US 12,095,606 B1
Significance ordered prefix tree for compute-efficient root cause investigation
Mengmeng Jie, Kirkland, WA (US); and Giancarlo Devich, Woodinville, WA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on Oct. 31, 2023, as Appl. No. 18/498,197.
Int. Cl. G06F 15/16 (2006.01); H04L 41/0604 (2022.01); H04L 41/0631 (2022.01); H04L 43/065 (2022.01)
CPC H04L 41/0636 (2013.01) [H04L 41/0604 (2013.01); H04L 43/065 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method of identifying cohorts of telemetry point values that are statistically significant indicators of a computing event satisfying a condition of interest, the method comprising:
computing Z-scores for a set of telemetry point values included in an event-based data set that includes telemetry data for multiple computing events;
identifying, based on the Z-scores, significant telemetry point values that are statistically significant indicators of the condition of interest;
generating a significance-ordered prefix tree based on the significant telemetry point values and the Z-scores, the significance-ordered prefix tree having different hierarchical levels populated with nodes corresponding to the significant telemetry point values and edges connecting nodes storing pairs of the significant telemetry point values co-observed with respect to one or more events of multiple computing events;
for each path of multiple different paths within the significance-ordered prefix tree, compute a cohort Z-score for a cohort comprising the significant telemetry point values corresponding to nodes along the path; and
based on the cohort Z-score computed for the cohorts corresponding to the multiple different paths, identifying a subset of the cohorts that are statistically significant indicators of the condition of interest; and
using the subset of cohorts to identify a root cause of the condition of interest.