Access point performance monitoring and anomaly detection based on temporal and spatial anomalies
During operation, a computer may compare values of at least one performance metric for access points in appropriate contexts to determine one or more temporal anomalies and/or one or more spatial anomalies for one or more of the access points. Then, the computer may generate one or more temporal anomaly events based at least in part on the one or more temporal anomalies and one or more spatial anomaly events based at least in part on the one or more spatial anomalies. Next, the computer may calculate one or more complex events based at least in part on two or more of the different anomalies. Moreover, the computer may evaluate the different anomalies, anomaly event and/or complex events to determine one or more insights about a problem in the network. Furthermore, the computer may perform a remedial action.
1. A computer, comprising:
an interface circuit configured to communicate with access points in a network;
a processor coupled to the interface circuit; and
memory, coupled to the processor, which stores program instructions, wherein, when executed by the processor, the program instructions cause the computer to perform operations comprising:
monitoring values of at least one performance metric associated with packet communication associated with the access points;
comparing the values of at least the one performance metric for the access points in multiple temporal contexts with historical values of at least the one performance metric to determine one or more temporal anomalies for one or more of the access points, wherein a given temporal anomaly comprises a deviation that is statistically significant based at least in part on a moment of a distribution of at least the one performance metric and a threshold value;
comparing the values of at least the one performance metric for the access points having a spatial context to determine one or more spatial anomalies for one or more of the access points, wherein a given spatial anomaly comprise a second deviation that is statistically significant based at least in part on a second moment of a second distribution associated with spatial locations of the access points and a second threshold value;
generating one or more temporal anomaly events based at least in part on the one or more temporal anomalies;
generating one or more spatial anomaly events based at least in part on the one or more spatial anomalies;
calculating one or more complex events based at least in part on two or more of the one or more temporal anomalies and the one or more spatial anomalies;
evaluating the one or more temporal anomaly events, the one or more spatial anomaly events, and the one or more complex events to determine one or more insights about a problem in the network; and
performing a remedial action associated with the problem based at least in part on the one or more insights.
2. The computer of claim 1 , wherein the spatial context comprises the access points having an environment with one or more common attributes.
3. The computer of claim 1 , wherein the multiple temporal contexts comprises one or more instances of a first time interval, a second time interval and a third time interval;
wherein the second time interval includes the first time interval and the third time interval includes the second time interval.
4. The computer of claim 1 , wherein the one or more temporal anomalies corresponding to the multiple temporal contexts are determined using different thresholds.
5. The computer of claim 1 , wherein the one or more temporal anomalies and the one or more spatial anomalies are determined concurrently.
6. The computer of claim 1 , wherein the one or more temporal anomalies are based at least in part on a temporal anomaly direction.
7. The computer of claim 1 , wherein, when at least the one performance metric corresponds to a ratio, the operations comprise computing adjusted values of at least the one performance metric based at least in part on the values of at least the one performance metric and the historical values of at least the one performance metric; and
wherein the one or more temporal anomalies or the one or more spatial anomalies are determined using the adjusted values instead of the values.
8. The computer of claim 1 , wherein the one or more temporal anomaly events correspond to one or more temporal clusters of the one or more temporal anomalies, and the one or more spatial anomaly events correspond to one or more spatial clusters of the one or more spatial anomalies.
9. The computer of claim 1 , wherein the one or more temporal anomalies are based at least in part on median absolute deviations of the values.
10. The computer of claim 1 , wherein the one or more temporal anomaly events are generated based at least in part on superpositions of instances of a kernel function at the one or more temporal anomalies and a threshold.
11. The computer of claim 1 , wherein the one or more insights comprise or correspond to one or more of: analysis in a time window; analysis of different potential problems in the network; or identification of the problem.
12. The computer of claim 1 , wherein the remedial action comprises: a recommendation about the problem, a notification about the problem, a report with computed results associated with the problem, or a corrective action in the network associated with the problem.
13. The computer of claim 12 , wherein the corrective action comprises: updating firmware, rebooting or providing another type of feedback to at least one of the access points.
14. A non-transitory computer-readable storage medium for use in conjunction with a computer, the computer-readable storage medium storing program instructions, wherein, when executed by the computer, the program instructions cause the computer to perform operations comprising:
monitoring values of at least one performance metric associated with packet communication associated with access points in a network;
comparing the values of at least the one performance metric for the access points in multiple temporal contexts with historical values of at least the one performance metric to determine one or more temporal anomalies for one or more of the access points, wherein a given temporal anomaly comprises a deviation that is statistically significant based at least in part on a moment of a distribution of at least the one performance metric and a threshold value;
comparing the values of at least the one performance metric for the access points having a spatial context to determine one or more spatial anomalies for one or more of the access points, wherein a given spatial anomaly comprise a second deviation that is statistically significant based at least in part on a second moment of a second distribution associated with spatial locations of the access points and a second threshold value;
generating one or more temporal anomaly events based at least in part on the one or more temporal anomalies;
generating one or more spatial anomaly events based at least in part on the one or more spatial anomalies;
calculating one or more complex events based at least in part on two or more of the one or more temporal anomalies and the one or more spatial anomalies;
evaluating the one or more temporal anomaly events, the one or more spatial anomaly events, and the one or more complex events to determine one or more insights about a problem in the network; and
performing a remedial action associated with the problem based at least in part on the one or more insights.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the spatial context comprises the access points having an environment with one or more common attributes.
16. The non-transitory computer-readable storage medium of claim 14 , wherein the one or more temporal anomalies corresponding to the multiple temporal contexts are determined using different thresholds.
17. The non-transitory computer-readable storage medium of claim 14 , wherein the one or more temporal anomaly events correspond to one or more temporal clusters of the one or more temporal anomalies, and the one or more spatial anomaly events correspond to one or more spatial clusters of the one or more spatial anomalies.
18. The non-transitory computer-readable storage medium of claim 14 , wherein the one or more temporal anomaly events are generated based at least in part on superpositions of instances of a kernel function at the one or more temporal anomalies and a threshold.
19. The non-transitory computer-readable storage medium of claim 14 , wherein the one or more insights comprise or correspond to one or more of: analysis in a time window; analysis of different potential problems in the network; or identification of the problem.
20. A method for performing a remedial action, comprising:
monitoring, by a computer, values of at least one performance metric associated with packet communication associated with access points in a network;
comparing, by the computer, the values of at least the one performance metric for the access points in multiple temporal contexts with historical values of at least the one performance metric to determine one or more temporal anomalies for one or more of the access points, wherein a given temporal anomaly comprises a deviation that is statistically significant based at least in part on a moment of a distribution of at least the one performance metric and a threshold value;
comparing, by the computer, the values of at least the one performance metric for the access points having a spatial context to determine one or more spatial anomalies for one or more of the access points, wherein a given spatial anomaly comprise a second deviation that is statistically significant based at least in part on a second moment of a second distribution associated with spatial locations of the access points and a second threshold value;
generating, by the computer, one or more temporal anomaly events based at least in part on the one or more temporal anomalies;
generating, by the computer, one or more spatial anomaly events based at least in part on the one or more spatial anomalies;
calculating, by the computer, one or more complex events based at least in part on two or more of the one or more temporal anomalies and the one or more spatial anomalies;
evaluating, by the computer, the one or more temporal anomaly events, the one or more spatial anomaly events, and the one or more complex events to determine one or more insights about a problem in the network; and
performing, by the computer, the remedial action associated with the problem based at least in part on the one or more insights.