Source-linked AI summary
An Influence-based Approach for Root Cause Alarm Discovery in Telecom Networks
Keli Zhang, Marcus Kalander, Min Zhou, Xi Zhang, Junjian Ye
TL;DR
Large-scale alarm streams make accurate root-cause localization challenging, while graph-based approaches can require expert knowledge for edge pruning. The paper combines causal inference, network embedding, and influence maximization to rank root-cause alarms. It reports significant improvement over the best baseline on synthetic and real-world data.
Problem
Large telecom networks produce many interrelated alarms, making it challenging to identify the alarms most significant for efficient fault localization.
Source: §1 · p. 1Method
The framework uses HPCI to infer causal graph structure, CPBE to infer edge weights, and influence maximization to rank alarms in a real-time stream.
Source: §1 · p. 2, §5.2 · p. 6, §5.3 · p. 7Results
The method significantly improves over the best baseline on synthetic and real-world data; CPBE achieves 61.8% accuracy for K = 1.
Source: §6.2 · p. 10, §7 · p. 11Takeaways & Limitations
The system produces a ranking of crucial alarms intended to assist operators in locating network faults.
Source: §7 · p. 11CI testing assumes independent, identically distributed input, so alarm-window size must suit network characteristics and separate causal alarms within windows from independent data across windows.
Source: §3 · p. 4
Abstract
from arXiv · showhide
Alarm root cause analysis is a significant component in the day-to-day telecommunication network maintenance, and it is critical for efficient and accurate fault localization and failure recovery. In practice, accurate and self-adjustable alarm root cause analysis is a great challenge due to network complexity and vast amounts of alarms. A popular approach for failure root cause identification is to construct a graph with approximate edges, commonly based on either event co-occurrences or conditional independence tests. However, considerable expert knowledge is typically required for edge pruning. We propose a novel data-driven framework for root cause alarm localization, combining both causal inference and network embedding techniques. In this framework, we design a hybrid causal graph learning method (HPCI), which combines Hawkes Process with Conditional Independence tests, as well as propose a novel Causal Propagation-Based Embedding algorithm (CPBE) to infer edge weights. We subsequently discover root cause alarms in a real-time data stream by applying an influence maximization algorithm on the weighted graph. We evaluate our method on artificial data and real-world telecom data, showing a significant improvement over the best baselines.
1 Introduction
Large-scale cellular networks generate floods of alarms after a fault, making manual fault localization slow; the paper proposes an unsupervised data-driven approach to identify the alarms most useful for localization.
1 Introduction
- A single fault can trigger alarms across multiple devices, while only a subset is most significant for fault localization.The paper calls these the root cause alarms.Source: §1 · p. 1
- Many existing RCA methods rely on network-specific properties, integrated domain knowledge, or particular design decisions.The authors contrast these specialized approaches with inferring the analysis from data.Source: §1 · p. 2
- The proposed system infers an initial causal graph, adds edge weights with CPBE, then applies influence maximization to rank top-K probable root cause alarms.It operates on the subgraph of alarms involved when a failure occurs.Source: §1 · p. 2
- The contribution list presents HPCI as a Hawkes Process-based Conditional Independence test and CPBE as a network-embedding method for inferring causal-graph edge weights.The framework is described as unsupervised and as integrating causal inference with influence maximization.Source: §1 · p. 2
- The authors report extensive experiments on synthetic data and a real-world citywide dataset.The supplied contribution passage does not state the experimental outcome.Source: §1 · p. 2
2 Related work
Prior root-cause and graph-based approaches use diverse heuristics, domain knowledge, or causal-graph construction methods, with scalability and reliability concerns noted for some approaches.
Root cause alarms
- Some RCA methods are specialized to deployed networks through domain knowledge or design choices.Other data-driven approaches include pattern mining and combining knowledge modeling with Bayesian networks.Source: §2 · p. 2
Graph-based root cause analysis
- Sherlock requires exact conditional probabilities, while G-RCA uses a hand-configured causality graph described as unfeasible for large, dynamic environments.Other methods use topology-aware alarm clustering and association-rule mining.Source: §2 · p. 2
- CauseInfer and use the PC algorithm to estimate DAGs, but the passage says such graphs can be unreliable.Other approaches estimate causal relations with co-occurrence and Bayesian decision theory, or use FP-Growth and lag correlation with expert feedback.Source: §2 · p. 2
3 Preliminaries
The preliminaries introduce Hawkes processes for modeling event sequences and the PC algorithm for causal-structure discovery, including the conditional-independence tests and assumptions relevant to alarm data.
Hawkes Process
- A Hawkes process models continuous-time event sequences in which past events can excite the probability of future events.Its conditional intensity represents the occurrence rate conditioned on past events.Source: §3 · p. 3
- In the exponential-kernel form, µ_u is the background intensity, while α_uv captures influence from type-v events to type-u events and β_uv controls its decay rate.The influence matrix A is described as reflecting causality between event types.Source: §3 · p. 3
- Because the influence matrix is generally sparse or low-rank, penalties such as Lasso and nuclear norms can constrain it.The cited example uses a mix of the two norms.Source: §3 · p. 3
PC Algorithm
- The PC algorithm learns directed acyclic graphs by using conditional-independence tests to remove or retain edges at a significance threshold.The G-square test targets categorical variables and the Fisher-Z test uses Pearson correlation.Source: §3 · pp. 3–4
- For alarm data, the CI-test time window must fit network characteristics and ensure causal alarms occur within a window while data across windows are independent.The tests assume input observations are independent and identically distributed.Source: §3 · p. 4
4 System Overview
The system periodically constructs an influence graph from historical alarm transactions and uses it to rank alarms involved in a real-time failure.
4 System Overview
- Alarm preprocessing filters and aggregates alarms with network topology in mind and is shared across the system's two procedures.Those procedures are influence-graph creation and alarm ranking.Source: §4 · p. 4
- Historical alarm transactions supply a graph whose alarm-type nodes are connected by inferred relations, with HPCI learning structure and CPBE inferring edge weights.The graph is periodically recreated.Source: §4 · p. 4
- When a failure occurs, the system combines involved alarms with the graph and ranks them by influence to provide operators top-K probable root-cause candidates.The alarm stream is monitored in real time.Source: §4 · p. 4
5 Methodology
The methodology converts alarm records into transactions, learns a causal graph and embeds it into a weighted influence graph, then ranks alarms within transaction-specific subgraphs.
5.1 Data and Alarm Preprocessing
- Raw alarms are aggregated by connected network subgraph, time-windowed into sequences, then collapsed into transactions with one entry per alarm type, earliest time, and occurrence count.The time-window size can be adjusted to network characteristics.Source: §5.1 · p. 5
5.2 Alarm Influence Graph Construction
- HPCI retains positive Hawkes influence edges, removes redundant or indirect edges with conditional-independence tests, then removes weakest edges until the causal graph is a DAG.The procedure uses alarm sequences for Hawkes inference and alarm transactions for conditional-independence testing.Source: §5.2 · pp. 5–6
- CPBE generates node-specific contexts by traversing causal propagation graphs filtered to each historical transaction, learns node embeddings with skip-gram, and weights edges by cosine similarity.The traversal considers only nodes causally related to the node being embedded.Source: §5.2 · pp. 6–7
5.3 Root Cause Alarm Influence Ranking
- For each transaction, the system retains present alarms and applicable weighted edges in a propagation subgraph, then ranks that subgraph independently using independent-cascade influence maximization and IRIE.The learned edge weights correspond to the activation probabilities in the diffusion model.Source: §5.3 · p. 7
6 Evaluation
The evaluation tests causal-graph correctness on synthetic and real-world data, then measures root-cause identification on real-world alarm transactions. CPBE leads the tested edge-weight strategies across K, while HPCI generally performs best on causal-graph precision and F1.
6 Evaluation
- The real-world dataset contains 672,639 alarms from 3,818 devices and 78 alarm types; causal-graph evaluation uses 44 known edges among 15 alarm types.The 6,000 transactions with labeled root-cause alarms are a random sample.Source: §6 · p. 8
6.1 Causal Graph Structure Correctness
- Causal-graph evaluation compares HPCI with PC-GS, PC-FZ, PCTS, and HPADM4, using a 0.05 CI-test significance level and a 300-second event window.The synthetic data varies event-type count and α; the real-world causal graph is evaluated against known causal relations.Source: §6.1 · pp. 8–9, Table 1 · p. 9, Table 2 · p. 10
- On synthetic data, HPCI has the best F1-scores in nearly all settings, except HPADM4 at N = 10 and low α.The authors attribute HPADM4's exception to sparse event intervals; at higher N or α, denser events make Hawkes processes less able to distinguish instantaneous causal relations, which CI tests help HPCI identify.Source: Table 1 · p. 9, §6.1 · p. 9
- On real-world data, HPCI significantly outperforms all baselines in precision and F1-score, while PCTS has the highest recall but significantly lower precision.The authors report that PCTS's lower precision indicates more false positives.Source: Table 2 · p. 10, §6.1 · p. 10
6.2 Root Cause Alarm Identification
- CPBE's outcome on the real-world data is insensitive to the tested traversal strategies and Skip-gram window and vector-length choices.The tested choices include RandomWalk, BFS, and DFS; w ∈ [1, 5] and L ∈ [10, 30].Source: §6.2 · p. 10
- 61.8% accuracy at K = 1; CPBE outperforms the baselines for every tested K in root-cause alarm identification.The evaluation uses IRIE to rank alarms in 6,000 labeled transactions.Source: §6.2 · p. 10, Table 3 · p. 11
- CPBE takes around 10 seconds, while IRIE takes 325 seconds for all 6,000 alarm transactions.The authors judge this runtime fast enough for system deployment.Source: §6.2 · p. 11
7 Conclusion
The conclusion presents a framework for finding telecom-network root-cause alarms without expert knowledge. It combines HPCI causal inference and CPBE edge weighting, and reports improvements over baselines on synthetic and real-world data.
7 Conclusion
- The framework constructs an alarm influence graph from historical alarm data and ranks likely root-cause alarms through influence maximization.It is intended for identifying root causes of network faults in large telecom networks without relying on expert knowledge.Source: §7 · p. 11
- HPCI infers causal structure, while CPBE infers network edge weights using a network-embedding-based algorithm.Together, the methods form the framework's alarm influence graph.Source: §7 · p. 11
- The authors report significant improvement over the best baseline on synthetic and real-world data, and better root-cause identification than the baselines.Source: §7 · p. 11