Detecting network events having adverse user impact

Patent metadata

Field	Value
Publication number	US-12021722-B2
Application number	US-202217812676-A
Country	US
Kind code	B2
Filing date	Jul 14, 2022
Priority date	Mar 22, 2022
Publication date	Jun 25, 2024
Grant date	Jun 25, 2024

Abstract

A method includes receiving, by a network management system, network data from a plurality of network devices configured to provide a network at a site; receiving, by the processing circuitry, user impact data from a plurality of client devices that access the network at the site; determining, based on the network data, a pattern of one or more network events occurring over time; correlating in time the pattern of the one or more network events to an adverse user impact event indicated by the user impact data received from the plurality of client devices; and determining, in response to the correlating, an instance of overwhelming network traffic having an adverse user impact. In some examples, the network data includes network traffic impact data, such as a number of packets dropped at a switch port due to congestion.

First claim

What is claimed is:

1. A network management system (NMS) comprising:
a memory storing network data received from a plurality of network devices configured to provide a network at a site and user impact data received from a plurality of client devices that access the network at the site, wherein the user impact data comprises data indicative of one or more feedback responses, wherein each feedback response of the one or more feedback responses comprises a response to a prompt presented to a user by a client device of the plurality of client devices, the response indicating user feedback of a quality of an application session; and
one or more processors coupled to the memory and configured to:
determine, based on the network data, a pattern of one or more network events occurring over time;
correlate in time the pattern of one or more network events to an adverse user impact event indicated by the one or more feedback responses each indicating the user feedback; and
determine, in response to the correlation, an instance of overwhelming network traffic having an adverse user impact.

2. The NMS of claim 1 , wherein the network data received from the plurality of network devices comprises network traffic impact data, which indicates an impact of network traffic at the network device.

3. The NMS of claim 2 , wherein the network traffic impact data is received from a switch of the plurality of network devices and comprises data indicative of a number of packets dropped at a port of the switch due to congestion on the switch port.

4. The NMS of claim 1 , wherein the one or more processors are further configured to:
identify a root cause of the overwhelming network traffic having the adverse user impact; and
initiate a remediation action to address the overwhelming network traffic having the adverse user impact.

5. The NMS of claim 1 , wherein to determine the pattern of one or more network events occurring over time, the one or more processors are configured to determine the pattern of one or more network events over time in a time window, wherein the time window advances with respect to time.

6. The NMS of claim 1 , wherein the network data is indicative of operational behavior of the network, and wherein the network data defines a series of network events of one or more event types over a plurality of observation time periods, wherein the one or more processors are further configured to:
apply a machine learning model to the network data to dynamically determine a baseline number of occurrences of the network events in the network for each of the event types over a time period and to classify, based on the baseline number of occurrences and subsequently received network data, the one or more network events as an abnormal network event indicative of abnormal network behavior.

7. The NMS of claim 6 , wherein the machine learning model comprises an unsupervised machine learning model.

8. The NMS of claim 6 , wherein the machine learning model uses transferred learning information from a second network to dynamically determine the baseline number of occurrences of the network events, the transferred learning information comprising information about a number of occurrences of network events of the one or more event types in the second network.

9. The NMS of claim 6 , wherein applying the machine learning model comprises applying trending analysis to identify trending behavior in the network events over the time period to classify, based on the baseline number of occurrences and subsequently received network data, the one or more of the network events as indicative of abnormal network behavior.

10. The NMS of claim 9 , wherein applying trending analysis to identify trending behavior comprises performing time series pattern recognition to identify a start of the trending behavior.

11. The NMS of claim 1 , wherein the one or more processors are further configured to:
determine a baseline value for the one or more network events occurring over time; and
determine a trend of the one or more network events, wherein the trend is indicative of a trending change in the one or more network events relative to the baseline value, wherein the trending change comprises an increase in a number of abnormal network events relative to the baseline value.

12. The NMS of claim 1 , wherein the network devices comprise one or more network switches, and wherein the network data comprises user traffic data received from the network switches that indicates increased levels of control plane traffic associated with a network protocol by which the one or more network switches attempts to negotiate a loop-free layer two (L2) forwarding topology.

13. The NMS of claim 12 , wherein the network protocol comprises a spanning tree protocol (STP), and wherein the network data indicates an amount of STP messages detected.

14. The NMS of claim 1 , wherein the one or more of the network events classified as abnormal network behavior includes increased proportion of broadcast, unknown- unicast or multicast (BUM) traffic in the network relative to unicast traffic in the network.

15. The NMS of claim 1 , wherein the pattern of one or more network events comprises a pattern of one or more network loops.

16. The NMS of claim 1 , wherein the pattern of one or more network events comprises a high volume of communications per unit time from one or more client devices of the plurality of client devices.

17. A method comprising:
receiving, by processing circuitry of a network management system (NMS), network data from a plurality of network devices configured to provide a network at a site;
receiving, by the processing circuitry, user impact data from a plurality of client devices that access the network at the site, wherein the user impact data comprises data indicative of one or more feedback responses, and wherein each feedback response of the one or more feedback responses comprises a response to a prompt presented to a user by a client device of the plurality of client devices, the response indicating user feedback of a quality of an application session;
determining, by the processing circuitry and based on the network data, a pattern of one or more network events occurring over time;
correlating in time, by the processing circuitry, the pattern of one or more network events to an adverse user impact event indicated by the one or more feedback responses each indicating the user feedback; and
determining, by the processing circuitry and in response to the correlating, an instance of overwhelming network traffic having an adverse user impact.

18. The method of claim 17 , further comprising:
performing, by the processing circuitry, root cause analysis of the overwhelming network traffic based on the network data to identify a suspected root cause of the overwhelming network traffic; and
sending, by the processing circuitry to a network device selected from among the plurality of network devices and based on the identified root cause, instructions for the selected network device to perform an action to remediate the overwhelming network traffic.

19. A non-transitory computer-readable medium, having instructions stored thereon that, when executed, cause one or more processors of a network management system (NMS) to:
receive network data from a plurality of network devices configured to provide a network at a site;
receive user impact data from a plurality of client devices that access the network at the site, wherein the user impact data comprises data indicative of one or more fee

Assignees

• Juniper Networks Inc

Inventors

• Wang Jisheng
• Cheng Jing
• Shamsundar Abhiram Madhugiri
• Frei Randall

Classifications

• H04L45/48

  Routing tree calculation · CPC title

• H04L43/062

  related to network traffic · CPC title

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• H04L41/0677

  Localisation of faults · CPC title

• H04L43/0876 Primary

  Network utilisation, e.g. volume of load or congestion level · CPC title