A diagnosis method and a diagnostic device for a network are disclosed. The network includes at least one network device. The network device is connected to the network. The network device has an operating hours counter, which outputs a time information relating to an operating time. The network device is re-connected to the network following a connection failure with the network at a connection failure instant. The method includes determining an operating time of an operating hours counter configured in a network device of the network to output a time information relating to the operating time, determining a connection failure time of the network device to the network at a connection failure instant until connection to the network is established and determining a reason for the connection failure using a comparison between the operating time and the connection failure time.

Methods are provided for both single modal and multimodal fault diagnosis. In a method, a fault fingerprint is constructed based on a fault event using an invariant model. A similarity matrix between the fault fingerprint and one or more historical representative fingerprints are derived using dynamic time warping and at least one convolution. A feature vector in a feature subspace for the fault fingerprint is generated. The feature vector includes at least one status of at least one system component during the fault event. A corrective action correlated to the fault fingerprint is determined. The corrective action is initiated on a hardware device to mitigate expected harm to at least one item selected from the group consisting of the hardware device, another hardware device related to the hardware device, and a person related to the hardware device.

Embodiments of this disclosure provide a trouble diagnosis method and apparatus and a system. The method includes: acquiring channel-related information on a coordinator and terminal equipment in communication with the coordinator; selecting multiple indices in the channel-related information, and calculating statistical values of the multiple indices in a predetermined period of time; and performing trouble diagnosis by using the statistical values and pre-stored training data, so as to obtain a trouble diagnosis result corresponding to the period of time. In the embodiments of this disclosure, by collecting the channel-related information on the coordinator and the terminal equipment in communication with the coordinator, doing statistics on the collected channel-related information, so as to perform trouble diagnosis by using a machine learning method, which may diagnose different troubles, and network service providers may make some countermeasures to solve the problem or avoid potential problems accordingly.

A network device such as a router or switch, in one embodiment, includes a timing analyzer which is capable of providing timing analysis over one or more network circuits. The timing analyzer, in one aspect, receives a data packet traveling across a circuit emulation service (“CES”) circuit such as T1 or E1 circuit. Upon obtaining an arrival timestamp associated with the data packet, the arrival timestamp is stored in a timestamp buffer in accordance with a first-in first-out (“FIFO”) storage sequence. After identifying the oldest arrival timestamp in the timestamp buffer, an offset is generated based on the result of comparison between the arrival timestamp and the oldest timestamp. The timing analyzer can also be configured to generate timing reports on-demand based on generated offset(s).

According to an aspect, there is provided a local diagnosis system comprising means for performing the following. The local diagnosis system detects one or more anomaly events associated with a communications network. Each anomaly event defines an anomaly pattern describing a data point in a performance indicator space. Then, the local diagnosis system updates one or more local cluster models to incorporate the one or more anomaly patterns within complexity constraints. Each of the one or more local cluster models corresponds to a different diagnosis label defining a diagnosis. In response to failing according to one or more per-defined criteria to incorporate, in the updating, the one or more anomaly patterns to the one or more local cluster models, the local diagnosis system forwards at least the one or more local cluster models and one or more associated diagnosis labels to a central diagnosis system for further diagnosis.

A method for managing alarms in a network includes identifying a first set of alarms based on data in a knowledge base, determining at least one attribute for each alarm in the first set of alarms, generating a model based on the at least one attribute, and applying the model to manage alarms in the network. The at least one attribute includes at least one of a persistence time for one or more alarms in the first set of alarms, an alarm group derived from the first set of alarms, and predictions for alarms in the first set of alarms. The model may be adaptively updated to track changing network conditions relating to the alarms.

A method, Request Router and Traffic Monitor for monitoring a Content Delivery Network effecting requests routing toward delivery nodes (DNs) without using a load balancer and achieving high availability. Iteratively, for each delivery node, sending a monitoring request to the delivery node. If a response indicative of success of the monitoring request is received from the delivery node before the end of a first time interval, setting a status of the delivery node to indicate success. If a response indicative of failure is received before the end of the first time interval, setting the status to indicate failure. If no response is received before the end of the first time interval, setting the status to indicate indetermination. Iteratively, at a second time interval, taking a snapshot of the statuses of the delivery nodes and producing a list of DNs with their statuses to be sent to the RR.

Historical telemetry data can be used to generate predictions for various classes of data at various aggregates of a system that implements an online service. An anomaly detection process can then be utilized to detect anomalies for a class of data at a selected aggregate. An example anomaly detection process includes receiving telemetry data originating from a plurality of client devices, selecting a class of data from the telemetry data, converting the class of data to a set of metrics, aggregating the set of metrics according to a component of interest to obtain values of aggregated metrics over time for the component of interest, determining a prediction error by comparing the values of the aggregated metrics to a prediction, detecting an anomaly based at least in part on the prediction error, and transmitting an alert message of the anomaly to a receiving entity.

Methods and systems for providing data analytics and generating real-time and historical views of network events using a single processing pipeline, managed by a single code base, are presented. A computing device may receive a stream of data indicative of a plurality of events occurring on a network. The computing device may process the stream of data to generate intermediate data and batch data using the single processing pipeline. The intermediate data may be available to generate historical views and the batch data may include a plurality of intermediate data for a time interval. The computing device may generate a historical view of the events based on a subset of intermediate data and the batch data. Finally, the computing device may provide the historical view to a processing layer to enable the computing device to respond to requests for information about the network.

Generally described, systems and methods are provided for detecting the impact of network failures. The system collects performance information from a plurality of nodes and links in a network, aggregates the collected performance information across paths in the network, processes the aggregated performance information for detecting failures on the paths, adjusts the set of performance information by removing the performance information for any nodes considered to be associated with performance information that is statistically different from performance information from other nodes at a given location or extrapolates the collected information to other paths, and determines the impact to customers of the network failures detected using the adjusted set of performance information.