Automated reconstruction system and method for sequences of events arising from a root cause impact in network environments

A non-transitory computer-readable medium storing a plurality of processor-executable instructions, wherein executing the plurality of processor-executable instructions causes one or more processors to:

• maintain a network dependency graph that includes a plurality of nodes and edges, wherein each node represents a respective network element of a plurality of network elements of a network environment and wherein each edge represents a dependency between different network elements;
• receive time-stamped network data associated with the plurality of network elements;
• identify, based on the time-stamped network data, an anomaly event, occurring at a first time, associated with a first node of the network dependency graph;
• identify, based on the time-stamped network data, a candidate root cause event for the anomaly event, wherein the candidate root cause event occurs at a second time that is prior to the first time and is associated with a second node of the network dependency graph;
• traverse, based on the candidate root cause event, the network dependency graph to identify a particular set of nodes that are on one or more dependency paths from the second node;
• identify, based on the time-stamped network data, a set of events associated with the particular set of nodes, wherein identifying the set of events includes selecting particular events that are associated with the particular set of nodes and that occur within a particular time window that includes the second time;
• apply a graph neural network (GNN) to nodes and edges of the network dependency graph to determine candidate causal paths associated with the particular set of nodes and select, from the set of events, a consistent sequence of events;
• identify one or more impacted network elements based on the consistent sequence of events;
• and
• output the consistent sequence of events with device-specific remediation instructions for the one or more impacted network elements.

A device, comprising:

• one or more memory devices storing a plurality of processor-executable instructions;
• and
• one or more processors configured to execute the plurality of processor-executable instructions, wherein executing the plurality of processor-executable instructions causes the one or more processors to:
• maintain a network dependency graph that includes a plurality of nodes and edges, wherein each node represents a respective network element of a plurality of network elements of a network environment and wherein each edge represents a dependency between different network elements;
• receive time-stamped network data associated with the plurality of network elements;
• identify, based on the time-stamped network data, an anomaly event, occurring at a first time, associated with a first node of the network dependency graph;
• identify, based on the time-stamped network data, a candidate root cause event for the anomaly event, wherein the candidate root cause event occurs at a second time that is prior to the first time and is associated with a second node of the network dependency graph;
• traverse, based on the candidate root cause event, the network dependency graph to identify a particular set of nodes that are on one or more dependency paths from the second node;
• identify, based on the time-stamped network data, a set of events associated with the particular set of nodes, wherein identifying the set of events includes selecting particular events that are associated with the particular set of nodes and that occur within a particular time window that includes the second time;
• apply a graph neural network (GNN) to nodes and edges of the network dependency graph to determine candidate causal paths associated with the particular set of nodes and select, from the set of events, a consistent sequence of events;
• identify one or more impacted network elements based on the consistent sequence of events;
• and
• output the consistent sequence of events with device-specific remediation instructions for the one or more impacted network elements.