The disclosure relates to technology for determining a root cause of anomalous behaviors in networks. First indicators (KQIs) are categorized into first groups (states) and second indicators (KPIs) are categorized into second groups. A conditional probability is estimated by calculating a probability that the second indicators will result in degradation of the first indicators based on historical data using association rule learning. The second indicators having the conditional probability associated with degradation of the first indicators are mapped to a corresponding one of the first groups in a probabilistic network structure based on a detected degradation of the first indicators in the historical data. Then it is determined whether the second indicators mapped to the corresponding first groups satisfy a threshold when degradation of the first indicators is detected, and each of the second indicators resulting in degradation of the first indicator are ranked according to a corresponding conditional probability.

A system and method of managing a network with assets are described. The method includes generating a directed graph with each of the assets represented as a node, determining individual failure probability of each node, computing downstream failure probability of each node according to an arrangement of the nodes in the directed graph, computing upstream failure probability of each node according to the arrangement of the nodes in directed graph, and computing network failure probability for each node based on the corresponding individual failure probability, the downstream failure probability, and the upstream failure probability. Managing the network is based on the network failure probability of the assets.

Method and system for Root Cause Analysis (RCA) across multiple network systems. Update information of a first local root cause analysis mechanism is received. An RCA controller generates, based on the update information, a new node to be added to a global root cause decision tree, where the global root cause decision tree is to be shared by at least two of the plurality of network operators. The RCA controller requests storage of the new node in a distributed ledger that is shared by network operators. The RCA controller participates in a verification operation of the new node. In response to determining that the verification operation is successful, the RCA controller adds an entry including the new node to the distributed ledger as part of the global root cause decision tree. Alternatively, when the verification operation is not successful, the new node is not added to the distributed ledger.

A method includes receiving network data describing operation of a network including a plurality of anomalies; clustering the network data to obtain clusters of groups of correlated anomalies; responsive to labeling the clusters of groups of correlated anomalies, utilizing the labels for the network data to train a model for automatic classification; and providing the model for automatic classification of additional network data. The clusters can be described through interpretable clustering (tree learning on cluster labels) (usage for description) or the cluster of interest can be deployed (again, tree learning on cluster labels) (usage for automatic classification).

Systems and methods for analyzing root-causes of Wi-Fi issues in a Wi-Fi system associated with a Local Area Network (LAN) are described in the present disclosure. A method, according to one embodiment, includes a step of monitoring a Wi-Fi system associated with a LAN to detect authentication failures in the Wi-Fi system. In response to detecting an authentication failure in the Wi-Fi system, the method also includes the step of analyzing the authentication failure to determine one or more root-causes of the authentication failure. The method also includes pushing changes to the Wi-Fi system to automatically remediate the one or more root-causes in the Wi-Fi system.

Architectures and techniques are presented that provide an improved mechanism for a subscriber entity to report to a network provider a network issue that affects the performance of an application that uses a service provided by the network provider. The improved mechanism can enable fine granularity with respect to the network issue by identifying the issue on a per-session basis. In response to feedback data that is reported by the subscriber entity, the network provider can perform self-healing or other upgrade techniques to rapidly remedy the network issue.

An alarm processing method and an alarm processing apparatus are provided. In the alarm processing method, an alarm reported by a Virtualized Network Function (VNF) is received; VNF Forwarding Graph (VNF FG) information of the VNF and/or Network Forwarding Path (NFP) information of the VNF is acquired; and alarm analysis processing is performed on the received alarm according to the VNF FG information and/or the NFP information acquired.

The disclosed computer-implemented method for debugging network nodes may include (1) detecting a computing event that is indicative of a networking malfunction within a network node, (2) determining, based at least in part on the computing event, one or more potential causes of the networking malfunction, (3) identifying one or more debugging templates that each define debugging steps that, when performed by a computing system, enable the computing system to determine whether the networking malfunction resulted from any of the potential causes, (4) performing a set of debugging steps defined by one of the debugging templates that corresponds to one of the potential causes, and then (5) determining, based at least in part on the set of debugging steps defined by the debugging template, that the networking malfunction resulted from the potential cause. Various other methods, systems, and apparatuses are also disclosed.

A method for managing alarms in a network includes identifying a first set of alarms based on data in a knowledge base, determining at least one attribute for each alarm in the first set of alarms, generating a model based on the at least one attribute, and applying the model to manage alarms in the network. The at least one attribute includes at least one of a persistence time for one or more alarms in the first set of alarms, an alarm group derived from the first set of alarms, and predictions for alarms in the first set of alarms. The model may be adaptively updated to track changing network conditions relating to the alarms.

Techniques for internet last-mile outage detection are disclosed herein. The techniques include methods for monitoring, by a network appliance associated with a network, a plurality of network nodes, detecting, by the network appliance, that a network node of the plurality of network nodes in a last mile of the network has disconnected from the network, overlaying, by the network appliance, the network node over a network model for at least a portion of the network including the network node to generate a model overlay, and determining, by the network appliance, a last mile outage source associated with a disconnection of the network node by identifying a lowest common ancestor node of the network node from the model overlay. Systems and computer-readable media are also provided.