Hypothesis driven diagnosis of network systems

Patent metadata

Field	Value
Publication number	US-11888679-B2
Application number	US-202017032799-A
Country	US
Kind code	B2
Filing date	Sep 25, 2020
Priority date	Sep 25, 2020
Publication date	Jan 30, 2024
Grant date	Jan 30, 2024

Abstract

An example method includes obtaining, by one or more processors, data indicating resource dependencies between a plurality of resources in a network and event dependencies between a plurality of network events and one or more of the plurality of resources; generating a Bayesian model based on resource types of the plurality of resources and event types of the plurality of network events; receiving an indication of a fault in the network; collecting fault data and generating, based on the Bayesian model and the fault data, a plurality of root cause hypotheses for the fault; ordering the plurality of root cause hypotheses based on respective root cause probabilities associated with the plurality of root cause hypotheses; and outputting the ordered plurality of root cause hypotheses.

First claim

What is claimed is:

1. A method comprising:
obtaining, by one or more processors, data indicating resource dependencies between a plurality of resources in a network and event dependencies between a plurality of network events and one or more of the plurality of resources;
generating a Bayesian model based on resource types of the plurality of resources and event types of the plurality of network events, each of the plurality of resources in the network representing an instance of one of the resource types;
receiving an indication of a fault in the network;
collecting fault data and generating, based on the Bayesian model and the fault data, a plurality of root cause hypotheses for the fault, wherein each root cause hypothesis of the plurality of root cause hypotheses is associated with a resource type of the resource types, and wherein each of the plurality of root cause hypotheses has an associated probability;
determining, for a resource of the plurality of resources in the network, wherein the resource is an instance of a resource type associated with one of the root cause hypotheses of the plurality of root cause hypotheses, a probe associated with the resource type associated with the one of the root cause hypotheses, wherein a definition for the probe specifies one or more networking commands to be issued to at least one resource of the plurality of resources that result in receiving at least one value from the at least one resource, and wherein the probe further specifies one or more conditions for the at least one value that, when triggered by the probe, disprove the root cause hypothesis;
executing the probe, including issuing the one or more networking commands to the at least one resource, and, in response to determining that the probe disproves the root cause hypothesis, removing the root cause hypothesis from the plurality of root cause hypotheses to form an updated plurality of root cause hypotheses;
adjusting the probabilities associated with the updated plurality of root cause hypotheses based on the probability of the root cause hypothesis that was removed;
ordering the updated plurality of root cause hypotheses based on the adjusted probabilities associated with the updated plurality of root cause hypotheses to form an ordered plurality of root cause hypotheses; and
outputting the ordered plurality of root cause hypotheses.

2. The method of claim 1 , wherein the definition for the probe includes at least one argument for the probe.

3. The method of claim 1 , further comprising
determining whether the fault data is complete; and
in response to determining that the fault data is complete, waiting a first time period and, after the first time period has elapsed, generating the plurality of root cause hypotheses.

4. The method of claim 3 , further comprising:
in response to determining that the fault data is not complete, waiting a second time period longer than the first time period and, after the second time period has elapsed, generating the plurality of root cause hypotheses.

5. The method of claim 3 , wherein determining that the fault data is complete comprises determining that a threshold percentage of child resources have provided fault information, wherein the child resources correspond to child nodes of a resource node in a resource dependency model and the resource node corresponds to a resource that provided the fault data.

6. The method of claim 1 , further comprising:
receiving a confirmation of a root cause hypothesis of the plurality of root cause hypotheses; and
increasing a probability associated with each node corresponding to the confirmed root cause hypothesis.

7. The method of claim 1 , further comprising:
receiving a user-generated root cause hypothesis of the plurality of root cause hypotheses;
receiving an indication of a probe associated with the user-generated root cause hypothesis; and
adding the user-generated root cause hypothesis to the Bayesian model.

8. The method of claim 7 , wherein the probe associated with the user-generated root cause hypothesis comprises a new probe, and wherein the method further comprises receiving a mapping of resource properties of a resource node to inputs of the new probe.

9. The method of claim 1 , further comprising initializing a probability associated with each node of the Bayesian model to an equal probability.

10. A system comprising:
a memory; and
processing circuitry configured to:
obtain data indicating resource dependencies between a plurality of resources in a network and event dependencies between a plurality of network events and one or more of the plurality of resources;
generate a Bayesian model based on resource types of the plurality of resources and event types of the plurality of network events, each of the plurality of resources in the network representing an instance of one of the resource types;
receive an indication of a fault in the network;
collect fault data and generating, based on the Bayesian model and the fault data, a plurality of root cause hypotheses for the fault, wherein each root cause hypothesis of the plurality of root cause hypotheses is associated with a resource type of the resource types, and wherein each of the plurality of root cause hypotheses has an associated probability;
determine, for a resource of the plurality of resources in the network, wherein the resource is an instance of a resource type associated with one of the root cause hypothesis of the plurality of root cause hypotheses, a probe associated with the resource type associated with the one of the root cause hypotheses, wherein a definition for the probe specifies one or more networking commands to be issued to at least one resource of the plurality of resources that result in receiving at least one value from the at least one resource, and wherein the probe further specifies one or more conditions for the at least one value that, when triggered by the probe, disprove the root cause hypothesis;
execute the probe, including issuing the one or more networking commands to the at least one resource, and, in response to determining that the probe disproves the root cause hypothesis, removing the root cause hypothesis from the plurality of root cause hypotheses to form an updated plurality of root cause hypotheses;
adjust the probabilities associated with the updated plurality of root cause hypotheses based on the probability of the root cause hypothesis that was removed;
order the updated plurality of root cause hypotheses based on the adjusted probabilities associated with the updated plurality of root cause hypotheses to form an ordered plurality of root cause hypotheses; and
output the ordered plurality of root cause hypotheses.

11. The system of claim 10 , wherein the definition for the probe includes at least one argument for the probe.

12. The system of claim 10 , wherein the processing circuitry is further configured to:
determine whether the fault data is complete; and
in response to a determination that the fault data is complete, wait a first time period and after the first time period has elapsed, generate the plurality of root cause hypotheses after a first time period has elapsed.

13. The system of claim 12 , wherein the processing circuitry is further configured to:
in response to a determination that the fault data is not complete, wait a second time period longer than the first time period and, after the second time period has elapsed, generate the plurality of root cause hypotheses.

14. The system of claim 12 , wherein to determine that the fault data is complete comprises to determine that a threshold p

Assignees

• Juniper Networks Inc

Inventors

• Grammel Gert
• R Jayanthi
• A Chandrasekhar

Classifications

• H04L41/0631 Primary

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• H04L41/064 Primary

  involving time analysis · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title

• H04L41/0681

  Configuration of triggering conditions · CPC title