Deriving highly interpretable cognitive patterns for network assurance

1. A method comprising:

labeling, by a network assurance system that monitors a network, time periods with positive labels, each positively-labeled time period being indicative of the network assurance system having detected a problem in the network during the corresponding time period;

assigning, by the network assurance system, categorical tags to discrete portions of a feature space comprising an aggregation of network measurements from the monitored network, based on whether a particular range of values in the feature space has a threshold probability of occurring during any of the positively-labeled time periods in which problems are detected in the network by applying a machine learning, decision tree-based classifier to the feature space to determine an association between the particular range of values in the feature space and the detected problems;

determining, by the network assurance system, a set of the assigned categorical tags that frequently co-occur with the positively-labeled time periods in which problems are detected in the network based on one or more predictive strength metrics indicative of a strength of an association between any of the assigned categorical tags and any of the positively-labeled time periods; and

causing, by the network assurance system, performance of a mitigation action in the network based on the set of assigned categorical tags that frequently co-occur with the positively-labeled time periods.

2. The method as in claim 1 , wherein the measurements obtained from the monitored network comprise one or more of: wireless interference, dropped packets, traffic volume, throughput, or an endpoint client count in the network.

3. The method as in claim 1 , wherein the mitigation action comprises providing an indication of the assigned tags that frequently co-occur with the positively-labeled time periods as one or more natural language sentences.

4. The method as in claim 1 , wherein labeling the time periods with positive labels, based on the network assurance system detecting problems in the network during the time periods comprises:

applying a machine learning-based anomaly detection model to one or more of the measurements from the monitored network; and

labeling a given time period with a positive label, when the anomaly detection model determines that the one or more measurements from the monitored network are anomalous.

5. The method as in claim 1 , further comprising:

receiving, at the network assurance system, a definition of a problem condition from a user interface.

6. An apparatus, comprising:

one or more network interfaces to communicate with a network that comprises a plurality of sensors and actuators;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

label time periods with positive labels, each positively-labeled time period being indicative of the apparatus having detected a problem in the network during the corresponding time period;

assign categorical tags to discrete portions of a feature space comprising an aggregation of network measurements from the network, based on whether a particular range of values in the feature space has a threshold probability of occurring during any of the positively-labeled time periods in which problems are detected in the network by applying a machine learning, decision tree-based classifier to the feature space to determine an association between the particular range of values in the feature space and the detected problems;

determine a set of the assigned categorical tags that frequently co-occur with the positively-labeled time periods in which problems are detected in the network based on one or more predictive strength metrics indicative of a strength of an association between any of the assigned categorical tags and any of the positively-labeled time periods; and

cause performance of a mitigation action in the network based on the set of assigned categorical tags that frequently co-occur with the positively-labeled time periods.

7. The apparatus as in claim 6 , wherein the measurements obtained from the network comprise one or more of: wireless interference, dropped packets, traffic volume, throughput, or an endpoint client count in the network.

8. The apparatus as in claim 6 , wherein the mitigation action comprises providing an indication of the assigned tags that frequently co-occur with the positively-labeled time periods as one or more natural language sentences.

9. The apparatus as in claim 6 , wherein labeling the time periods with positive labels, based on the apparatus detecting problems in the network during the time periods comprises:

applying a machine learning-based anomaly detection model to one or more of the measurements from the network; and

labeling a given time period with a positive label, when the anomaly detection model determines that the one or more measurements from the network are anomalous.

10. The apparatus as in claim 6 , wherein the process when executed is further configured to:

receive a definition of a problem condition from a user interface.

11. A tangible, non-transitory, computer-readable medium storing program instructions that cause a network assurance system that monitors a network to execute a process comprising:

labeling, by the network assurance system, time periods with positive labels, each positively-labeled time period being indicative of the network assurance system having detected a problem in the network during the corresponding time period;

assigning, by the network assurance system, categorical tags to discrete portions of a feature space comprising an aggregation of network measurements from the monitored network, based on whether a particular range of values in the feature space has a threshold probability of occurring during any of the positively-labeled time periods in which problems are detected in the network by applying a machine learning, decision tree-based classifier to the feature space to determine an association between the particular range of values in the feature space and the detected problems;

determining, by the network assurance system, a set of the assigned categorical tags that frequently co-occur with the positively-labeled time periods in which problems are detected in the network based on one or more predictive strength metrics indicative of a strength of an association between any of the assigned categorical tags and any of the positively-labeled time periods; and

causing, by the network assurance system, performance of a mitigation action in the network based on the set of assigned categorical tags that frequently co-occur with the positively-labeled time periods.

12. The computer-readable medium as in claim 11 , wherein the measurements obtained from the monitored network comprise one or more of: wireless interference, dropped packets, traffic volume, throughput, or an endpoint client count in the network.

13. The computer-readable medium as in claim 11 , wherein the mitigation action comprises providing an indication of the assigned tags that frequently co-occur with the positively-labeled time periods as one or more natural language sentences.

14. The computer-readable medium as in claim 11 , wherein labeling the time periods with positive labels, based on the network assurance system detecting problems in the network during the time periods comprises:

applying a machine learning-based anomaly detection model to one or more of the measurements from the monitored network; and

labeling a given time period with a positive label, when the anomaly detection model determines that the one or more measurements from the monitored network are anomalous.