wherein the performance metrics comprise at least one of: packet loss, jitter, delay, or throughput. ### Claim 13 (depends on 11) The apparatus as in claim 11, wherein the networking devices comprise one or more routers. ### Claim 14 (depends on 11) The apparatus as in claim 11, wherein the apparatus determines the root cause by: receiving, from the user interface, a metadata tag for the root cause. ### Claim 15 (depends on 11) The apparatus as in claim 11, wherein the apparatus identifies the timeseries motif by: extracting portions of a particular timeseries in the plurality of timeseries; and grouping a subset of the portions of the particular timeseries into the timeseries motif based on their similarities. ### Claim 16 (depends on 15) The apparatus as in claim 15, wherein the subset of the portions of the particular timeseries are grouped by the apparatus into the timeseries motif based on their similarities by: computing distances between portions of the particular timeseries in the subset and one or more other portions outside of the subset. ### Claim 17 (depends on 11) The apparatus as in claim 11, wherein the apparatus determines the root cause by: correlating the timeseries motif with a particular portion of the network. ### Claim 18 (depends on 11) The apparatus as in claim 11, wherein the device-level telemetry data is indicative of at least one of: control plane, interface, or data path metrics. ### Claim 19 (depends on 11) The apparatus as in claim 11, wherein the device-level telemetry data is indicative of at least one of: wireless controller metrics, cellular metrics, or digital subscriber line (DSL) metrics. ### Claim 20 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising: identifying, by the device, a timeseries motif present in a plurality of timeseries of performance metrics for a plurality of paths in a network; retrieving, by the device and based on the timeseries motif, device-level telemetry data from networking devices along the plurality of paths; determining, by the device, a root cause of the timeseries motif by correlating the timeseries motif with the device-level telemetry data; and providing, by the device, an indication of the timeseries motif and its root cause for display by a user interface.