# Human readable network troubleshooting based on anomaly detection and feature scoring

arXiv: https://arxiv.org/abs/2108.11807 · HTML: https://mlsanity.com/paper/2108.11807/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 55 references that are in the map.
- First posted on arXiv 26 Aug 2021.

## Builds on (most cited first, 4 of 4)

- [A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data](https://mlsanity.com/paper/1811.08055/) (2018)
- [Sequential Feature Explanations for Anomaly Detection](https://mlsanity.com/paper/1503.00038/) (2015)
- [HURRA! Human readable router anomaly detection](https://mlsanity.com/paper/2107.11078/) (2021)
- [CloudDet: Interactive Visual Analysis of Anomalous Performances in Cloud Computing Systems](https://mlsanity.com/paper/1907.13187/) (2019)

## Built on by (most cited first, 4 of 4)

- [A Closer Look at AUROC and AUPRC under Class Imbalance](https://mlsanity.com/paper/2401.06091/) (2024)
- [Landing AI on Networks: An equipment vendor viewpoint on Autonomous Driving Networks](https://mlsanity.com/paper/2205.08347/) (2022)
- [From Explanation to Action: An End-to-End Human-in-the-loop Framework for Anomaly Reasoning and Management](https://mlsanity.com/paper/2304.03368/) (2023)
- [Anomaly Detection for IoT Global Connectivity](https://mlsanity.com/paper/2508.09660/) (2025)

## Abstract (arXiv)

Network troubleshooting is still a heavily human-intensive process. To reduce the time spent by human operators in the diagnosis process, we present a system based on (i) unsupervised learning methods for detecting anomalies in the time domain, (ii) an attention mechanism to rank features in the feature space and finally (iii) an expert knowledge module able to seamlessly incorporate previously collected domain-knowledge. In this paper, we thoroughly evaluate the performance of the full system and of its individual building blocks: particularly, we consider (i) 10 anomaly detection algorithms as well as (ii) 10 attention mechanisms, that comprehensively represent the current state of the art in the respective fields. Leveraging a unique collection of expert-labeled datasets worth several months of real router telemetry data, we perform a thorough performance evaluation contrasting practical results in constrained stream-mode settings, with the results achievable by an ideal oracle in academic settings. Our experimental evaluation shows that (i) the proposed system is effective in achieving high levels of agreement with the expert, and (ii) that even a simple statistical approach is able to extract useful information from expert knowledge gained in past cases, significantly improving troubleshooting performance.