Network issue tracking and resolution system

Patent metadata

Field	Value
Publication number	US-11196614-B2
Application number	US-201916523463-A
Country	US
Kind code	B2
Filing date	Jul 26, 2019
Priority date	Jul 26, 2019
Publication date	Dec 7, 2021
Grant date	Dec 7, 2021

Abstract

In one embodiment, an issue analysis service determines that an issue exists with a device in a network. The service searches a decision tree for a solution to the issue, wherein branch nodes of the decision tree comprise diagnostic checks. The service clusters, based on a determination that a solution to the issue does not exist in the decision tree, telemetry for the device with telemetry for one or more other devices that also experienced the issue. The service uses a neural network to identify a difference between the clustered telemetry and telemetry from one or more devices for which the issue was resolved. The service adds a leaf node to the decision tree with the identified difference as a solution to the issue.

First claim

What is claimed is:

1. A method comprising:
determining, by an issue analysis service, that an issue exists with a device in a network;
searching, by the issue analysis service, a decision tree for a solution to the issue, wherein branch nodes of the decision tree comprise diagnostic checks, and at least one leaf node of the decision tree may represent a solution to a particular issue;
clustering, by the issue analysis service and based on a determination that a solution to the issue does not exist in the decision tree, telemetry for the device with telemetry for one or more other devices that also experienced the issue;
using, by the issue analysis service, a neural network to identify a difference between the clustered telemetry and telemetry from one or more devices for which the issue was resolved; and
adding, by the issue analysis service, a new leaf node to the decision tree with the identified difference as a solution to the issue.

2. The method as in claim 1 , wherein the device comprises a router or switch.

3. The method as in claim 1 , further comprising:
augmenting the telemetry for the device with derived metadata.

4. The method as in claim 1 , further comprising:
identifying a failure in the network;
forming sets of telemetry from devices in the network, each set corresponding to a different window of time prior to the failure; and
identifying one or more changes in traits of the sets of telemetry.

5. The method as in claim 4 , further comprising:
sending a report to a user interface indicative of the one or more changes in the traits of the sets of telemetry.

6. The method as in claim 4 , further comprising:
determining that the failure in the network is a significant failure;
identifying one or more issues in the network that were unresolved before the failure; and
associating the failure with the one or more unresolved issues as an impact of the one or more unresolved issues.

7. The method as in claim 6 , further comprising:
providing the impact in conjunction with an alert to a user interface regarding the one or more unresolved issues.

8. The method as in claim 6 , wherein associating the failure with the one or more unresolved issues as an impact of the one or more unresolved issues comprises:
applying a machine learning model to the unresolved issues.

9. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
determine that an issue exists with a device in a network;
search a decision tree for a solution to the issue, wherein branch nodes of the decision tree comprise diagnostic checks, and at least one leaf node of the decision tree may represent a solution to a particular issue;
cluster, based on a determination that a solution to the issue does not exist in the decision tree, telemetry for the device with telemetry for one or more other devices that also experienced the issue;
use a neural network to identify a difference between the clustered telemetry and telemetry from one or more devices for which the issue was resolved; and
add a new leaf node to the decision tree with the identified difference as a solution to the issue.

10. The apparatus as in claim 9 , wherein the process when executed is further configured to:
use the decision tree with the new leaf node to determine a solution to a previously-identified issue in the network.

11. The apparatus as in claim 9 , wherein the process when executed is further configured to:
augment the telemetry for the device with derived metadata.

12. The apparatus as in claim 9 , wherein the process when executed is further configured to:
identify a failure in the network;
form sets of telemetry from devices in the network, each set corresponding to a different window of time prior to the failure; and
identify one or more changes in traits of the sets of telemetry.

13. The apparatus as in claim 12 , wherein the process when executed is further configured to:
send a report to a user interface indicative of the one or more changes in the traits of the sets of telemetry.

14. The apparatus as in claim 12 , wherein the process when executed is further configured to:
determine that the failure in the network is a significant failure;
identify one or more issues in the network that were unresolved before the failure; and
associate the failure with the one or more unresolved issues as an impact of the one or more unresolved issues.

15. The apparatus as in claim 12 , wherein the process when executed is further configured to:
providing the impact in conjunction with an alert to a user interface regarding the one or more unresolved issues.

16. The apparatus as in claim 12 , wherein the apparatus associates the failure with the one or more unresolved issues as an impact of the one or more unresolved issues by:
applying a machine learning model to the unresolved issues.

17. A tangible, non-transitory, computer-readable medium storing program instructions that cause an issue analysis service that operates on a device comprising a processor and a memory to execute a process comprising:
determining, by the issue analysis service, that an issue exists with a device in a network;
searching, by the issue analysis service, a decision tree for a solution to the issue, wherein branch nodes of the decision tree comprise diagnostic checks, and at least one leaf node of the decision tree may represent a solution to a particular issue;
clustering, by the issue analysis service and based on a determination that a solution to the issue does not exist in the decision tree, telemetry for the device with telemetry for one or more other devices that also experienced the issue;
using, by the issue analysis service, a neural network to identify a difference between the clustered telemetry and telemetry from one or more devices for which the issue was resolved; and
adding, by the issue analysis service, a new leaf node to the decision tree with the identified difference as a solution to the issue.

18. The computer-readable medium as in claim 17 , wherein the device comprises a router or switch.

19. The computer-readable medium as in claim 17 , wherein the process further comprises:
augmenting the telemetry for the device with derived metadata.

20. The computer-readable medium as in claim 17 , wherein the process further comprises:
identifying a failure in the network;
forming sets of telemetry from devices in the network, each set corresponding to a different window of time prior to the failure; and
identifying one or more changes in traits of the sets of telemetry.

Assignees

• Cisco Tech Inc

Inventors

• Mortensen Magnus
• Johnston Jay Kemper
• White Jr David C

Classifications

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N3/042

  Knowledge-based neural networks; Logical representations of neural networks · CPC title

• G06N3/0499

  Feedforward networks · CPC title

• H04L41/064

  involving time analysis · CPC title

• G06N3/088

  Non-supervised learning, e.g. competitive learning · CPC title