Network monitoring and healing based on a behavior model
Aspects of the disclosure are directed to monitoring, alerting, and/or root causing network problems based on current network behavior and network events at any instant in time using a network behavior model. The network behavior model can learn and be updated with network states and events to correlate network problems and determine root causes of the network problems for alerting and/or automatic correction.
1. A method for managing a network using a behavior model, comprising:
identifying, by one or more processors, current network metadata that matches test network metadata;
computing, by the one or more processors, a plurality of network events based on possible transitions to the current network metadata;
identifying, by the one or more processors, a root cause of a problem in the network based on the plurality of network events; and
outputting, by the one or more processors, instructions based on the root cause.
2. The method of claim 1 , wherein the current network metadata comprises at least one of network states or behaviors at a point in time.
3. The method of claim 1 , wherein the test network metadata comprises at least one of desired network states or behaviors for the network.
4. The method of claim 1 , wherein outputting instructions further comprises at least one of sending an alert or notification to validate the root cause or automatically correcting the root cause.
5. The method of claim 1 , wherein the behavior model comprises at least one of a finite state machine or a machine learning model.
6. The method of claim 1 , further comprising generating, by the one or more processors, a directed graph for the behavior model, the directed graph comprising a plurality of nodes and a plurality of edges connecting the plurality of nodes, the plurality of nodes representing network metadata and the plurality of edges representing network events.
7. The method of claim 6 , wherein identifying the root cause further comprises filtering the plurality of network events based on changes to the network.
8. The method of claim 6 , wherein identifying the root cause further comprises predicting the root cause based on previous network metadata or network events.
9. The method of claim 1 , further comprising training, by the one or more processors, the behavior model on previous network events, previous network metadata, and network objectives.
10. The method of claim 1 , further comprising comparing, by the one or more processors, the current network metadata to the test network metadata.
11. A system comprising:
one or more processors; and
one or more storage devices coupled to the one or more processors and storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for managing a network using a behavior model, the operations comprising:
identifying current network metadata that matches test network metadata;
computing a plurality of network events based on possible transitions to the current network metadata;
identifying a root cause of a problem in the network based on the plurality of network events; and
outputting instructions based on the root cause.
12. The system of claim 11 , wherein outputting instructions further comprises at least one of sending an alert or notification to validate the root cause or automatically correcting the root cause.
13. The system of claim 11 , wherein the operations further comprise generating a directed graph for the behavior model, the directed graph comprising a plurality of nodes and a plurality of edges connecting the plurality of nodes, the plurality of nodes representing network metadata and the plurality of edges representing network events.
14. The system of claim 13 , wherein identifying the root cause further comprises filtering the plurality of network events based on changes to the network.
15. The system of claim 13 , wherein identifying the root cause further comprises predicting the root cause based on previous network metadata or network events.
16. A non-transitory computer readable medium for storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for managing a network using a behavior model, the operations comprising:
identifying current network metadata that matches test network metadata;
computing a plurality of network events based on possible transitions to the current network metadata;
identifying a root cause of a problem in the network based on the plurality of network events; and
outputting instructions based on the root cause.
17. The non-transitory computer readable medium of claim 16 , wherein outputting instructions further comprises at least one of sending an alert or notification to validate the root cause or automatically correcting the root cause.
18. The non-transitory computer readable medium of claim 16 , wherein the operations further comprise generating a directed graph for the behavior model, the directed graph comprising a plurality of nodes and a plurality of edges connecting the plurality of nodes, the plurality of nodes representing network metadata and the plurality of edges representing network events.
19. The non-transitory computer readable medium of claim 18 , wherein identifying the root cause further comprises filtering the plurality of network events based on changes to the network.
20. The non-transitory computer readable medium of claim 18 , wherein identifying the root cause further comprises predicting the root cause based on previous network metadata or network events.