# US 2019/0356533 A1 · Using machine learning based on cross-signal correlation for root cause analysis in a network assurance service

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0356533 A1
- Document ID: US20190356533A1
- Status: Published application
- Kind: A1
- Application number: 15/983,437
- Filed: 2018-05-18
- Published: 2019-11-21
- Earliest claimed: 2018-05-18
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Jean-Philippe Vasseur; Grégory Mermoud; Santosh Ghanshyam Pandey; Vikram Kumaran
- Web page: https://patentgrep.com/patent/US20190356533A1

## CPC

- H04L 41/064: {involving time analysis}
- G06N 3/045: Combinations of networks
- G06N 3/0455: Auto-encoder networks; Encoder-decoder networks
- G06N 3/088: Non-supervised learning, e.g. competitive learning
- G06N 5/045: Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence
- G06N 20/00: Machine learning
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06N 20/20: Ensemble learning
- H04L 41/149: for prediction of maintenance
- H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- G06N 3/044: Recurrent networks, e.g. Hopfield networks
- G06N 3/049: Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 5/025: Extracting rules from data
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP]
- H04L 41/5003: Managing SLA; Interaction between SLA and QoS
- H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
- H04L 61/503: using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

In one embodiment, a network assurance service associates a target key performance indicator (tKPI) measured from a network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly. The network assurance service applies a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores. The network assurance service calculates, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores. The network assurance service uses the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs. The network assurance service selects one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

## Claims

### Claim 1

A method comprising:
associating, by a network assurance service that monitors a network, a target key performance indicator (tKPI) measured from the network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly;
applying, by the network assurance service, a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores;
calculating, by the network assurance service and for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores;
using, by the network assurance service, the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs; and
selecting, by the network assurance service, one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

### Claim 2 (depends on 1)

The method as in claim 1, wherein associating the tKPI with the plurality of cKPIs comprises:
receiving, at the network assurance service, a selection of the cKPIs from a user interface for association with the tKPI.

### Claim 3 (depends on 1)

The method as in claim 1, wherein the tKPI indicates onboarding times for wireless clients of the network, and wherein the cKPIs comprise one or more of: a Dynamic Host Configuration Protocol (DHCP) error count, a number of clients being onboarded to the network, or a number of Authentication, Authorization and Accounting (AAA) authentication failures.

### Claim 4 (depends on 1)

The method as in claim 1, further comprising:
providing, by the network assurance service, an indication of the one or more cKPIs selected as the root cause of the tKPI anomaly to a user interface.

### Claim 5 (depends on 1)

The method as in claim 1, wherein selecting the one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores comprises:
comparing the calculated cross-correlation scores to a defined correlation threshold; and
selecting the one or more cKPIs as the root cause of the tKPI anomaly based on at least one of their cross-correlation scores exceeding the defined correlation threshold.

### Claim 6 (depends on 5)

The method as in claim 5, further comprising:
dynamically adjusting, by the network assurance service, the correlation threshold, based on feedback from a user interface regarding the selected one or more cKPIs.

### Claim 7 (depends on 1)

The method as in claim 1, further comprising:
using, by the network assurance service, an auto-encoder to detect a spike in a particular cKPI relative to one or more of the other cKPIs; and
selecting the particular cKPI as the root cause of the tKPI anomaly based in part on the detected spike.

### Claim 8 (depends on 1)

The method as in claim 1, further comprising:
adjusting, by the network assurance service, the plurality of cKPIs associated with the tKPI to exclude a particular cKPI that was not selected as a root cause of the tKPI anomaly.

### Claim 9 (depends on 1)

The method as in claim 1, wherein the network assurance service is a cloud-based service.

### Claim 10

An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
associate a target key performance indicator (tKPI) measured from a monitored network with a plurality of causation key performance indicators (cKPIs) measured from the monitored network that may indicate a root cause of a tKPI anomaly;
apply a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores;
calculate, for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores;
use the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs; and
select one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

### Claim 11 (depends on 10)

The apparatus as in claim 10, wherein the apparatus associates the tKPI with the plurality of cKPIs by:
receiving a selection of the cKPIs from a user interface for association with the tKPI.

### Claim 12 (depends on 10)

The apparatus as in claim 10, wherein the tKPI indicates onboarding times for wireless clients of the network, and wherein the cKPIs comprise one or more of: a Dynamic Host Configuration Protocol (DHCP) error count, a number of clients being onboarded to the network, or a number of Authentication, Authorization and Accounting (AAA) authentication failures.

### Claim 13 (depends on 10)

The apparatus as in claim 10, wherein the process when executed is further configured to:
provide an indication of the one or more cKPIs selected as the root cause of the tKPI anomaly to a user interface.

### Claim 14 (depends on 10)

The apparatus as in claim 10, wherein the apparatus selects the one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores by:
comparing the calculated cross-correlation scores to a defined correlation threshold; and
selecting the one or more cKPIs as the root cause of the tKPI anomaly based on at least one of their cross-correlation scores exceeding the defined correlation threshold.

### Claim 15 (depends on 14)

The apparatus as in claim 14, wherein the process when executed is further configured to:
dynamically adjust the correlation threshold, based on feedback from a user interface regarding the selected one or more cKPIs.

### Claim 16 (depends on 10)

The apparatus as in claim 10, wherein the process when executed is further configured to:
use an auto-encoder to detect a spike in a particular cKPI relative to one or more of the other cKPIs; and
select the particular cKPI as the root cause of the tKPI anomaly based in part on the detected spike.

### Claim 17 (depends on 10)

The apparatus as in claim 10, wherein the process when executed is further configured to:
adjust the plurality of cKPIs associated with the tKPI to exclude a particular cKPI that was not selected as a root cause of the tKPI anomaly.

### Claim 18 (depends on 10)

The apparatus as in claim 10, wherein the process when executed is further configured to:
filter one of the selected cKPIs as a root cause of the tKPI anomaly.

### Claim 19

A tangible, non-transitory, computer-readable medium storing program instructions that cause a network assurance service that monitors a network to execute a process comprising:
associating, by the network assurance service, a target key performance indicator (tKPI) measured from the network with a plurality of causation key performance indicators (cKPIs) measured from the network that may indicate a root cause of a tKPI anomaly;
applying, by the network assurance service, a machine learning-based anomaly detector to the tKPI over time, to generate tKPI anomaly scores;
calculating, by the network assurance service and for each of cKPIs, a mean and standard deviation of that cKPI using a plurality of different time windows associated with the tKPI anomaly scores;
using, by the network assurance service, the calculated means and standard deviations of the cKPIs in the different time windows to calculate cross-correlation scores between the tKPI anomaly scores and the cKPIs; and
selecting, by the network assurance service, one or more of the cKPIs as the root cause of the tKPI anomaly based on their calculated cross-correlation scores.

### Claim 20 (depends on 19)

The computer-readable medium as in claim 19, wherein the process further comprises:
providing, by the network assurance service, an indication of the one or more cKPIs selected as the root cause of the tKPI anomaly to a user interface.