# US 2020/0396147 A1 · Network performance monitoring and anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396147 A1 - Document ID: US20200396147A1 - Status: Published application - Kind: A1 - Application number: 16/897,434 - Filed: 2020-06-10 - Published: 2020-12-17 - Earliest claimed: 2019-06-11 - Assignees: ARRIS Enterprises LLC - Applicants: ARRIS Enterprises LLC - Inventors: Yang Han; SeeHo Ting; Koteswar Rao Mellachervu; Lakshmi Nagarajan; Ilango Purushothaman; Jiayi Chen - Web page: https://patentgrep.com/patent/US20200396147A1 ## CPC - H04L 41/0618: {based on the physical or logical position} - H04L 41/0622: {based on time} - H04L 41/0654: using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) - H04L 43/06: Generation of reports - H04L 43/0817: by checking functioning - H04L 43/0888: Throughput - H04L 43/106: using time related information in packets, e.g. by adding timestamps - H04L 43/16: Threshold monitoring - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04W 24/04: Arrangements for maintaining operational condition - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract During operation, a computer may compare values of at least one performance metric for access points in appropriate contexts to determine one or more temporal anomalies and/or one or more spatial anomalies for one or more of the access points. Then, the computer may generate one or more temporal anomaly events based at least in part on the one or more temporal anomalies and one or more spatial anomaly events based at least in part on the one or more spatial anomalies. Next, the computer may calculate one or more complex events based at least in part on two or more of the different anomalies. Moreover, the computer may evaluate the different anomalies, anomaly event and/or complex events to determine one or more insights about a problem in the network. Furthermore, the computer may perform a remedial action. ## Claims ### Claim 1 A computer, comprising: an interface circuit configured to communicate with access points in a network; a processor coupled to the interface circuit; and memory, coupled to the processor, which stores program instructions, wherein, when executed by the processor, the program instructions cause the computer to perform operations comprising: monitoring values of at least one performance metric associated with packet communication associated with the access points; comparing the values of at least the one performance metric for the access points in multiple temporal contexts with historical values of at least the one performance metric to determine one or more temporal anomalies for one or more of the access points; comparing the values of at least the one performance metric for the access points having a spatial context to determine one or more spatial anomalies for one or more of the access points; generating one or more temporal anomaly events based at least in part on the one or more temporal anomalies; generating one or more spatial anomaly events based at least in part on the one or more spatial anomalies; calculating one or more complex events based at least in part on two or more of the one or more temporal anomalies and the one or more spatial anomalies; evaluating the one or more temporal anomaly events, the one or more spatial anomaly events, and the one or more complex events to determine one or more insights about a problem in the network; and performing a remedial action associated with the problem based at least in part on the one or more insights. ### Claim 2 (depends on 1) The computer of claim 1, wherein the spatial context comprises the access points having an environment with one or more common attributes. ### Claim 3 (depends on 1) The computer of claim 1, wherein the multiple temporal contexts comprises one or more instances of a first time interval, a second time interval and a third time interval; wherein the second time interval includes the first time interval and the third time interval includes the second time interval. ### Claim 4 (depends on 1) The computer of claim 1, wherein the one or more temporal anomalies corresponding to the multiple temporal contexts are determined using different thresholds. ### Claim 5 (depends on 1) The computer of claim 1, wherein the one or more temporal anomalies and the one or more spatial anomalies are determined concurrently. ### Claim 6 (depends on 1) The computer of claim 1, wherein the one or more temporal anomalies are based at least in part on a temporal anomaly direction. ### Claim 7 (depends on 1) The computer of claim 1, wherein, when at least the one performance metric corresponds to a ratio, the one or more operations comprise computing adjusted values of at least the one performance metric based at least in part on the values of at least the one performance metric and the historical values of at least the one performance metric; and wherein and the one or more temporal anomalies or the one or more spatial anomalies are determined using the adjusted values instead of the values. ### Claim 8 (depends on 1) The computer of claim 1, wherein the one or more temporal anomaly events correspond to one or more temporal clusters of the one or more temporal anomalies, and the one or more spatial anomaly events correspond to one or more spatial clusters of the one or more spatial anomalies. ### Claim 9 (depends on 1) The computer of claim 1, wherein the one or more temporal anomalies are based at least in part on median absolute deviations of the values. ### Claim 10 (depends on 1) The computer of claim 1, wherein the one or more temporal anomaly events are generated based at least in part on superpositions of instances of a kernel function at the one or more temporal anomalies and a threshold. ### Claim 11 (depends on 1) The computer of claim 1, wherein the one or more insights comprise or correspond to one or more of: analysis in a time window; analysis of different potential problems in the network; or identification of the problem. ### Claim 12 (depends on 1) The computer of claim 1, wherein the remedial action comprises: a recommendation about the problem, a notification about the problem, a report with computed results associated with the problem, or a corrective action in the network associated with the problem. ### Claim 13 (depends on 12) The computer of claim 12, wherein the corrective action comprises: updating firmware, rebooting or providing another type of feedback to at least one of the access points. ### Claim 14 A non-transitory computer-readable storage medium for use in conjunction with a computer, the computer-readable storage medium storing program instructions, wherein, when executed by the computer, the program instructions cause the computer to perform operations comprising: monitoring values of at least one performance metric associated with packet communication associated with access points in a network; comparing the values of at least the one performance metric for the access points in multiple temporal contexts with historical values of at least the one performance metric to determine one or more temporal anomalies for one or more of the access points; comparing the values of at least the one performance metric for the access points having a spatial context to determine one or more spatial anomalies for one or more of the access points; generating one or more temporal anomaly events based at least in part on the one or more temporal anomalies; generating one or more spatial anomaly events based at least in part on the one or more spatial anomalies; calculating one or more complex events based at least in part on two or more of the one or more temporal anomalies and the one or more spatial anomalies; evaluating the one or more temporal anomaly events, the one or more spatial anomaly events, and the one or more complex events to determine one or more insights about a problem in the network; and performing a remedial action associated with the problem based at least in part on the one or more insights. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the spatial context comprises the access points having an environment with one or more common attributes. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the one or more temporal anomalies corresponding to the multiple temporal contexts are determined using different thresholds. ### Claim 17 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the one or more temporal anomaly events correspond to one or more temporal clusters of the one or more temporal anomalies, and the one or more spatial anomaly events correspond to one or more spatial clusters of the one or more spatial anomalies. ### Claim 18 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the one or more temporal anomaly events are generated based at least in part on superpositions of instances of a kernel function at the one or more temporal anomalies and a threshold. ### Claim 19 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the one or more insights comprise or correspond to one or more of: analysis in a time window; analysis of different potential problems in the network; or identification of the problem. ### Claim 20 A method for performing a remedial action, comprising: by a computer: monitoring values of at least one performance metric associated with packet communication associated with access points in a network; comparing the values of at least the one performance metric for the access points in multiple temporal contexts with historical values of at least the one performance metric to determine one or more temporal anomalies for one or more of the access points; comparing the values of at least the one performance metric for the access points having a spatial context to determine one or more spatial anomalies for one or more of the access points; generating one or more temporal anomaly events based at least in part on the one or more temporal anomalies; generating one or more spatial anomaly events based at least in part on the one or more spatial anomalies; calculating one or more complex events based at least in part on two or more of the one or more temporal anomalies and the one or more spatial anomalies; evaluating the one or more temporal anomaly events, the one or more spatial anomaly events, and the one or more complex events to determine one or more insights about a problem in the network; and performing the remedial action associated with the problem based at least in part on the one or more insights.