Using user equipment data clusters and spatial temporal graphs of abnormalities for root cause analysis

1. A system comprising:

a processor; and

a memory that stores computer-executable instructions that, when executed by the processor, cause the processor to perform operations comprising

obtaining user equipment data comprising values for performance metrics for user equipment, wherein the user equipment is connected to a cellular network and is experiencing a failure, and wherein the performance metrics relate to a connection between the user equipment and the cellular network,

applying a filter having a threshold to the user equipment data to obtain a subset of records from the user equipment data, wherein the threshold specifies a value for the performance metrics,

determining if the threshold is to be adjusted based on a number of records included in the subset of records,

in response to a determination that the threshold is to be adjusted, generating a plurality of data clusters by applying a clustering algorithm to a record set, determining a centroid for each of the plurality of data clusters, and adjusting the threshold based on the centroid for each of the plurality of data clusters, and

in response to a determination that the threshold is not to be adjusted, adding the records of the subset of records to the record set, correlating the records of the subset of records based on a key to obtain a filtered and correlated version of the record set, and generating, based on the filtered and correlated version of the record set, a spatial temporal graph of abnormalities associated with the cellular network, wherein a root cause of the failure can be determined based on the spatial temporal graph of abnormalities.

2. The system of claim 1 , wherein the clustering algorithm comprises a k-means clustering algorithm, wherein generating the plurality of data clusters comprises generating two data clusters, and wherein determining the centroid for each of the plurality of data clusters comprises determining a first centroid for a first of the two data clusters and a second centroid for a second of the two data clusters.

3. The system of claim 2 , wherein the first centroid is associated with a first value, wherein the second centroid is associated with a second value, and wherein adjusting the threshold comprises adjusting the threshold based on a function of the first value and the second value.

4. The system of claim 1 , wherein the computer-executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

determining, based on the spatial temporal graph of abnormalities, the root cause of the failure.

5. The system of claim 1 , wherein the computer-executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

identifying a solution for the root cause of the failure; and

outputting, to the cellular network, the solution for implementation on the cellular network.

6. The system of claim 1 , wherein applying the filter comprises:

applying a first filter to the user equipment data to obtain a first subset of records;

applying a second filter to the record set to obtain a second subset of records; and

correlating and aggregating the first subset of records in the record set with the second subset of records.

7. The system of claim 1 , wherein the root cause of the failure is determined based on analyzing the spatial temporal graph of abnormalities.

8. A method comprising:

obtaining, at a computing device comprising a processor, user equipment data comprising values for performance metrics for user equipment, wherein the user equipment is connected to a cellular network and is experiencing a failure, and wherein the performance metrics relate to a connection between the user equipment and the cellular network;

applying, by the processor, a filter having a threshold to the user equipment data to obtain a subset of records from the user equipment data, wherein the threshold specifies a value for the performance metrics;

determining, by the processor, if the threshold is to be adjusted based on a number of records included in the subset of records;

in response to a determination that the threshold is to be adjusted, generating, by the processor, a plurality of data clusters by applying a clustering algorithm to a record set, determining a centroid for each of the plurality of data clusters, and adjusting the threshold based on the centroid for each of the plurality of data clusters; and

in response to a determination that the threshold is not to be adjusted, adding, by the processor, the records of the subset of records to the record set, correlating the records of the subset of records based on a key to obtain a filtered and correlated version of the record set, and generating, based on the filtered and correlated version of the record set, a spatial temporal graph of abnormalities associated with the cellular network, wherein a root cause of the failure can be determined based on the spatial temporal graph of abnormalities.

9. The method of claim 8 , wherein the clustering algorithm comprises a k-means clustering algorithm, wherein generating the plurality of data clusters comprises generating two data clusters, and wherein determining the centroid for each of the plurality of data clusters comprises determining a first centroid for a first of the two data clusters and a second centroid for a second of the two data clusters.

10. The method of claim 9 , wherein the first centroid is associated with a first value, wherein the second centroid is associated with a second value, and wherein adjusting the threshold comprises adjusting the threshold based on a function of the first value and the second value.

11. The method of claim 8 , further comprising:

determining, based on the spatial temporal graph of abnormalities, the root cause of the failure.

12. The method of claim 8 , further comprising:

identifying a solution for the root cause of the failure; and

outputting, to the cellular network, the solution for implementation on the cellular network.

13. The method of claim 8 , wherein applying the filter comprises:

applying a first filter to the user equipment data to obtain a first subset of records;

applying a second filter to the record set to obtain a second subset of records; and

correlating and aggregating the first subset of records in the record set with the second subset of records.

14. A computer storage medium having computer-executable instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

obtaining user equipment data comprising values for performance metrics for user equipment, wherein the user equipment is connected to a cellular network and is experiencing a failure, and wherein the performance metrics relate to a connection between the user equipment and the cellular network;

applying a filter having a threshold to the user equipment data to obtain a subset of records from the user equipment data, wherein the threshold specifies a value for the performance metrics;

determining if the threshold is to be adjusted based on a number of records included in the subset of records;

in response to a determination that the threshold is to be adjusted, generating a plurality of data clusters by applying a clustering algorithm to a record set, determining a centroid for each of the plurality of data clusters, and adjusting the threshold based on the centroid for each of the plurality of data clusters; and

in response to a determination that the threshold is not to be adjusted, adding the records of the subset of records to the record set, correlating the records of the subset of records based on a key to obtain a filtered and correlated version of the record set, and generating, based on the filtered and correlated version of the record set, a spatial temporal graph of abnormalities associated with the cellular network, wherein a root cause of the failure can be determined based on the spatial temporal graph of abnormalities.

15. The computer storage medium of claim 14 , wherein the clustering algorithm comprises a k-means clustering algorithm, wherein generating the plurality of data clusters comprises generating two data clusters, and wherein determining the centroid for each of the plurality of data clusters comprises determining a first centroid for a first of the two data clusters and a second centroid for a second of the two data clusters.

16. The computer storage medium of claim 15 , wherein the first centroid is associated with a first value, wherein the second centroid is associated with a second value, and wherein adjusting the threshold comprises adjusting the threshold based on a function of the first value and the second value.

17. The computer storage medium of claim 4 , wherein the computer-executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

determining, based on the spatial temporal graph of abnormalities, the root cause of the failure.

18. The computer storage medium of claim 14 , wherein the computer-executable instructions, when executed by the processor, cause the processor to perform operations further comprising:

identifying a solution for the root cause of the failure; and

outputting, to the cellular network, the solution for implementation on the cellular network.

19. The computer storage medium of claim 14 , wherein applying the filter comprises:

applying a first filter to the user equipment data to obtain a first subset of records;

applying a second filter to the record set to obtain a second subset of records; and

correlating and aggregating the first subset of records in the record set with the second subset of records.

20. The computer storage medium of claim 14 , wherein the root cause of the failure is determined based on analyzing the spatial temporal graph of abnormalities.