System and method for anomaly detection with root cause identification

1. A method comprising:

obtaining, by a computer device, a plurality of key performance indicator (KPI) values for a plurality of KPI parameters associated with at least one network device;

identifying, by the computer device, a plurality of potential anomalies based on the plurality of KPI values using an anomaly detection model;

identifying, by the computer device, at least one anomaly based on the plurality of potential anomalies by determining that the at least one anomaly is not associated with behavior designated as desirable behavior for a KPI parameter of the plurality of KPI parameters;

determining, by the computer device, a root cause parameter for the identified at least one anomaly; and

sending, by the computer device, an alert identifying the at least one anomaly and the root cause parameter to a management device associated with the at least one network device.

2. The method of claim 1 , wherein identifying the at least one anomaly based on the plurality of potential anomalies further includes:

determining that a particular one of the plurality of potential anomalies is associated with behavior designated as desirable behavior for a KPI parameter; and

removing the particular one of the plurality of potential anomalies from the plurality of potential anomalies.

3. The method of claim 1 , wherein the designated desirable behavior for the KPI parameter identifies either a set of increasing values for the KPI parameter as desirable or a set of decreasing values for the KPI parameter as desirable.

4. The method of claim 1 , further comprising:

computing a set of historical statistical values for the obtained plurality of KPI values;

computing a degree of randomness for the plurality of KPI values; and

selecting the set of historical statistical parameters for the obtained plurality of KPI values associated with the network device based on the computed degree of randomness.

5. The method of claim 4 , wherein the computed degree of randomness is based on a number of data points, from the plurality of KPI values, that crossed a standard deviation value computed for the plurality of KPI values.

6. The method of claim 4 , further comprising:

selecting at least one of an interquartile range, burstiness, or maximum and minimum values within a time period as the set of historical statistical parameters for the obtained plurality of KPI values associated with the network device, when the computed degree of randomness is higher than a randomness threshold; or

selecting at least one of a mean, standard deviation, or historically observed maximum and minimum values as the set of historical statistical parameters for the obtained plurality of KPI values associated with the network device, when the computed degree of randomness is lower than the randomness threshold.

7. The method of claim 1 , wherein the plurality of KPI values for the plurality of KPI parameters associated with the at least one network device includes:

a time series of values for at least one KPI parameter for a particular network device; or

a set of values for at least one KPI parameter at a particular time for a plurality of network devices.

8. The method of claim 1 , further comprising:

selecting the anomaly detection model based on a data distribution uniformity value and a data size associated with the plurality of KPI values.

9. The method of claim 8 , further comprising:

selecting a distance-based anomaly detection model, when it is determined that the data distribution uniformity value is above a uniformity threshold and the data size is below a size threshold; or

selecting a tree-based anomaly detection model, when it is determined that the data distribution uniformity value is below the uniformity threshold and the data size is above the size threshold.

10. The method of claim 1 , wherein determining the root cause parameter for the identified at least one anomaly includes:

using a distance-based anomaly detection model as the anomaly detection model to identify the plurality of potential anomalies; and

using a tree-based anomaly detection model to identify a root cause parameter using the identified at least one anomaly as an input.

11. The method of claim 1 , wherein determining the root cause parameter for the identified at least one anomaly includes:

calculating at least one Shapley Additive Explanations (SHAP) value for the identified at least one anomaly.

12. A device comprising:

a processor configured to:

obtain a plurality of key performance indicator (KPI) values for a plurality of KPI parameters associated with at least one network device;

identify a plurality of potential anomalies based on the plurality of KPI values using an anomaly detection model;

identify at least one anomaly based on the plurality of potential anomalies by determining that the at least one anomaly is not associated with behavior designated as desirable behavior for a KPI parameter of the plurality of KPI parameters;

determine a root cause parameter for the identified at least one anomaly; and

send an alert identifying the at least one anomaly and the root cause parameter to a management device associated with the at least one network device.

13. The device of claim 12 , wherein, when identifying the at least one anomaly based on the plurality of potential anomalies, the processor is further configured to:

determine that a particular one of the plurality of potential anomalies is associated with behavior designated as desirable behavior for a KPI parameter, wherein the designated desirable behavior for the KPI parameter identifies either a set of increasing values for the KPI parameter as desirable or a set of decreasing values for the KPI parameter as desirable; and

remove the particular one of the plurality of potential anomalies from the plurality of potential anomalies.

14. The device of claim 12 , wherein the processor is further configured to:

compute a set of historical statistical values for the obtained plurality of KPI values;

compute a degree of randomness for the plurality of KPI values based on a number of data points, from the plurality of KPI values, that crossed a standard deviation value computed for the plurality of KPI values; and

select the set of historical statistical parameters for the obtained plurality of KPI values associated with the network device based on the computed degree of randomness.

15. The device of claim 14 , wherein the processor is further configured to:

select at least one of an interquartile range, burstiness, or maximum and minimum values within a time period as the set of historical statistical parameters for the obtained plurality of KPI values associated with the network device, when the computed degree of randomness is higher than a randomness threshold; or

select at least one of a mean, standard deviation, or historically observed maximum and minimum values as the set of historical statistical parameters for the obtained plurality of KPI values associated with the network device, when the computed degree of randomness is lower than the randomness threshold.

16. The device of claim 12 , wherein the plurality of KPI values for the plurality of KPI parameters associated with the at least one network device includes:

a time series of values for at least one KPI parameter for a particular network device; or

a set of values for at least one KPI parameter at a particular time for a plurality of network devices.

17. The device of claim 12 , wherein the processor is further configured to:

determine a data distribution uniformity value and a data size for the plurality of KPI values; and

select a distance-based anomaly detection model, when it is determined that the data distribution uniformity value is above a uniformity threshold and the data size is below a size threshold; or

select a tree-based anomaly detection model, when it is determined that the data distribution uniformity value is below the uniformity threshold and the data size is above the size threshold.

18. The device of claim 12 , wherein, when determining the root cause parameter for the identified at least one anomaly, the processor is further configured to:

use a distance-based anomaly detection model as the anomaly detection model to identify the plurality of potential anomalies; and

use a tree-based anomaly detection model to identify a root cause parameter using the identified at least one anomaly as an input.

19. The device of claim 12 , wherein, when determining the root cause parameter for the identified at least one anomaly, the processor is further configured to:

calculate at least one Shapley Additive Explanations (SHAP) value for the identified at least one anomaly.

20. A non-transitory computer-readable memory device storing instructions executable by a processor, the non-transitory computer-readable memory device comprising:

one or more instructions to obtain a plurality of key performance indicator (KPI) values for a plurality of KPI parameters associated with at least one network device;

one or more instructions to identify a plurality of potential anomalies based on the plurality of KPI values using an anomaly detection model;

one or more instructions to identify at least one anomaly based on the plurality of potential anomalies by determining that the at least one anomaly is not associated with behavior designated as desirable behavior for a KPI parameter of the plurality of KPI parameters;

one or more instructions to determine a root cause parameter for the identified at least one anomaly; and

one or more instructions to send an alert identifying the at least one anomaly and the root cause parameter to a management device associated with the at least one network device.