Root-cause analysis of event occurrences
Provided herein are systems and methods for determining relationships between events occurring in networks. Notifications describing events occurring in networks can be received and processed to determine groups of network event types. A root-cause network can be generated based on the events, with the nodes of the root-cause network representing different event types and the edges of the root-cause network indicating directional, causal relationships between the nodes. A received network event can be processed to determine potential causes of the received network event based on the root-cause network and other events received by the network.
1. A method, comprising:
comparing an arrival time distribution to a reference distribution to determine a relationship between a first network event type and a second network event type, wherein the arrival time distribution is based on a time difference between an occurrence of the first network event type and an occurrence of the second network event type after the occurrence of the first network event type;
updating a relationship probability for an edge in a root-cause network based on the relationship, wherein the edge connects a first node in the root-cause network representing the first network event type to a second node in the root-cause network representing the second network event type;
receiving a first event notification associated with a first network event occurring in a network, wherein the first network event is the first network event type;
receiving a second event notification associated with a second network event occurring in the network, wherein the second network event is the second network event type and occurs after the first network event; and
in response to finding the edge in the root-cause network based on the first and second event notifications, generating a notification about the second network event, wherein the notification comprises a remedial response based on the relationship probability.
2. The method of claim 1 , further comprising determining the arrival time distribution based on a first group of network events of the first network event type and a second group of network events based on the second event type.
3. The method of claim 2 , further comprising:
receiving a plurality of network event notifications, wherein each network event notification comprises a respective timestamp and a respective event description for a respective network event occurring in the network;
determining, for each network event notification in the plurality of network event notifications, a respective network event type based on the respective event description;
adding each network event with a respective network event notification that is determined to be from the first network event type to the first group of network events; and
adding each network event with the respective network event notification that is determined to be from the second network event type to the second group of network events;
wherein determining the arrival time distribution comprises:
forming, from the first and second groups of network events, a set of pairs of network events, wherein each pair of network events in the set of pairs of network events comprises a first respective network event from the first group of network events and a second respective network event from the second group of network events, wherein the first respective network event is a closest network event from the first group of network events that has a first arrival time closest to and before a second arrival time to the second network event;
determining a respective arrival time difference between each pair of network events in the set of pairs of network events; and
forming a distribution of the respective arrival time differences to determine the arrival time distribution.
4. The method of claim 3 , wherein determining the respective network event type for each network notification comprises determining the respective network event type based on respective topology information in the respective network event notification.
5. The method of claim 1 , further comprising searching for the edge in the root-cause network in response to receiving a selection of the second network event.
6. The method of claim 1 , wherein the relationship probability comprises a probability that the second network event type is caused by the first network event type.
7. The method of claim 1 , further comprising, in response to the edge being absent from the root-cause network, generating another notification comprising that the second network event is not caused by the first network event.
8. The method of claim 1 , wherein the reference distribution is a uniform distribution.
9. The method of claim 1 , wherein comparing the arrival time distribution to the reference distribution comprises determining a Kullback-Leibler divergence between the arrival time distribution and the reference distribution.
10. A system, comprising:
one or more processors; and
memory communicatively coupled to the one or more processors, wherein the memory stores instructions configured to, when executed, cause the one or more processors to:
compare an arrival time distribution to a reference distribution to determine a relationship between a first network event type and a second network event type, wherein the arrival time distribution is based on a time difference between an occurrence of the first network event type and an occurrence of the second network event type after the occurrence of the first event type;
update a relationship probability for an edge in a root-cause network based on the relationship, wherein the edge connects a first node in the root-cause network representing the first network event type to a second node in the root-cause network representing the second network event type;
receive a first event notification associated with a first network event occurring in a network, wherein the first network event is the first network event type;
receive a second event notification associated with a second network event occurring in the network, wherein the second network event is the second network event type and occurs after the first network event; and
in response to finding the edge in the root-cause network based on the first and second event notifications, generate a notification about the second network event, wherein the notification comprises a remedial response based on the relationship probability.
11. The system of claim 10 , wherein the instructions further cause the one or more processors to determine the arrival time distribution based on a first group of network events of the first network event type and a second group of network events based on the second event type.
12. The system of claim 11 , wherein the instructions further cause the one or more processors to:
receive a plurality of network event notifications, wherein each network event notification comprises a respective timestamp and a respective event description for a respective network event occurring in the network;
determine, for each network event notification in the plurality of network event notifications, a respective network event type based on the respective event description;
add each network event with a respective network event notification that is determined to be from the first network event type to the first group of network events; and
add each network event with the respective network event notification that is determined to be from the second network event type to the second group of network events;
wherein the arrival time distribution is determined by:
forming, from the first and second groups of network events, a set of pairs of network events, wherein each pair of network events in the set of pairs of network events comprises a first respective network event from the first group of network events and a second respective network event from the second group of network events, wherein the first respective network event is a closest network event from the first group of network events that has a first arrival time closest to and before a second arrival time to the second network event;
determining a respective arrival time difference between each pair of network events in the set of pairs of network events; and
forming a distribution of the respective arrival time differences to determine the arrival time distribution.
13. The system of claim 12 , wherein the instructions further cause the one or more processors to determine the respective network event type for each network notification based on respective topology information in the respective network event notification.
14. The system of claim 10 , wherein the instructions further cause the one or more processors to search for the edge in the root-cause network in response to receiving a selection of the second network event.
15. The system of claim 10 , wherein the relationship probability comprises a probability that the second network event type is caused by the first network event type.
16. The system of claim 10 , wherein the instructions further cause the one or more processors to, in response to the edge being absent from the root-cause network, generate another notification comprising that the second network event is not caused by the first network event.
17. The system of claim 10 , wherein the reference distribution is a uniform distribution.
18. The system of claim 10 , wherein the instructions further cause the one or more processors to determine the arrival time distribution to the reference distribution using a Kullback-Leibler divergence between the arrival time distribution and the reference distribution.
19. A non-transitory computer readable storage medium having computer readable code thereon, the non-transitory computer readable storage medium including instructions configured to cause a computer system to perform operations, comprising:
comparing an arrival time distribution to a reference distribution to determine a relationship between a first network event type and a second network event type, wherein the arrival time distribution is based on a time difference between an occurrence of the first network event type and an occurrence of the second network event type after the occurrence of the first network event type;
updating a relationship probability for an edge in a root-cause network based on the relationship, wherein the edge connects a first node in the root-cause network representing the first network event type to a second node in the root-cause network representing the second network event type;
receiving a first event notification associated with a first network event occurring in a network, wherein the first network event is the first network event type;
receiving a second event notification associated with a second network event occurring in the network, wherein the second network event is the second network event type and occurs after the first network event; and
in response to finding the edge in the root-cause network based on the first and second event notifications, generating a notification about the second network event, wherein the notification comprises a remedial response based on the relationship probability.
20. The non-transitory computer readable storage medium of claim 19 , the operations further comprising:
receiving a plurality of network event notifications, wherein each network event notification comprises a respective timestamp and a respective event description for a respective network event occurring in the network;
determining, for each network event notification in the plurality of network event notifications, a respective network event type based on the respective event description;
adding each network event with a respective network event notification that is determined to be from the first network event type to a first group of network events;
adding each network event with the respective network event notification that is determined to be from the second network event type to a second group of network events; and
determining an arrival time distribution, wherein determining the arrival time distribution comprises:
forming, from the first and second groups of network events, a set of pairs of network events, wherein each pair of network events in the set of pairs of network events comprises a first respective network event from the first group of network events and a second respective network event from the second group of network events, wherein the first respective network event is a closest network event from the first group of network events that has a first arrival time closest to and before a second arrival time to the second network event;
determining a respective arrival time difference between each pair of network events in the set of pairs of network events; and
forming a distribution of the respective arrival time differences to determine the arrival time distribution.