Abstract: Some embodiments provide a method for reporting potential root causes of incidents within a network. The method identifies a first network entity as a potential root cause of an incident affecting a second network entity. For each network entity of a set of network entities in a dependency chain beginning with the first network entity and ending with the second network entity, the method assigns a label to the network entity based on measured metrics of the network entity. The method uses a state machine that encodes causality between different network entity labels to generate a human-readable explanation for the first network entity causing the incident affecting the second network entity.

Abstract: Some embodiments provide a method for evaluating incidents within a network. The method receives notification of a first incident related to a first network entity and a second incident related to a second network entity. In response to the respective notifications of the first and second incidents, the method uses network monitoring data to generate a first component graph of a first portion of the network that includes the first network entity and a second component graph of a second portion of the network that includes the second network entity. The first and second component graphs respectively include first and second sets of network entities related to the first and second network entities according to the network monitoring data. The method uses the first and second component graphs to respectively identify root causes of the first and second incidents.

Abstract: Some embodiments provide a method for identifying root causes of incidents within a network. The method receives a graph of a portion of the network related to a particular network entity for which an incident is reported. The graph specifies dependencies between neighboring network entities in the network. The method uses probabilistic analysis to determine, for each network entity of a set of network entities represented in the graph, whether adjusting a set of metrics of the entity affects one or more metrics of the particular network entity that have been diagnosed as indicative of a problem. The method reports a subset of the network entities with metrics that affect the one or more metrics of the particular network entity as potential root causes of the incident.

Abstract: Some embodiments provide a method for evaluating a network correctness requirement at an evaluation program instance assigned to evaluate a particular network correctness requirement. The method identifies data message properties associated with the particular network correctness requirement. The method evaluates the particular network correctness requirement by (i) determining a path through a set of network devices for a data message having the identified data message properties and (ii) from a data storage that stores data message processing rules for a plurality of network devices including the set of network devices and additional network devices, retrieving and storing in memory data specifying data message processing rules for the set of network devices to use in evaluating the particular network correctness requirement.

Abstract: Some embodiments provide a method for evaluating a network. The method identifies multiple network correctness requirements configured for the network. The method instantiates a separate respective evaluation program instance for each respective identified network correctness requirement to evaluate the respective network correctness requirement. At least two evaluation program instances are instantiated on different machines. Each respective evaluation program instance stores in a respective memory a respective set of network device data to evaluate the respective network correctness requirement. Each set of network device data requires less memory than storing network device data for the entire network.

Abstract: Some embodiments provide a method for an orchestration program instance assigned a particular network device in a network. Each network device of multiple network devices is assigned to a different orchestration program instance in a cluster. The method receives a notification message that a configuration for the particular network device has been modified. In response to the notification message, the method identifies a set of network correctness requirements to be evaluated for the network. The method sends a separate notification message for each identified network correctness requirement specifying that the particular network device configuration has been modified so that a set of evaluation program instances can re-evaluate any network correctness requirements dependent on the particular network device.

Abstract: A search engine queries a network model for behavior of the entire network, such as data flow, based on combinations of multiple network elements. The search engine provides the state information and/or predicted behavior of the network by searching network objects in a graph-based model or a network state database that satisfy constraints given in a search query. The search engine provides the state information and/or predicted behavior based on regular-expression or plain language search expressions that do not provide packet header information. The search engine parses such search expression into a sequence of atoms that encode forwarding paths of interest to the user. A flow path through the modeled network can be generated dynamically, within the context of the search queries.

Abstract: A search engine queries a network model for behavior of the entire network, such as data flow, based on combinations of multiple network elements. The search engine provides the state information and/or predicted behavior of the network by searching network objects in a graph-based model or a network state database that satisfy constraints given in a search query. The search engine provides the state information and/or predicted behavior based on regular-expression or plain language search expressions that do not provide packet header information. The search engine parses such search expression into a sequence of atoms that encode forwarding paths of interest to the user. A flow path through the modeled network can be generated dynamically, within the context of the search queries.

Abstract: Automated computer-implemented processes and systems are directed to troubleshooting a network used by an application in a data center. The processes and system execute a framework for automated network troubleshooting of an application. The framework performs automated fault localization by traversing a dependency graph that models the network from the observed performance problem, guided by the causality relationships, and for each edge of the graph, performs a test to determine problem causality, terminates at a set of well-defined criteria, and outputs at least one potential root cause for the application performance problem.

Abstract: System and method for relation extraction using adaptive thresholding and localized context pooling (ATLOP). The system includes a computing device, the computing device has a processer and a storage device storing computer executable code. The computer executable code is configured to provide a document; embed entities in the document into embedding vectors; and predict relations between a pair of entities in the document using their embedding vectors. The relation prediction is performed based on an improved language model. Each relation has an adaptive threshold, and the relation between the pair of entities is determined to exist when a logit of the relation between the pair of entities is greater than a logit function of the corresponding adaptive threshold.

Abstract: System and method for relation extraction using adaptive thresholding and localized context pooling (ATLOP). The system includes a computing device, the computing device has a processer and a storage device storing computer executable code. The computer executable code is configured to provide a document; embed entities in the document into embedding vectors; and predict relations between a pair of entities in the document using their embedding vectors. The relation prediction is performed based on an improved language model. Each relation has an adaptive threshold, and the relation between the pair of entities is determined to exist when a logit of the relation between the pair of entities is greater than a logit function of the corresponding adaptive threshold.

Abstract: Systems for and methods of modelling, analyzing and managing data networks are provided. In an embodiment, a plurality of network device interfaces are configured to collect state information for a plurality of network devices. A computer-implemented model of the network comprises a data structure, which may be graph-based. The data structure comprises a plurality of snapshots of the network, each snapshot representing the network at a particular point in time, and the data structure comprises a representation of possible data flow and data packet processing within the network. The data structure contains normalized representations of the network devices corresponding to the location. The normalized representation for each device contains a set of packet processing rules. A user-interface is configured to receive queries from a user that request verification of network policies and predictions of network behavior.