Systems and methods for determining causal relationships among network alarms

A system comprising at least one computer including a processor, wherein the at least one computer is configured to:

• receive, at an alarm management service, a plurality of alarms generated in a network, wherein each of the plurality of alarms includes respective alarm data including an alarm identifier, a device identifier, an alarm start timestamp and an alarm end timestamp;
• cluster the plurality of alarms into an alarm cluster group based on time factors and/or a persistent homology technique, wherein the persistent homology technique is based on topological features of a topology of the network;
• generate a plurality of binary time sequences, wherein each of the plurality of binary time sequences corresponds to one of the plurality of alarms and wherein each of the plurality of binary time sequences is generated based on the alarm start timestamp and the alarm end timestamp of a corresponding alarm of the plurality of alarms;
• generate an initial alarm graph based on the alarm cluster group, the topology of the network, and the plurality of binary time sequences, wherein the initial alarm graph is a completely connected, undirected graph based on the plurality of alarms being generated for each received alarm identifier including the alarm identifier;
• provide, as input to a causal inference process, the initial alarm graph and the plurality of binary time sequences;
• and
• generate, by the causal inference process, a causal alarm graph based on the input, wherein the causal alarm graph is a partially connected and directed graph and wherein the partially connected and directed graph comprises a direction of each edge in the partially connected and directed graph;
• wherein the generating the initial alarm graph includes deleting delete an edge from between a first node of the initial alarm graph and a second node of the initial alarm graph when:
• (i) a first node device identifier associated with the first node is different from a second node device identifier associated with the second node;
• (ii) there is an absence of a network connection between a network device represented by the first node and a network device represented by the second node;
• and (iii) there is an absence of overlap between active intervals defined by the alarm start timestamp and the alarm end timestamp of the corresponding alarm of the plurality of alarms, where in the plurality of alarms are associated with the first node and the second node in their corresponding binary time sequences of the plurality of binary time sequences.

A non-transitory computer readable storage medium, including instructions stored thereon, which instructions, when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:

• receiving, at an alarm management service, a plurality of alarms generated in a network, wherein each of the plurality of alarms includes respective alarm data including an alarm identifier, a device identifier, an alarm start timestamp and an alarm end timestamp;
• clustering the plurality of alarms into an alarm cluster group based on time factors and/or a persistent homology technique, wherein the persistent homology technique is based on topological features of a topology of the network;
• generating a plurality of binary time sequences, wherein each of the plurality of binary time sequences corresponds to one of the plurality of alarms and wherein each of the plurality of binary time sequences is generated based on the alarm start timestamp and the alarm end timestamp of a corresponding alarm of the plurality of alarms;
• generating an initial alarm graph based on the alarm cluster group, the topology of the network, and the plurality of binary time sequences, wherein the initial alarm graph is a completely connected, undirected graph based on the plurality of alarms being generated for each received alarm identifier;
• providing, as input to a causal inference process, the initial alarm graph and the plurality of binary time sequences;
• and
• generating, by the causal inference process, a causal alarm graph based on the input, wherein the causal alarm graph is a partially connected and directed graph and wherein the partially connected and directed graph comprises a direction of each edge in the partially connected and directed graph;
• where in the generating the initial alarm graph includes deleting an edge from between a first node of the initial alarm graph and a second node of the initial alarm graph when:
• (i) a first node device identifier associated with the first node is different from a second node device identifier associated with the second node;
• (ii) there is an absence of a network connection between a network device represented by the first node and a network device represented by the second node;
• and (iii) there is an absence of overlap between active intervals defined by the alarm start timestamp and the alarm end timestamp of the corresponding alarm of the plurality of alarms, wherein the plurality of alarms are associated with the first node and the second node in their corresponding binary time sequences of the plurality of binary time sequences.