Granted Patent B2

US 12,652,213 · App. 18/478,883 · Granted Jun 9, 2026

Inventors: Quenie Sun (Westford, MA); Erdem Uysal (Westford, MA); Steve Loker (Westford, MA); Greg Mayo (Westford, MA)

Assignee: NetScout Systems, Inc.

H04L41/0631H04L1/0061

Abstract

Claims (77)

1 . A method comprising:

detecting, by one or more processors, a failure condition on a network;

identifying, by the one or more processors, a subset of subscribers impacted by the failure condition;

determining, by the one or more processors, for each subscriber in the subset of subscribers a first set of error codes associated with the failure condition;

creating, by the one or more processors, a Bayesian network comprising one or more error codes from the first set of error codes of each subscriber in the subset of subscribers;

accessing, by the one or more processors, a correlation matrix which indicates a plurality of correlations within a third set of error codes, wherein at least one error code of the first set of error codes is included in the third set of error codes, and wherein respective correlations of the plurality of correlations identify particular error codes within the third set of error codes that cause other particular error codes within the third set of error codes based on computed correlation coefficients;

wherein the plurality of correlations are determined based on computing, by the one or more processors, a correlation coefficient between each error code in the third set of error codes and remaining error codes in the third set of error codes, wherein the correlation matrix is created based on each correlation coefficient, the correlation matrix identifying which error codes in the third set of error codes are correlated, wherein the correlation matrix identifies error code-to-error code causation relationships, and wherein error codes having a correlation coefficient greater than a predetermined threshold are identified as correlated;

identifying, by the one or more processors, using the correlation matrix, a first correlation of the plurality of correlations that relates one or more error codes in the third set of error codes to the at least one error code of the first set of error codes;

determining, by the one or more processors, a second set of error codes from the third set of error codes based on the first correlation; and

resolving, by the one or more processors, at least one of the failure condition or the first set of error codes by addressing one or more error codes of the second set of error codes.

2 . The method of claim 1 , further comprising:

determining, by the one or more processors, the third set of error codes associated with the network; and

filtering, by the one or more processors, the Bayesian network based on the correlation matrix.

3 . The method of claim 2 , wherein the Bayesian network comprises a plurality of nodes, the plurality of nodes comprising a first node having a connection to a second node, the first node is associated with a first error code and the second node is associated with a second error code, and wherein filtering the Bayesian network comprises:

determining, by the one or more processors, from the correlation matrix that the first error code is not correlated to the second error code; and

deleting, by the one or more processors, the connection between the first node and the second node.

4 . The method of claim 1 , further comprising:

updating, by the one or more processors, the Bayesian network upon creation, wherein updating the Bayesian network comprises:

identifying, by the one or more processors, at least one node in the Bayesian network that is part of a loop in the Bayesian network; and

combining, by the one or more processors, each of the at least one node that is part of the loop into a single node.

5 . The method of claim 1 , further comprising:

generating, by the one or more processors, a message comprising the second set of error codes;

enriching, by the one or more processors, the message with error group information to obtain an enriched message; and

presenting, by the one or more processors, the enriched message to a user.

6 . The method of claim 1 , wherein the failure condition is a first failure condition that occurs in a first part of the network, wherein the second set of error codes are associated with a second failure condition in a second part of the network, and wherein the second set of error codes are related to, or cause, the first failure condition based on the subset of subscribers.

7 . A system, comprising:

one or more memories having computer-readable instructions stored thereon; and

one or more processors that execute the computer-readable instructions to:

detect a failure condition on a network;

identify a subset of subscribers impacted by the failure condition;

determine for each subscriber in the subset of subscribers a first set of error codes associated with the failure condition;

create a Bayesian network comprising one or more error codes from the first set of error codes of each subscriber in the subset of subscribers;

access a correlation matrix which indicates a plurality of correlations within a third set of error codes, wherein at least one error code of the first set of error codes is included in the third set of error codes, and wherein respective correlations of the plurality of correlations identify particular error codes within the third set of error codes that cause other particular error codes within the third set of error codes based on computed correlation coefficients;

wherein the plurality of correlations are determined based on computing a correlation coefficient between each error code in the third set of error codes and remaining error codes in the third set of error codes, wherein the correlation matrix is created based on each correlation coefficient, the correlation matrix identifying which error codes in the third set of error codes are correlated, wherein the correlation matrix identifies error code-to-error code causation relationships, and wherein error codes having a correlation coefficient greater than a predetermined threshold are identified as correlated;

identify, using the correlation matrix, a first correlation of the plurality of correlations that relates one or more error codes in the third set of error codes to the at least one error code of the first set of error codes;

determine a second set of error codes from the third set of error codes based on the first correlation; and

resolve at least one of the failure condition or the first set of error codes by addressing one or more error codes of the second set of error codes.

8 . The system of claim 7 , wherein the one or more processors further execute the computer-readable instructions to:

determine the third set of error codes associated with the network;

determine correlations within the third set of error codes by computing correlation coefficients between error codes within the third set of error codes; and

update the Bayesian network based on the correlations.

9 . The system of claim 8 , wherein the Bayesian network comprises a plurality of nodes, the plurality of nodes comprising a first node having a connection to a second node, the first node is associated with a first error code and the second node is associated with a second error code, and wherein to update the Bayesian network, the one or more processors further execute the computer-readable instructions to:

determine from the correlation matrix that the first error code is not correlated to the second error code; and

delete the connection between the first node and the second node.

10 . The system of claim 7 , wherein the one or more processors further execute the computer-readable instructions to:

update the Bayesian network upon creation, wherein updating the Bayesian network comprises:

identify at least one node in the Bayesian network that is part of a loop in the Bayesian network; and

combine each of the at least one node that is part of the loop into a single node.

11 . The system of claim 7 , wherein the one or more processors further execute the computer-readable instructions to:

generate a message comprising the second set of error codes;

enrich the message with error group information to obtain an enriched message; and

present the enriched message to a user.

12 . A non-transitory computer-readable media comprising computer-readable instructions stored thereon that, when executed by one or more processors, cause the one or more processors to:

detect a failure condition on a network;

identify a subset of subscribers impacted by the failure condition;

determine for each subscriber in the subset of subscribers a first set of error codes associated with the failure condition;

create a Bayesian network comprising one or more error codes from the first set of error codes of each subscriber in the subset of subscribers;

access a correlation matrix which indicates a plurality of correlations within a third set of error codes, wherein at least one error code of the first set of error codes is included in the third set of error codes, and wherein respective correlations of the plurality of correlations identify particular error codes within the third set of error codes that cause other particular error codes within the third set of error codes based on computed correlation coefficients;

wherein the plurality of correlations are determined based on computing a correlation coefficient between each error code in the third set of error codes and remaining error codes in the third set of error codes, wherein the correlation matrix is created based on each correlation coefficient, the correlation matrix identifying which error codes in the third set of error codes are correlated, wherein the correlation matrix identifies error code-to-error code causation relationships, and wherein error codes having a correlation coefficient greater than a predetermined threshold are identified as correlated;

identify, using the correlation matrix, a first correlation of the plurality of correlations that relates one or more error codes in the third set of error codes to the at least one error code of the first set of error codes;

determine a second set of error codes from the third set of error codes based on the first correlation; and

resolve at least one of the failure condition or the first set of error codes by addressing one or more error codes of the second set of error codes.

13 . The non-transitory computer-readable media of claim 12 , wherein the one or more processors further execute the computer-readable instructions to:

determine the third set of error codes associated with the network;

determine correlations within the third set of error codes by computing correlation coefficients between error codes within the third set of error codes; and

update the Bayesian network based on the correlations.

14 . The non-transitory computer-readable media of claim 13 , wherein the Bayesian network comprises a plurality of nodes, the plurality of nodes comprising a first node having a connection to a second node, the first node is associated with a first error code and the second node is associated with a second error code, and wherein to update the Bayesian network, the one or more processors further execute the computer-readable instructions to:

determine from the correlation matrix that the first error code is not correlated to the second error code; and

delete the connection between the first node and the second node.

15 . The non-transitory computer-readable media of claim 12 , wherein the one or more processors further execute the computer-readable instructions to:

update the Bayesian network upon creation, wherein updating the Bayesian network comprises:

identify at least one node in the Bayesian network that is part of a loop in the Bayesian network; and

combine each of the at least one node that is part of the loop into a single node.

16 . The non-transitory computer-readable media of claim 12 , wherein the one or more processors further execute the computer-readable instructions to:

generate a message comprising the second set of error codes;

enrich the message with error group information to obtain an enriched message; and

present the enriched message to a user.

Assignments (2)

Continuity (1)

References Cited (45)