Method and apparatus for determining a first causal map

An apparatus for determining a first causal map for the root cause analysis of a primary event in a network environment, the apparatus comprising processing circuitry configured to cause the apparatus to:

• obtain a first data set, wherein each entry in the first data set comprises values of a plurality of features representative of the network environment, wherein the plurality of features comprises a primary feature representative of the primary event;
• for each first feature in a first subset of the plurality of features, perform an independence test on the first data set to determine a relationship between the first feature and the primary feature;
• for each first feature in the first subset for which the independence test indicates a dependent relationship to the primary feature, perform the independence test on the first data set to determine a relationship between the first feature and each second feature in a second subset of the plurality of features;
• based on results of the steps of performing the independence test, determine one or more pathways in the first causal map between at least one root cause for the primary event and the primary feature, wherein
• at least one pathway comprises at least one intermediate feature between the primary event and a root cause for the primary event;
• and
• group the plurality of features into a plurality of non-overlapping groups, wherein
• at least two or more of the plurality of non-overlapping groups are arranged into a hierarchy,
• the hierarchy starts with a primary group comprising the primary feature and ends with a root cause group comprising one or more suspected root causes for the primary feature, and
• the first subset of the plurality of features is associated with a first group, and the second subset of the plurality of features is associated with a second group.

A non-transitory computer readable storage medium storing a computer program for determining a first causal map for the root cause analysis of a primary event in a network environment, the computer program comprising computer code which, when run on processing circuitry of an apparatus, causes the apparatus to:

• obtain a first data set, wherein each entry in the first data set comprises values of a plurality of features representative of the network environment, wherein the plurality of features comprises a primary feature representative of the primary event;
• for each first feature in a first subset of the plurality of features, perform an independence test on the first data set to determine a relationship between the first feature and the primary feature;
• for each first feature in the first subset for which the independence test indicates a dependent relationship to the primary feature, perform the independence test on the first data set to determine a relationship between the first feature and each second feature in a second subset of the plurality of features;
• based on results of the steps of performing the independence test, determine one or more pathways in the first causal map between at least one root cause for the primary event and the primary feature, wherein
• at least one pathway comprises at least one intermediate feature between the primary event and a root cause for the primary event;
• and
• group the plurality of features into a plurality of non-overlapping groups, wherein
• at least two or more of the plurality of non-overlapping groups are arranged into a hierarchy,
• the hierarchy starts with a primary group comprising the primary feature and ends with a root cause group comprising one or more suspected root causes for the primary feature, and
• the first subset of the plurality of features is associated with a first group, and the second subset of the plurality of features is associated with a second group.