Intelligent network operation platform for network fault mitigation
Embodiments of the present disclosure provide systems, methods, and computer-readable storage media that leverage artificial intelligence and machine learning to identify, diagnose, and mitigate occurrences of network faults or incidents within a network. Historical network incidents may be used to generate a model that may be used to evaluate real-time occurring network incidents, such as to identify a cause of the network incident. Clustering algorithms may be used to identify portions of the model that share similarities with a network incident and then actions taken to resolve similar network incidents in the past may be identified and proposed as candidate actions that may be executed to resolve the cause of the network incident. Execution of the candidate actions may be performed under control of a user or automatically based on execution criteria and the configuration of the fault mitigation system.
1. A method for diagnosing and resolving network incidents, the method comprising:
executing clustering logic against historic network incident data to identify a plurality of clusters associated with historic network incidents represented by the historic network incidents data, each cluster of the plurality of clusters corresponding to a set of historic network incidents associated with a same network incident cause;
generating, by one or more processors, a model based on the plurality of clusters;
receiving, by the one or more processors, an alarm message comprising information indicative of a network incident that occurred in a network;
executing, by the one or more processors, machine learning logic against the information indicative of the network incident and the model to determine one or more candidate actions, the one or more candidate actions determined to resolve a cause of the network incident; and
executing, by the one or more processors, at least one candidate action of the one or more candidate actions.
2. The method of claim 1 , wherein executing the machine learning logic against the information indicative of the network incident and the model to determine one or more candidate actions comprises:
identifying the cause of the network incident based on the information indicative of the network incident and the model;
identifying historic network incidents sharing a same cause as the cause of the network incident based on the model; and
determining one or more actions executed to resolve the cause of the historic network incidents, wherein the one or more candidate actions correspond to the one or more actions executed to resolve the cause of the historic network incidents.
3. The method of claim 2 , wherein the information indicative of the network incident comprises a plurality of parameters.
4. The method of claim 3 , wherein the historic network incidents are identified based on the plurality of parameters.
5. The method of claim 1 , wherein the at least one candidate action is executed automatically.
6. The method of claim 1 , further comprising transmitting a notification to a user device that includes information that identifies the one or more candidate actions, wherein the at least one candidate action is executed in response to an input received from the user device.
7. The method of claim 1 , wherein the one or more candidate actions include at least a first candidate action and a second candidate action, and wherein executing the at least one candidate action of the one or more candidate actions comprises:
executing the first candidate action; and
determining whether the first candidate action resolved a cause of the network incident.
8. The method of claim 7 , further comprising:
monitoring a network associated with the network incident to determine whether the first candidate action resolved the cause of the network incident; and
in response to the cause of the network incident not being resolved by the first candidate action, executing the second candidate action.
9. The method of claim 1 , further comprising:
generating feedback data based on the executing of the at least one candidate action, wherein the feedback data indicates whether the cause of the network incident was resolved by the at least one executed candidate action; and
updating the historic network incident data based on the feedback data.
10. The method of claim 9 , further comprising training the model based on the feedback data.
11. The method of claim 1 , further comprising assigning a score for each candidate action of the one or more candidate actions, wherein the at least one candidate action is selected for execution based at least in part on the score assigned to the at least one candidate action.
12. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for diagnosing and resolving network incidents, the operations comprising:
executing clustering logic against historic network incident data to identify a plurality of clusters associated with historic network incidents represented by the historic network incident data, each cluster of the plurality of clusters corresponding to a set of historic network incidents associated with a same network incident cause;
generating a model based on the plurality of clusters;
receiving an alarm message comprising information indicative of a network incident that occurred in a network;
executing machine learning logic against the information indicative of the network incident and the model to determine one or more candidate actions, the one or more candidate actions determined to resolve a cause of the network incident, wherein the machine learning logic is configured to determine the one or more candidate actions to resolve the network incident via analysis of a portion of the model using the information indicative of the network incident; and
executing at least one candidate action of the one or more candidate actions.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the operations to execute the machine learning logic against the information indicative of the network incident and the model to determine one or more candidate actions comprise:
identifying the cause of the network incident based on the information indicative of the network incident and the model, wherein the information indicative of the network incident comprises a plurality of parameters;
identifying historic network incidents sharing a same cause as the cause of the network incident based on the model, wherein the historic network incidents are identified based on the plurality of parameters; and
determining one or more actions executed to resolve the cause of the historic network incidents, wherein the one or more candidate actions correspond to the one or more actions executed to resolve the cause of the historic network incidents.
14. The non-transitory computer-readable storage medium of claim 12 , wherein the at least one candidate action is executed automatically.
15. The non-transitory computer-readable storage medium of claim 12 , the operations further comprising transmitting a notification to a user device that includes information that identifies the one or more candidate actions, wherein the at least one candidate action is executed in response to an input received from the user device.
16. The non-transitory computer-readable storage medium of claim 12 , wherein the one or more candidate actions include at least a first candidate action and a second candidate action, and wherein the operations to execute the at least one candidate action of the one or more candidate actions comprise:
executing the first candidate action;
monitoring a network associated with the network incident to determine whether the first candidate action resolved the cause of the network incident; and
in response to the cause of the network incident not being resolved by the first candidate action, executing the second candidate action.
17. The non-transitory computer-readable storage medium of claim 12 , the operations further comprising:
generating feedback data based on the executing of the at least one candidate action, wherein the feedback data indicates whether the cause of the network incident was resolved by the at least one executed candidate action;
updating the historic network incident data based on the feedback data; and
training the model based on the feedback data.
18. The non-transitory computer-readable storage medium of claim 12 , the operations further comprising assigning a score for each candidate action of the one or more candidate actions, wherein the at least one candidate action is selected for execution based at least in part on the score assigned to the at least one candidate action.
19. A system for diagnosing and resolving network incidents, the system comprising:
a memory storing historic network incident data; and
one or more processors communicatively coupled to the memory, the one or more processors configured to:
execute clustering logic against historic network incident data to identify a plurality of clusters associated with historic network incidents represented by the historic network incidents data, each cluster of the plurality of clusters corresponding to a set of historic network incidents associated with a same network incident cause;
generate a model based on the plurality of clusters;
receive an alarm message comprising information indicative of a network incident that occurred in a network;
evaluate the model based on the information indicative of the network incident to determine one or more candidate actions, the one or more candidate actions determined to resolve a cause of the network incident; and
execute at least one candidate action of the one or more candidate actions.
20. The system of claim 19 , wherein evaluating the information indicative of the network incident based on the model to determine one or more candidate actions comprises:
identifying the cause of the network incident based on the information indicative of the network incident and the model;
identifying historic network incidents sharing a same cause as the cause of the network incident based on the model; and
determining one or more actions executed to resolve the cause of the historic network incidents, wherein the one or more candidate actions correspond to the one or more actions executed to resolve the cause of the historic network incidents.