Predictive bad event alert generation
Segments of a network having connectivity issues are detected in a network environment that may include one or more cloud computing platforms. A mutual information algorithm is used to determine relevance of network element factors, a subset of factors are selected based on relevance, and clustered according to values for the subset of factors, and quality of the clusters evaluated. Various thresholds for selecting the subset of factors may be used to determine which provides improved cluster quality. An approach for performing root cause analysis of events in a network environment selects bad events for logging alerts based on whether a factor is found to distinguish bad events according to a mutual information algorithm. Events for alerts may be aggregated based on temporal proximity or similarity. Visualization may be performed using Sankey diagrams with each column representing a factor.
1 . A method comprising:
monitoring, by a computer system, a time window of events over time from a plurality of nodes in a network environment to detect bad events, wherein each event comprises a plurality of factors;
in response to detection of a bad event, determining whether to generate a bad event alert, wherein determining whether to generate a bad event alert comprises,
maintaining counts of bad and benign events observed in a current time window and determining whether a ratio of bad events within the current time window satisfies a first threshold;
based on determining that the ratio of bad events within the current time window does not satisfy the first threshold,
determining with trained machine learning models bad events predicted for the current time window across an organization and bad events predicted for at least one of a user and a team for the current time window, wherein the trained machine learning models comprise at least one of regression models and neural network models;
aggregating counts of the predicted bad events;
determining whether the aggregated counts satisfies a second threshold; and
based on determining that the aggregated counts satisfies the second threshold, calculating, according to a mutual information algorithm that uses recursive adaptive partitions for the plurality of factors, relevance of each of the plurality of factors of each event observed within the current time window with respect to the event being a bad event type or a benign event type;
determining, by the computer system, that a maximum relevance of the relevancies of the plurality of factors exceeds a maximum relevance threshold and generating a bad event alert based on the determination; and
in response to generating the bad event alert, logging a bad event alert.
2 . The method of claim 1 , further comprising generating a visualization of the bad event alert.
3 . The method of claim 2 , wherein the visualization is a Sankey diagram.
4 . The method of claim 3 , wherein each column of the Sankey diagram represents a factor of the plurality of factors.
5 . The method of claim 1 , wherein the bad event alert is a first bad event alert, the method further comprising:
determining, by the computer system, that the first bad event alert meets one of a temporal proximity threshold and a similarity threshold with respect to a previously generated second bad event alert; and
in response to determining that the first bad event alert meets one of the temporal proximity threshold and the similarity threshold with respect to the second bad event alert, aggregating the first bad event alert with the second bad event alert.
6 . The method of claim 5 , wherein the second bad event alert corresponds to a preceding time window.
7 . The method of claim 6 , further comprising:
performing, by the computer system, the mutual information algorithm with respect to events of the plurality of events in the preceding time window;
selecting, by the computer system, a subset of factors of the plurality of factors based on an output of the mutual information algorithm; and
generating, by the computer system, a visualization of values for the subset of factors for the events corresponding to the first bad event alert and the second bad event alert.
8 . The method of claim 1 , wherein aggregating counts of the predicted bad events comprises averaging count of the predicted bad events across the organization and count of the predicted bad events of the user or the team or selecting a maximum of the count of the predicted bad events across the organization and the count of the predicted bad events of the user or the team.
9 . The method of claim 1 , wherein the trained machine learning models were trained to forecast a predicted count of bad events based on event statistics, wherein a first of the trained machine learning models was trained with event statistics for the organization and a second of the trained machine learning models was trained with event statistics for the user or the team.
10 . The method of claim 9 , wherein event statistics comprise time-series of counts of bad events in different time windows and at least one of number of requests per time window, number of distinct domain identifiers per time window, and number of distinct user identifiers per time window.
11 . The method of claim 1 further comprising determining that a minimum number of requests have been received by the nodes within the current time window, wherein determining whether a ratio of bad events within the current time window satisfies a first threshold is dependent on determining that the minimum number of request have been received.
12 . A non-transitory, computer-readable medium having stored thereon program code comprising instructions to:
monitor a time window of events over time from a plurality of nodes in a network environment to detect bad events, wherein each event comprises a plurality of factors;
in response to detection of a bad event, determine whether to generate a bad event alert, wherein the instructions to determine whether to generate a bad event alert comprise instructions to,
maintain counts of bad and benign events observed in a current time window and determine whether a ratio of bad events within the current time window satisfies a first threshold;
based on a determination that the ratio of bad events within the current time window does not satisfy the first threshold,
determine with trained machine learning models bad events predicted for the current time window across an organization and bad events predicted for at least one of a user and a team for the current time window, wherein the trained machine learning models comprise at least one of regression models and neural network models;
aggregate counts of the predicted bad events;
determine whether the aggregated counts satisfies a second threshold; and
based on determining that the aggregated counts satisfies the second threshold, calculate, according to a mutual information algorithm that uses recursive adaptive partitions for the plurality of factors, relevance of each of the plurality of factors of each event observed within the current time window with respect to the event being a bad event type or a benign event type;
determine whether a maximum relevance of the relevancies of the plurality of factors exceeds a maximum relevance threshold and generate a bad event alert based on a determination that the maximum relevance of the relevancies of the plurality of factors exceeds the maximum relevance threshold; and
in response to generating the bad event alert, logging a bad event alert.
13 . The non-transitory, computer-readable medium of claim 12 , wherein the instructions to aggregate counts of the predicted bad events comprise instructions to average count of the predicted bad events across the organization and count of the predicted bad events of the user or the team or instructions to select a maximum of the count of the predicted bad events across the organization and the count of the predicted bad events of the user or the team.
14 . The non-transitory, computer-readable medium of claim 12 , wherein the trained machine learning models were trained to forecast a predicted count of bad events based on event statistics, wherein a first of the trained machine learning models was trained with event statistics for the organization and a second of the trained machine learning models was trained with event statistics for the user or the team.
15 . The non-transitory, computer-readable medium of claim 14 , wherein event statistics comprise time-series of counts of bad events in different time windows and at least one of number of requests per time window, number of distinct domain identifiers per time window, and number of distinct user identifiers per time window.
16 . The non-transitory, computer-readable medium of claim 12 , wherein the program code further comprises instructions to determine whether a minimum number of requests have been received by the nodes within the current time window, wherein the instructions to determine whether a ratio of bad events within the current time window satisfies a first threshold execute based on a determination that the minimum number of request have been received.
17 . The non-transitory, computer-readable medium of claim 12 , wherein the program code further comprises instructions to generate a visualization of the bad event alert, wherein the visualization is a Sankey diagram and each column of the Sankey diagram represents a factor of the plurality of factors.
18 . An apparatus comprising:
a processor; and
a computer-readable medium having stored thereon instructions executable by the processor to cause the apparatus to,
monitor a time window of events over time from a plurality of nodes in a network environment to detect bad events, wherein each event comprises a plurality of factors;
in response to detection of a bad event, determine whether to generate a bad event alert, wherein the instructions to determine whether to generate a bad event alert comprise instructions executable by the processor to cause the apparatus to,
maintain counts of bad and benign events observed in a current time window and determine whether a ratio of bad events within the current time window satisfies a first threshold;
based on a determination that the ratio of bad events within the current time window does not satisfy the first threshold,
determine with trained machine learning models bad events predicted for the current time window across an organization and bad events predicted for at least one of a user and a team for the current time window, wherein the trained machine learning models comprise at least one of regression models and neural network models;
aggregate counts of the predicted bad events;
determine whether the aggregated counts satisfies a second threshold; and
based on determining that the aggregated counts satisfies the second threshold, calculate, according to a mutual information algorithm that uses recursive adaptive partitions for the plurality of factors, relevance of each of the plurality of factors of each event observed within the current time window with respect to the event being a bad event type or a benign event type;
determine whether a maximum relevance of the relevancies of the plurality of factors exceeds a maximum relevance threshold and generate a bad event alert based on a determination that the maximum relevance of the relevancies of the plurality of factors exceeds the maximum relevance threshold; and
in response to generating the bad event alert, logging a bad event alert.
19 . The apparatus of claim 18 , wherein the instructions to aggregate counts of the predicted bad events comprise instructions executable by the processor to cause the apparatus to average count of the predicted bad events across the organization and count of the predicted bad events of the user or the team or instructions to select a maximum of the count of the predicted bad events across the organization and the count of the predicted bad events of the user or the team.
20 . The apparatus of claim 18 , wherein the trained machine learning models were trained to forecast a predicted count of bad events based on event statistics, wherein a first of the trained machine learning models was trained with event statistics for the organization and a second of the trained machine learning models was trained with event statistics for the user or the team.
21 . The apparatus of claim 20 , wherein event statistics comprise time-series of counts of bad events in different time windows and at least one of number of requests per time window, number of distinct domain identifiers per time window, and number of distinct user identifiers per time window.
22 . The apparatus of claim 18 , wherein the computer-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to determine whether a minimum number of requests have been received by the nodes within the current time window, wherein the instructions to determine whether a ratio of bad events within the current time window satisfies a first threshold execute based on a determination that the minimum number of requests have been received.
23 . The apparatus of claim 18 , wherein the program code further comprises instructions to generate a visualization of the bad event alert, wherein the visualization is a Sankey diagram and each column of the Sankey diagram represents a factor of the plurality of factors.