| CPC H04L 41/12 (2013.01) [H04L 41/147 (2013.01)] | 27 Claims |

|
1. One or more non-transitory computer readable media comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:
determining network topology information for a plurality of time periods, the network topology information comprising, for individual time periods of the plurality of time periods:
a plurality of entities associated with the network topology,
a plurality of relationships between the plurality of entities, and
health metrics of the plurality of entities;
storing, in a topology log, the network topology information for the individual time periods in association with the health metrics of the plurality of entities for the individual time periods;
based on the topology log, predicting characteristics of the network topology for a future time period;
selecting a subset of the network topology for anomaly detection analysis;
determining that predicted characteristics of a threshold number of nodes in the subset of the network topology meet at least one anomaly detection criteria;
responsive to determining that predicted characteristics of a threshold number of nodes in the subset of the network topology meet the at least one anomaly detection criteria, predicting an anomaly corresponding to the subset of the network topology for the future time period based on the predicted characteristics, wherein the subset of the network topology comprises two or more nodes of the network topology;
determining a candidate remediation for the subset of the network topology based on the predicted anomaly for the subset of the network topology; and
presenting, using a computer-user interface, the candidate remediation for the subset of the network topology.
|