Deep fusion reasoning engine (DFRE) for prioritizing network monitoring alerts
In one embodiment, a service that monitors a network detects a plurality of anomalies in the network. The service uses data regarding the detected anomalies as input to one or more machine learning models. The service maps, using a conceptual space, outputs of the one or more machine learning models to symbols. The service applies a symbolic reasoning engine to the symbols, to rank the anomalies. The service sends an alert for a particular one of the detected anomalies to a user interface, based on its corresponding rank.
1. A method comprising:
detecting, by a service that monitors a network, a plurality of anomalies in the network;
using, by the service, data regarding the detected anomalies as input to one or more machine learning models;
mapping, by the service and using a conceptual space comprising an impact reference sub-concept and an impact context sub-concept, outputs of the one or more machine learning models to symbols, wherein the impact reference sub-concept models one or more of: temporal characteristics of a detected anomaly, a location of a detected anomaly in the network, or a nature of a detected anomaly in the network, and wherein the impact context sub-concept models one or more of: an intent associated with a detected anomaly, or a scope of a detected anomaly;
applying, by the service, a symbolic reasoning engine to the symbols, to rank the anomalies; and
sending, by the service, an alert for a particular one of the detected anomalies to a user interface, based on its corresponding rank.
2. The method as in claim 1 , wherein detecting the plurality of anomalies in the network comprises:
using telemetry data from the network as input to one or more machine learning-based anomaly detectors.
3. The method as in claim 1 , wherein one or more machine learning models comprise a deep learning model or hierarchical temporal memory (HTM) model.
4. The method as in claim 1 , further comprising:
receiving, at the service, feedback from the user interface regarding relevance of the alert; and
updating one of the machine learning models using the feedback, wherein the updated model predicts which of the data regarding the detected anomalies is of interest to a user of the user interface.
5. The method as in claim 1 , wherein the symbolic reasoning engine is non-axiomatic.
6. The method as in claim 1 , wherein the one or more machine learning models comprise one or more of: a device, feature, or network model, an impact model, or a solution model.
7. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
detect a plurality of anomalies in the network;
use data regarding the detected anomalies as input to one or more machine learning models;
map, using a conceptual space comprising an impact reference sub-concept and an impact context sub-concept, outputs of the one or more machine learning models to symbols wherein the impact reference sub-concept models one or more of: temporal characteristics of a detected anomaly, a location of a detected anomaly in the network, or a nature of a detected anomaly in the network, and wherein the impact context sub-concept models one or more of: an intent associated with a detected anomaly, or a scope of a detected anomaly;
apply a symbolic reasoning engine to the symbols, to rank the anomalies; and
send an alert for a particular one of the detected anomalies to a user interface, based on its corresponding rank.
8. The apparatus as in claim 7 , wherein the apparatus detects the plurality of anomalies in the network by:
using telemetry data from the network as input to one or more machine learning-based anomaly detectors.
9. The apparatus as in claim 7 , wherein one or more machine learning models comprise a deep learning model or hierarchical temporal memory (HTM) model.
10. The apparatus as in claim 7 , wherein the process when executed is further configured to:
receive feedback from the user interface regarding relevance of the alert; and
update one of the machine learning models or a reasoning system knowledge representation using the feedback, wherein the updated model predicts which of the data regarding the detected anomalies is of interest to a user of the user interface.
11. The apparatus as in claim 7 , wherein the symbolic reasoning engine is non-axiomatic.
12. The apparatus as in claim 7 , wherein the process when executed is further configured to:
rank an alert regarding a diagnostic output or matched pattern in the network.
13. A tangible, non-transitory, computer-readable medium storing program instructions that cause a service that monitors a network to execute a process comprising:
detecting, by the service that monitors the network, a plurality of anomalies in the network;
using, by the service, data regarding the detected anomalies as input to one or more machine learning models;
mapping, by the service and using a conceptual space comprising an impact reference sub-concept and an impact context sub-concept, outputs of the one or more machine learning models to symbols, wherein the impact reference sub-concept models one or more of: temporal characteristics of a detected anomaly, a location of a detected anomaly in the network, or a nature of a detected anomaly in the network, and wherein the impact context sub-concept models one or more of: an intent associated with a detected anomaly, or a scope of a detected anomaly;
applying, by the service, a symbolic reasoning engine to the symbols, to rank the anomalies; and
sending, by the service, an alert for a particular one of the detected anomalies to a user interface, based on its corresponding rank.