Threshold selection for kpi candidacy in root cause analysis of network issues

Abstract

In one embodiment, a network assurance service that monitors a network maps time series of values of key performance indicator (KPIs) measured from the network to lists of unique values from the time series. The service sets a target alarm rate for anomaly detection alarms raised by the network assurance service. The service uses an optimization function to identify a set of thresholds for the KPIs. The optimization function is based on: a comparison between the target alarm rate and a fraction of network issues flagged by the service as outliers, KPI thresholds selected based on the lists of unique values from the time series, and a number of thresholds that the KPIs must cross for the service to raise an alarm. The service raises an anomaly detection alarm for the monitored network based on the identified set of thresholds for the KPIs.

What is claimed is: 
     
         1 . A method comprising:
 mapping, by a network assurance service that monitors a network, time series of values of key performance indicator (KPIs) measured from the network to lists of unique values from the time series;   setting, by the network assurance service, a target alarm rate for anomaly detection alarms raised by the network assurance service;   using, by the network assurance service, an optimization function to identify a set of thresholds for the KPIs, wherein the optimization function is based on: a comparison between the target alarm rate and a fraction of network issues flagged by the service as outliers, KPI thresholds selected based on the lists of unique values from the time series, and a number of thresholds that the KPIs must cross for the service to raise an alarm; and   raising, by the network assurance service, an anomaly detection alarm for the monitored network based on the identified set of thresholds for the KPIs.