At&t Intellectual Property I, L.p.

Hiren Shah

Alexandre Gerber

Zihui Ge

He Yan

Dan Pei

Ashley Flavel

Jennifer Yates

Example methods disclosed herein to prioritize anomalies in a communication network include classifying respective nodes in the communication network as normal, abnormal or indeterminate based on measurements received for the nodes. Disclosed example methods also include selecting a subset of the nodes classified as abnormal to be root cause abnormal nodes representing sources of the anomalies in the communication network, respective ones of the root cause abnormal nodes being abnormal nodes identified in the communication network and determined to have respective sets of direct descendent nodes having majorities of nodes classified as abnormal or indeterminate. Disclosed example methods further include combining respective anomaly sizes and anomaly scopes determined for the respective ones of root cause abnormal nodes based on the measurements to determine respective rankings for the root cause abnormal nodes, and outputting the respective rankings to prioritize the set of root cause abnormal nodes.

Hierarchical anomaly localization and prioritization

Example methods disclosed herein to localize anomalies in a communication network include identifying a first set of abnormal nodes in the communication network, and including respective ones of the first set of abnormal nodes having a number of normal direct descendent nodes that is less than a combined number of abnormal direct descendent nodes and indeterminate direct descendent nodes in a set of candidate nodes. Such disclosed example methods also include iteratively selecting ones of the set of candidate nodes to include in a set of root cause abnormal nodes representing sources of the anomalies in the communication network. In such disclosed example methods, the ones of the set of candidate nodes are selected based on sizes of respective subsets of the abnormal nodes from the first set of abnormal nodes covered by the candidate nodes.

A technique for monitoring performance in a network uses passively monitored traffic data at the server access routers. The technique aggregates performance metrics into clusters according to a spatial hierarchy in the network, and then aggregates performance metrics within spatial clusters to form time series of temporal bins. Representative values from the temporal bins are then analyzed using an enhanced Holt-Winters exponential smoothing algorithm.

Passive and comprehensive hierarchical anomaly detection system and method

Methods, apparatus and articles of manufacture for hierarchical anomaly localization and prioritization are disclosed. An example method disclosed herein comprises obtaining reported status for a plurality of nodes of a hierarchical topology, the reported status for a particular node being at least one of normal, abnormal or indeterminate, and determining a subset of root cause abnormal nodes, a root cause abnormal node included in the subset of root cause abnormal nodes having a total number of abnormal direct descendent nodes and indeterminate direct descendent nodes that is greater than a number of normal direct descendent nodes of the root cause abnormal node.

Growing community of inventors

Morristown, NJ, United States of America

Hiren Shah