Using user equipment data clusters and spatial temporal graphs of abnormalities for root cause analysis

1. A system comprising:

a processor; and

a memory that stores computer-executable instructions that, when executed by the processor, cause the processor to perform operations comprising

obtaining user equipment data from a cellular network, the user equipment data comprising one or more values for one or more performance metrics for one or more instances of user equipment, wherein each of the one or more instances of user equipment is connected to the cellular network and is experiencing a failure, and wherein the one or more performance metrics relate to one or more connections between the one or more instances of user equipment and the cellular network,

applying a filter having a threshold to the user equipment data to obtain a subset of records from the user equipment data, wherein the threshold specifies a value for the one or more performance metrics,

determining if the threshold is to be adjusted based on a number of records included in the subset of records,

in response to a determination that the threshold is to be adjusted, generating a plurality of data clusters by applying a clustering algorithm to a record set, determining a centroid for each of the plurality of data clusters, and adjusting the threshold based on the centroid for each of the plurality of data clusters, and

in response to a determination that the threshold is not to be adjusted, adding the records of the subset of records to the record set, correlating the records of the subset of records based on a key to obtain a filtered and correlated version of the record set, generating, based on the filtered and correlated version of the record set, a spatial temporal graph of abnormalities associated with the cellular network, and determining, based on the spatial temporal graph of abnormalities, a root cause of the failure associated with the cellular network.

2. The system of claim 1 , wherein the clustering algorithm comprises a k-means clustering algorithm, wherein generating the plurality of data clusters comprises generating two data clusters, and wherein determining the centroid for each of the plurality of data clusters comprises determining a first centroid for a first of the two data clusters and a second centroid for a second of the two data clusters.

3. The system of claim 2 , wherein the first centroid is associated with a first value, wherein the second centroid is associated with a second value, and wherein adjusting the threshold comprises adjusting the threshold based on a function of the first value and the second value.

4. The system of claim 3 , wherein the function of the first value and the second value comprises an average of the first value and the second value.

5. The system of claim 1 , wherein the computer-executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

identifying a solution for the root cause of the failure; and

outputting the solution for implementation on the cellular network.

6. The system of claim 1 , wherein applying the filter comprises:

applying a first filter to the user equipment data to obtain a first subset of records;

applying a second filter to the record set to obtain a second subset of records; and

correlating and aggregating the first subset of records in the record set with the second subset of records.

7. The system of claim 1 , wherein applying the filter comprises determining, based on values associated with data in included in the spatial temporal graph of abnormalities, whether the root cause relates to a malfunctioning user equipment, a malfunctioning network element, or poor coverage.

8. A method comprising:

obtaining, at a computing device comprising a processor, user equipment data from a cellular network, the user equipment data comprising one or more values for one or more performance metrics for one or more instances of user equipment, wherein each of the one or more instances of user equipment is connected to the cellular network and is experiencing a failure, and wherein the one or more performance metrics relate to one or more connections between the one or more instances of user equipment and the cellular network;

applying, by the processor, a filter having a threshold to the user equipment data to obtain a subset of records from the user equipment data, wherein the threshold specifies a value for the one or more performance metrics;

determining, by the processor, if the threshold is to be adjusted based on a number of records included in the subset of records;

in response to a determination that the threshold is to be adjusted, generating, by the processor, a plurality of data clusters by applying a clustering algorithm to a record set, determining a centroid for each of the plurality of data clusters, and adjusting the threshold based on the centroid for each of the plurality of data clusters; and

in response to a determination that the threshold is not to be adjusted, adding, by the processor, the records of the subset of records to the record set, correlating, by the processor, the records of the subset of records based on a key to obtain a filtered and correlated version of the record set, generating, by the processor and based on the filtered and correlated version of the record set, a spatial temporal graph of abnormalities associated with the cellular network, and determining, by the processor and based on the spatial temporal graph of abnormalities, a root cause of the failure associated with the cellular network.

9. The method of claim 8 , wherein the clustering algorithm comprises a k-means clustering algorithm, wherein generating the plurality of data clusters comprises generating two data clusters, and wherein determining the centroid for each of the plurality of data clusters comprises determining a first centroid for a first of the two data clusters and a second centroid for a second of the two data clusters.

10. The method of claim 9 , wherein the first centroid is associated with a first value, wherein the second centroid is associated with a second value, and wherein adjusting the threshold comprises adjusting the threshold based on a function of the first value and the second value.

11. The method of claim 10 , wherein the function of the first value and the second value comprises an average of the first value and the second value.

12. The method of claim 8 , further comprising:

identifying a solution for the root cause of the failure; and

outputting the solution for implementation on the cellular network.

13. The method of claim 8 , wherein applying the filter comprises:

applying a first filter to the user equipment data to obtain a first subset of records;

applying a second filter to the record set to obtain a second subset of records; and

correlating and aggregating the first subset of records in the record set with the second subset of records.

14. A computer storage medium having computer-executable instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

obtaining, at a computing device, user equipment data from a cellular network, the user equipment data comprising one or more values for one or more performance metrics for one or more instances of user equipment, wherein each of the one or more instances of user equipment is connected to the cellular network and is experiencing a failure, and wherein the one or more performance metrics relate to one or more connections between the one or more instances of user equipment and the cellular network;

applying a filter having a threshold to the user equipment data to obtain a subset of records from the user equipment data, wherein the threshold specifies a value for the one or more performance metrics;

determining if the threshold is to be adjusted based on a number of records included in the subset of records;

in response to a determination that the threshold is to be adjusted, generating a plurality of data clusters by applying a clustering algorithm to a record set, determining a centroid for each of the plurality of data clusters, and adjusting the threshold based on the centroid for each of the plurality of data clusters; and

in response to a determination that the threshold is not to be adjusted, adding the records of the subset of records to the record set, correlating the records of the subset of records based on a key to obtain a filtered and correlated version of the record set, generating, based on the filtered and correlated version of the record set, a spatial temporal graph of abnormalities associated with the cellular network, and determining, based on the spatial temporal graph of abnormalities, a root cause of the failure associated with the cellular network.

15. The computer storage medium of claim 14 , wherein the clustering algorithm comprises a k-means clustering algorithm, wherein generating the plurality of data clusters comprises generating two data clusters, and wherein determining the centroid for each of the plurality of data clusters comprises determining a first centroid for a first of the two data clusters and a second centroid for a second of the two data clusters.

16. The computer storage medium of claim 15 , wherein the first centroid is associated with a first value, wherein the second centroid is associated with a second value, and wherein adjusting the threshold comprises adjusting the threshold based on a function of the first value and the second value.

17. The computer storage medium of claim 16 , wherein the function of the first value and the second value comprises an average of the first value and the second value.

18. The computer storage medium of claim 14 , wherein the computer-executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

identifying a solution for the root cause of the failure; and

outputting the solution for implementation on the cellular network.

19. The computer storage medium of claim 14 , wherein applying the filter comprises:

applying a first filter to the user equipment data to obtain a first subset of records;

applying a second filter to the record set to obtain a second subset of records; and

correlating and aggregating the first subset of records in the record set with the second subset of records.

20. The computer storage medium of claim 14 , wherein applying the filter comprises determining, based on values associated with data in included in the spatial temporal graph of abnormalities, whether the root cause relates to a malfunctioning user equipment, a malfunctioning network element, or poor coverage.