International Business Machines Corporation

Vmware, Inc.

Nyansa, Inc.

Murtaza Zafer

Anand Srinivas

Dakshi Agrawal

Kang-Won Lee

Bong Jun Ko

Ramya Raghavendra

Balachander Chandrasekaran

Dinesh C Verma

Chatschik Bisdikian

Douglas Morgan Freimuth

Seraphin Bernard Calo

Theodoros Salonidis

Stephen Craig Connors

Bongjun Ko

Ting He

Vinay Kumar Kolar

Ho Yin Starsky Wong

Brennan Marshall Young

Yunxi Li

Akhilesh Gadde

Abm Musa

S M S Hossain

Mudhakar Srivatsa

Qing Fa Wang

Vasileios Pappas

Yonghua Lin

Navaneeth Krishnan Ramaswamy

Hugo M Krawczyk

Kristian Jon Stewart

Matthew Edward Duggan

Rosario Gennaro

Hai Zhan

Tal D Rabin

Gopa Kumar

Cagatay Capar

Some embodiments of the invention provide a method of detecting and remediating anomalies in an SD-WAN implemented by multiple forwarding elements (FEs) located at multiple sites connected by the SD-WAN. The method receives, from the multiple FEs, multiple sets of flow data associated with application traffic that traverses the multiple FEs. The method uses a first set of machine-trained processes to analyze the multiple sets of flow data in order to identify at least one anomaly associated with at least one particular FE in the multiple FEs. The method uses a second set of machine-trained processes to identify at least one remedial action for remediating the identified anomaly. The method implements the identified remedial action by directing an SD-WAN controller deployed in the SD-WAN to implement the identified remedial action.

Identifying and remediating anomalies in a self-healing network

Some embodiments of the invention provide a method of remediating anomalies in an SD-WAN implemented by multiple forwarding elements (FEs) located at multiple sites connected by the SD-WAN. The method is performed iteratively. The method receives multiple performance metrics that over a duration of time express a performance of the SD-WAN for at least one particular application associated with flows that traverse the SD-WAN during the time duration. The method uses the received performance metrics to update generated weight values for a topology graph that includes (1) multiple nodes representing the multiple FEs and (2) multiple edges between the multiple nodes representing paths traversed between the FEs by the flows associated with the particular application, said generated weight values associated with said paths. The method uses a topology-based machine-trained process to analyze the topology graph with the generated weight values in order to identify an anomaly in the topology graph that is indicative of an anomaly the SD-WAN for the particular application's traffic flows. For an identified anomaly, the method implements a remedial action to modify the SD-WAN in order to remediate the identified anomaly.

Some embodiments of the invention provide a method of dynamically scaling a hub cluster in a software-defined wide area network (SD-WAN) based on particular traffic statistics, the hub cluster being located in a datacenter of the SD-WAN and allowing branch sites of the SD-WAN to access resource of the datacenter by connecting to the hub cluster. A controller of the SD-WAN receives, from the hub cluster, traffic statistics centrally captured at the hub cluster. The controller then analyzes these statistics to identify traffic load fluctuations, and determines that a number of hubs in the hub cluster should be adjusted based on the identified fluctuations. The controller adjusts the number of hubs in the hub cluster based on the determination.

Dynamic SD-WAN hub cluster scaling with machine learning

A system and method is disclosed of extracting information from real-time network packet data to analyze connectivity data for client devices in a network. The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to either reach or fail to reach a network connected state; after waiting a period of time, recording connectivity event information; and sending the recorded connectivity event information to an analytics system for network incident and/or network congestion analysis.

System and method for using real-time packet data to detect and manage network issues

A method for analyzing network incidents within a network and providing prioritized remediation recommendations is disclosed. The method includes: receiving network data and computing a plurality of network incidents from the network data, collecting network incidents related to a particular network issue over a time period and grouping the network incidents according to root-cause symptoms, generating a network incident graph by superimposing groups of network incidents over a network graph, analyzing the network incident graph to identify localized areas with systemic issues; and based on the analysis of the network incident graph, generating and displaying a list of remediation recommendations. Each remediation recommendation includes a systemic issue in the network, a remediation to resolve the issue, and a quantified expected benefit from implementing the remediation.

System and method for network incident remediation recommendations

A method, system and computer program product for adaptive system monitoring. In one embodiment, the method comprises generating time-varying correlation graphs indicating correlations between a multitude of parameters of the system, and using the correlation graphs to identify monitoring logic for monitoring the system. In an embodiment, the correlation graphs are used to select a group of the parameters as monitoring parameters, and these monitoring parameters are dynamically changed. In one embodiment, the monitoring parameters form sets of monitoring parameters, and each set of monitoring parameters is used to monitor the system for an associated period of time. The lengths of these monitoring periods are changed based on the rate of change of the correlation graphs. In an embodiment, the rate at which the monitoring parameters are changed is itself changed based on the rate of change of the correlation graphs.

Correlation based adaptive system monitoring

A system and method is disclosed of extracting information from real-time network data to analyze roaming data for client devices in a network. The method includes: detecting when the client devices initiate roaming association events, buffering other data regarding the detected roaming association events, sending roaming event information to an analytics system for network incident and network congestion analysis, analyzing the roaming event information, identifying one or more root causes of the detected network incidents; and determining remediation of the identified one or more root causes of the detected network incidents.

A system and method for client network congestion analysis and management is disclosed. According to one embodiment, the method includes: collecting real-time network data; executing calculations on the real-time network data to compute performance metrics; detecting peak usage time; and detecting one or more congestion incidents, wherein a congestion incident comprises a persistence of one or more metrics over a time window that comprises detecting a proportion of metric values crossing a threshold that exceeds a defined percentage amount, detecting a time-ordered stretch of metric values that exceeds a defined threshold, or combinations thereof.

System and method for client network congestion detection, analysis, and management

A system and method for automatic detection of a network incident from real-time network data is disclosed. The method includes: collecting real-time network data; executing performance calculations on the real-time network data to compute performance metrics; and detecting a pattern over a time window, wherein detecting a pattern includes detecting a proportion of metric values crossing a threshold exceeding a defined percentage amount, detecting a presence of a sequence of metric values, detecting a time-ordered stretch of metric values with a length of the time-ordered stretch exceeding a defined threshold, detecting a cyclical presence of a sequence of metric values, or combinations thereof.

System and method for network incident identification and analysis

Various embodiments manage service issues within a wireless communication network. In one embodiment, a one or more call detail records associated with a set of wireless communication devices of a wireless communication network is received. A set of information within each of the one or more call detail records is compared to a baseline statistical model. The baseline statistical model identifies a normal operating state of the wireless communication network. At least one outlier call detail record in the one or more call detail records is identified based on the comparison. The at least one outlier call detail record indicates that at least one wireless communication device associated with the at least one outlier call detail record experienced one or more service issues.

Localizing faults in wireless communication networks

Techniques for resource sharing among wireless service providers in a wireless network cloud (WNC) are provided. In one aspect, a method for spectrum sharing in a WNC that hosts multiple wireless service providers is provided. The method includes the following steps. A spectrum usage is predicted for each of the wireless service providers during a given future time-window. An excess amount of spectrum, if any, each of the wireless service providers will have during the given time-window is determined. The excess amount of spectrum is allocated from the wireless service providers having the excess amount of spectrum to those of the wireless service providers having a spectrum usage that will exceed an allocated spectrum capacity during the given time-window.

Resource sharing among multiple service providers in a wireless network cloud

Growing community of inventors

White Plains, NY, United States of America

Murtaza Zafer