Using machine learning based on cross-signal correlation for root cause analysis in a network assurance service

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• associate a target key performance indicator (tKPI) measured from a monitored network with a plurality of causation key performance indicators (cKPIs) measured from the monitored network that may indicate a root cause of a tKPI anomaly;
• apply a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores;
• calculate, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores;
• use the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs;
• and
• select one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a network assurance service that monitors a network to execute a process comprising:

• associating, by the network assurance service, a target key performance indicator (tKPI) measured from the network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly;
• applying, by the network assurance service, a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores;
• calculating, by the network assurance service and for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores;
• using, by the network assurance service, the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs;
• and
• selecting, by the network assurance service, one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.