# US 12,771,594 B2 · Apparatuses and methods for identifying and disseminating information pertaining to issues in networks and systems utilizing machine learning and artificial intelligence > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,771,594 B2 - Document ID: US12771594B2 - Status: Granted - Kind: B2 - Application number: 18/508,286 - Filed: 2023-11-14 - Published: 2025-05-15 - Granted: 2026-10-20 - Earliest claimed: 2023-11-14 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Lucus Haugen; Lakshmanan Ravichandran; Shimona Kavdia - Web page: https://patentgrep.com/patent/US12771594B2 ## CPC - H04L 41/0654: using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) - H04L 41/0627: {by acting on the notification or alarm source} - H04L 41/12: Discovery or management of network topologies - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Aspects of the subject disclosure may include, for example, obtaining a plurality of alarms associated with a network, correlating the plurality of alarms to data that identifies a topology of the network to obtain a plurality of correlated events, applying a model that is based on machine learning to the plurality of correlated events to generate an extended correlated event, identifying a solution to the extended correlated event, and implementing the solution as part of the network. Other embodiments are disclosed. ## Claims ### Claim 1 A device, comprising: a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising: obtaining a plurality of alarms associated with a network; correlating the plurality of alarms to data that identifies a topology of the network utilizing a combination of a Breadth-First Search (BFS) directed to the plurality of alarms within a single level of the topology, and a Depth-First Search (DFS) directed to the plurality of alarms across multiple levels of the topology, the data including an indication of a first physical resource, a first physical device, a first virtual resource, a first logical resource, a modification made relative to the first physical resource, a modification made relative to the first physical device, a modification made relative to the first virtual resource, and a modification made relative to the first logical resource, wherein at the single level of the topology the correlating comprises executing a proximity-based search (PBS), generating a first correlated event in respect of a first common node between at least two nodes associated with at least two alarms of the plurality of alarms, and wherein the DFS comprises extending the first correlated event and a second correlated event across the multiple levels of the topology to identify another common node that is common to the first common node and another common node associated with the second correlated event; obtaining a plurality of correlated events based on the correlating of the plurality of alarms to the data; utilizing a key-value pair to represent common correlated events included in the plurality of correlated events, resulting in a modified plurality of correlated events, wherein the key-value pair includes a key that is representative of a type of a device and a value that is an identifier of the device, and wherein the utilizing of the key-value pair includes, when an alarm associated with a given device is obtained and an open correlated event already exists for the given device, appending the alarm to the open correlated event; applying a model that is based on machine learning to the modified plurality of correlated events to generate an extended correlated event; identifying a solution to the extended correlated event; and implementing the solution as part of the network. ### Claim 2 (depends on 1) The device of claim 1, wherein the data indicates that the topology of the network is arranged as a plurality of levels. ### Claim 3 (depends on 2) The device of claim 2, wherein each correlated event of the plurality of correlated events is associated with a respective level of the plurality of levels. ### Claim 4 (depends on 3) The device of claim 3, wherein the extended correlated event is separated from at least one correlated event of the plurality of correlated events by at least two levels. ### Claim 5 (depends on 1) The device of claim 1, wherein a first alarm of the plurality of alarms is generated by a first device of the network. ### Claim 6 (depends on 5) The device of claim 5, wherein the first device includes a server, a router, a gateway, a switch, an access point, a base station, or any combination thereof, and wherein the first device performs a monitoring of second data and generates the first alarm based on the monitoring. ### Claim 7 (depends on 5) The device of claim 5, wherein a second alarm of the plurality of alarms is generated based on a user input. ### Claim 8 (depends on 7) The device of claim 7, wherein the user input is obtained from an engineer or a technician that is associated with the network. ### Claim 9 (depends on 7) The device of claim 7, wherein the user input is obtained from a user equipment that is communicatively coupled to the network, the user equipment being associated with a subscriber to the network. ### Claim 10 (depends on 1) The device of claim 1, wherein the operations further comprise: subsequent to the implementing of the solution as part of the network, obtaining a second plurality of alarms associated with the network; correlating the second plurality of alarms to the data that identifies the topology of the network to obtain a second plurality of correlated events, the second plurality of correlated events being at least partially different from the plurality of correlated events; applying the model to the second plurality of correlated events to generate a second solution that is different from the solution; and implementing the second solution as part of the network. ### Claim 11 (depends on 1) The device of claim 1, wherein the operations further comprise: subsequent to the implementing of the solution as part of the network, obtaining a second plurality of alarms associated with the network; correlating the second plurality of alarms to second data that identifies a second topology of the network to obtain a second plurality of correlated events, the second plurality of correlated events being at least partially different from the plurality of correlated events and the second topology being different from the topology; applying the model to the second plurality of correlated events to generate a second solution that is different from the solution; and implementing the second solution as part of the network. ### Claim 12 (depends on 11) The device of claim 11, wherein the topology is based on a use of a first communication device and a first function in the network, and wherein the second topology is based on: a removal of the first communication device from the network, a removal of the first function from the network, an addition of a second communication device to the network, an addition of a second function in the network, or any combination thereof. ### Claim 13 (depends on 1) The device of claim 1, wherein the operations further comprise: generating the model based on a use of a second plurality of alarms and a user input. ### Claim 14 (depends on 1) The device of claim 1, wherein the operations further comprise: modifying the model based on the implementing of the solution, resulting in a modified model; obtaining a second plurality of alarms associated with the network; correlating the second plurality of alarms to the data that identifies the topology of the network to obtain a second plurality of correlated events; applying the modified model to the second plurality of correlated events to generate a second solution that is different from the solution; and implementing the second solution as part of the network. ### Claim 15 A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising: mapping a plurality of alarms associated with a communication system to data that identifies a topology of the communication system to identify a plurality of correlated events utilizing a combination of a Breadth-First Search (BFS) directed to the plurality of alarms within a single level of the topology, and a Depth-First Search (DFS) directed to the plurality of alarms across multiple levels of the topology, the data including an indication of a first physical resource, a first physical device, a first virtual resource, a first logical resource, a modification made relative to the first physical resource, a modification made relative to the first physical device, a modification made relative to the first virtual resource, and a modification made relative to the first logical resource, wherein at the single level of the topology the mapping comprises executing a proximity-based search (PBS), generating a first correlated event in respect of a first common node between at least two nodes associated with at least two alarms of the plurality of alarms, and wherein the DFS comprises extending the first correlated event and a second correlated event across the multiple levels of the topology to identify another common node that is common to the first common node and another common node associated with the second correlated event; utilizing a key-value pair to represent common correlated events included in the plurality of correlated events, resulting in a modified plurality of correlated events, wherein the key-value pair includes a key that is representative of a type of a device and a value that is an identifier of the device, and wherein the utilizing of the key-value pair includes, when an alarm associated with a given device is obtained and an open correlated event already exists for the given device, appending the alarm to the open correlated event; identifying a root cause of an issue in the communication system based on the modified plurality of correlated events; identifying a solution to the issue based on the identifying of the root cause; and implementing the solution. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein each correlated event of the plurality of correlated events is identified based on an identification of a common node of the communication system that is associated with at least two alarms of the plurality of alarms, and wherein the identifying of the root cause of the issue is based on extending the plurality of correlated events to a second common node of the communication system. ### Claim 17 A method, comprising: obtaining, by a processing system including a processor, a plurality of alarms associated with a network, the plurality of alarms including a first alarm generated by a first device and a second alarm generated by a second device; analyzing, by the processing system, the plurality of alarms in accordance with data including an identification of a topology of the network to identify a plurality of correlated events utilizing a combination of a Breadth-First Search (BFS) directed to the plurality of alarms within a single level of the topology, and a Depth-First Search (DFS) directed to the plurality of alarms across multiple levels of the topology, the data including an indication of a first physical resource, a first physical device, a first virtual resource, a first logical resource, a modification made relative to the first physical resource, a modification made relative to the first physical device, a modification made relative to the first virtual resource, and a modification made relative to the first logical resource, wherein at the single level of the topology the analyzing comprises executing a proximity-based search (PBS), generating a first correlated event in respect of a first common node between at least two nodes associated with at least two alarms of the plurality of alarms, and wherein the DFS comprises extending the first correlated event and a second correlated event across the multiple levels of the topology to identify another common node that is common to the first common node and another common node associated with the second correlated event; utilizing, by the processing system, a key-value pair to represent common correlated events included in the plurality of correlated events, resulting in a modified plurality of correlated events, wherein the key-value pair includes a key that is representative of a type of a device and a value that is an identifier of the device, and wherein the utilizing of the key-value pair includes, when an alarm associated with a given device is obtained and an open correlated event already exists for the given device, appending the alarm to the open correlated event; applying, by the processing system, a model to the modified plurality of correlated events to identify a source of an issue in the network, the model being based on a use of machine learning, artificial intelligence, or a combination thereof; and addressing, by the processing system, the issue via a solution. ### Claim 18 (depends on 17) The method of claim 17, further comprising: identifying, by the processing system, the solution based on an analysis of a record of data pertaining to the network, wherein the network includes a social media network, and wherein the plurality of alarms is based on a monitoring of content or messages contributed to the social media network by one or more users of the social media network. ### Claim 19 (depends on 17) The method of claim 17, wherein the network includes a utility network that provides electrical power, water, sewer services, or trash services. ### Claim 20 (depends on 17) The method of claim 17, wherein the key-value pair includes a key that is representative of a type of a device and a value that is an identifier of the device, and wherein the utilizing of the key-value pair includes appending a third alarm generated by a third device to an open correlated event included in the plurality of correlated events.