NetEventCause: Event-Driven Root Cause Analysis for Large Network System Without Topology.

Area of Science:

• Computer Science
• Network Engineering
• Data Science

Background:

• Root cause analysis (RCA) is vital for network systems to identify abnormal nodes causing alarm floods.
• Incomplete network topologies in private clouds hinder traditional RCA methods.
• Existing topology-free RCA techniques are ineffective for large-scale or sparse alarm scenarios.

Purpose of the Study:

• To propose NetEventCause (NEC), an event-driven, unsupervised, and nonintrusive RCA algorithm for large-scale network systems with unknown topology.
• To accurately model alarm event occurrences and identify root causes in complex network environments.
• To overcome limitations of existing RCA techniques in large or sparse alarm scenarios.

Main Methods:

• Developed NEC, an algorithm utilizing a multivariate neural temporal point process (TPP) to model historical alarm events.
• Employed conditional intensity prediction from the learned TPP for root alarm identification.
• Applied an attribution method to locate causal alarms from derivative events.

Main Results:

• NEC demonstrated superior performance in modeling alarm events compared to state-of-the-art TPP models.
• The algorithm effectively identified root alarms and recovered anomaly transmission chains.
• Evaluated using synthetic and a large-scale real-world dataset from a major airport's network operations center.

Conclusions:

• NEC provides an effective solution for unsupervised, nonintrusive RCA in large network systems with unknown topologies.
• The algorithm significantly outperforms general RCA methods and SOTA TPP models in practical network scenarios.
• NEC offers a robust approach for network maintenance and operations, particularly in complex environments.