A method of managing a controller of a software defined networking (SDN) network is implemented by a computing device in the SDN network. The method includes receiving status information for the controller, receiving usage information for the operating environment, generating at least one failure prediction for the controller based on the received status information, and outputting prediction information for the at least one failure prediction.

Techniques are described in which a network management system (NMS) is configured to determine a root cause of degraded network performance based on SLE metrics and the locations associated with network devices providing the SLE metrics. The NMS can determine service level experience (SLE) metrics associated with each client device on a network and location data for each client device of the plurality of client devices. The NMS can generate a time series of parameter vectors, where each parameter vector includes SLE metrics corresponding to each client device of the plurality of client devices. Each parameter vector is associated with the location of the client device corresponding to the SLE metrics. The NMS can determine, based on the time series of parameter vectors and associated locations, a root cause for a degradation in SLE metrics associated with the one or more of the client devices.

This disclosure describes systems, devices, and techniques for determining a root cause of anomalous events in a networked computing environment. A node detects an alert corresponding to an anomalous event during a time period. The alert is correlated with previously detected alerts occurring within the time period and a causal relationship associated with nodes in the networked computing environment. The node may then recursively identify a root cause of the anomalous event detected in the networked computing environment based on a set of correlated alerts. An incident ticket may then be sent to the node identified as the root cause of the anomalous event, and the node may notify other nodes in the network having a causal relationship with the node of the anomalous event.

The claimed system and method describes a root cause analysis system for a radio access network. Some aspects include automatic identification of possible causes for network issues, their ranking, determination of the root (main) cause and execution of related best actions, alerts and reporting in order to automatically identify, mitigate or eliminate the problem.

Provided herein are systems and methods for determining relationships between events occurring in networks. Notifications describing events occurring in networks can be received and processed to determine groups of network event types. A root-cause network can be generated based on the events, with the nodes of the root-cause network representing different event types and the edges of the root-cause network indicating directional, causal relationships between the nodes. A received network event can be processed to determine potential causes of the received network event based on the root-cause network and other events received by the network.

The disclosure describes techniques for detecting network measurement inaccuracies through the detection of sender delays or packet drops. For example, a sender device of a test packet may determine whether the sender device is experiencing any issues in sending the test packet to a receiver device and notify a controller of the issues such that the controller may generate an indication that one or more Key Performance Indicator (KPI) measurements based on the test packets from the sender device are inaccurate and/or untrustworthy, remove the inaccurate KPI measurements, and/or adjust the inaccurate KPI measurements.

A method for correlating discarded network traffic with network policy events in a network includes receiving a flow record. The flow record includes initial network flow information in a standard flow record format. Discarded network traffic information associated with each network policy is received from a network policy enforcement device. Network traffic is discarded based on a network traffic policy. The received flow record is correlated with the received discarded network traffic information. The discarded network traffic information is encoded into the received flow record based on the correlation while maintaining the initial network flow information to yield an enhanced flow record.

A method for detecting anomalies in one or more network performance metrics stream for one or more monitored object comprising using a discrete window on the stream to extract a motif from said stream for a first of said network performance metric for a first of said monitored object. Maintaining an abnormal and a normal cluster center of historical time series for said first network performance metric for said first monitored object. Classifying said motif based on a distance between said new time series and said abnormal and said normal cluster center. Determining whether an anomaly for said motif occurred based on said distance and a predetermined decision boundary.

Systems and methods for detection, characterization, prediction, and next occurrence prediction of approximately periodic chain of events with missing occurrences using pattern recognition obtaining data from monitoring a system, wherein the data includes a plurality of records each includes at least a start time and a unique identifier; analyzing the plurality of records to detect a periodic chain of events, wherein the periodic chain of events includes clear or approximate periodicity that is detected based on a plurality of parameters including some missing occurrences therein; converting the periodic chain of events into a binary sequence with each bit representing a time bin and having a value based on a presence or absence of an event in the time bin; and analyzing the binary sequence to recognize a pattern therein to determine a next occurrence of an event in the periodic chain of events.

The invention concerns a method and a system for determining root-cause diagnosis of events occurring during the operation of a communication network comprising monitoring time signals representative of the operation of the network to detect the occurrence of an event relative to the network traffic, and for each detected event, during the duration of said event obtaining distributions of data on several dimensions of the network linked to said event, automatically determining an event root-cause diagnosis of the detected event, called single event diagnosis, comprising at least one element of said distributions, an element being a value taken by a network dimension having a contribution in said distributions of data, the single event diagnosis determination using rules of business logic configuration organized hierarchically, which are applied according to said hierarchy to select at least one element of said distributions, the selection of more than one element comprising machine learning clustering.