Determining context and actions for machine learning-detected network issues

Patent metadata

Field	Value
Publication number	US-2021281492-A1
Application number	US-202016812517-A
Country	US
Kind code	A1
Filing date	Mar 9, 2020
Priority date	Mar 9, 2020
Publication date	Sep 9, 2021
Grant date	—

Abstract

In one embodiment, a network assurance service that monitors a network detects a network issue in the network using a machine learning model and based on telemetry data captured in the network. The service assigns the detected network issue to an issue cluster by applying clustering to the detected network issue and to a plurality of previously detected network issues. The service selects a set of one or more actions for the detected network issue from among a plurality of actions associated with the previously detected network issues in the issue cluster. The service obtains context data for the detected network issue. The service provides, to a user interface, an indication of the detected network issue, the obtained context data for the detected network issue, and the selected set of one or more actions.

First claim

1 . A method comprising:
detecting, by a network assurance service that monitors a network, a network issue in the network using a machine learning model and based on telemetry data captured in the network; representing, by the network assurance service, the detected network issue and a plurality of previously detected network issues as feature vectors; assigning, by the network assurance service, the detected network issue to an issue cluster by applying clustering to the feature vectors that represent the detected network issue and the plurality of previously detected network issues; selecting, by the network assurance service, a set of one or more actions for the detected network issue from among a plurality of actions associated with the previously detected network issues in the issue cluster; obtaining, by the network assurance service, context data for the detected network issue; and providing, by the network assurance service and to a user interface, an indication of the detected network issue, the context data for the detected network issue, and the selected set of one or more actions.

2 . The method as in claim 1 , wherein the feature vectors are indicative of one or more of: a key performance indicator (KPI) from the telemetry data captured in the network, a KPI predicted by the machine learning model, or an amount of deviation between a KPI from the telemetry data and a KPI predicted by the machine learning model.

3 . The method as in claim 1 , wherein the context data for the detected network issue is indicative of at least one of: a relevance score, a user-defined description, an action rating for an action in the selected set of one or more actions, or network configuration information for the network.

4 . The method as in claim 1 , wherein the plurality of previously detected network issues comprise at least one network issue detected in another network.

5 . The method as in claim 1 , wherein the set of one or more actions are selected based on confidence indices assigned to one or more of the plurality of actions associated with the previously detected network issues in the issue cluster.

6 . The method as in claim 5 , wherein selecting the set of one or more actions for the detected network issue from among the plurality of actions associated with the previously detected network issues in the issue cluster comprises:
computing vote scores for each of the previously detected network issues, wherein the vote scores are weighted based on the confidence indices assigned to the one or more of the plurality of actions; and selecting the set of one or more actions using the computed vote scores.

7 . The method as in claim 1 , further comprising:
receiving, at the network assurance service and via the user interface, an instruction to automatically enforce the selected set of one or more actions in the network for the detected network issue; and initiating, by the network assurance service and after receiving the instruction, performance of the selected set of one or more actions in the network.

8 . The method as in claim 7 , further comprising:
computing, by the network assurance service, a trust score based on the received instruction to automatically enforce the selected set of one or more actions in the network; and sending, by the network assurance service and to the user interface, an option to enable automatic enforcement of actions in the network for future network issues detected by the network assurance service.

9 . The method as in claim 1 , further comprising:
receiving, at the network assurance service and from the user interface, a rejection of the set of one or more actions; and adjusting, by the network assurance service, confidence indices assigned to the one or more actions based on the rejection.

10 . An apparatus, comprising:
one or more network interfaces; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to:
detect a network issue in a network using a machine learning model and based on telemetry data captured in the network;
represent the detected network issue and a plurality of previously detected network issues as feature vectors;
assign the detected network issue to an issue cluster by applying clustering to the feature vectors that represent the detected network issue and the plurality of previously detected network issues;
select a set of one or more actions for the detected network issue from among a plurality of actions associated with the previously detected network issues in the issue cluster;
obtain context data for the detected network issue; and
provide, to a user interface, an indication of the detected network issue, the context data for the detected network issue, and the selected set of one or more actions.

11 . The apparatus as in claim 10 , wherein the feature vectors are indicative of one or more of: a key performance indicator (KPI) from the telemetry data captured in the network, a KPI predicted by the machine learning model, or an amount of deviation between a KPI from the telemetry data and a KPI predicted by the machine learning model.

12 . The apparatus as in claim 10 , wherein the context data for the detected network issue is indicative of at least one of: a relevance score, a user-defined description, an action rating for an action in the selected set of one or more actions, or network configuration information for the network.

13 . The apparatus as in claim 10 , wherein the plurality of previously detected network issues comprise at least one network issue detected in another network.

14 . The apparatus as in claim 10 , wherein the set of one or more actions are selected based on confidence indices assigned to one or more of the plurality of actions associated with the previously detected network issues in the issue cluster.

15 . The apparatus as in claim 14 , wherein the apparatus selects the set of one or more actions for the detected network issue from among the plurality of actions associated with the previously detected network issues in the issue cluster by:
computing vote scores for each of the previously detected network issues, wherein the vote scores are weighted based on the confidence indices assigned to the one or more of the plurality of actions; and selecting the set of one or more actions using the computed vote scores.

16 . The apparatus as in claim 10 , wherein the process when executed is further configured to:
receive, via the user interface, an instruction to automatically enforce the selected set of one or more actions in the network for the detected network issue; and initiate, after receiving the instruction, performance of the selected set of one or more actions in the network.

17 . The apparatus as in claim 16 , wherein the process when executed is further configured to:
compute a trust score based on the received instruction to automatically enforce the selected set of one or more actions in the network; and send, to the user interface, an option to enable automatic enforcement of actions in the network for future network issues detected by the apparatus.

18 . The apparatus as in claim 10 , wherein the process when executed is further configured to:
receive, from the user interface, a rejection of the set of one or more actions; and adjust confidence indices assigned to the one or more actions based on the rejection.

19 . A tangible,

Assignees

• Cisco Tech Inc

Inventors

• Di Pietro Andrea
• Cruz Mota Javier
• Dasgupta Sukrit
• Vasseur Jean-Philippe

Classifications

• H04L41/147

  for predicting network behaviour · CPC title

• H04L41/149

  for prediction of maintenance · CPC title

• H04L41/16 Primary

  using machine learning or artificial intelligence · CPC title

• H04L41/145 Primary

  involving simulating, designing, planning or modelling of a network · CPC title

• G06N5/022

  Knowledge engineering; Knowledge acquisition · CPC title