Analysis and classification of network device alarm clusters

The application of machine learning and data mining has seen a rise over the past decade thanks to their recent success in different fields, ranging from computer vision, biomedical data analyses to natural language processing. The field of computer networks and network maintenance has also observed the application of such concepts. This thesis is a result of an ongoing collaboration with TIM SpA. Overall, the studies presented in this manuscript consist in the analysis of the alarms raised by TIM network devices both in mobile and transmission domains, with the ultimate goal of developing a real-time environment that can help technicians to quickly determine faults within their network and solve them faster. The first step of the thesis consists in studying the results obtained by an already existing clustering and data mining algorithms, which were developed ad-hoc in a previous study.The clustering algorithm groups alarms raised in similar space-time contexts and identifies critical events within the system. The basket analysis instead, which is the outcome of the data mining algorithm, is used to search correlations between the attributes of the alarms falling within the same cluster. Lastly, an existing exploratory dashboard was improved and extended. Consequently, the clusters were validated, thanks to analyzes to verify their effectiveness, with the approval of TIM domain experts. The clusters were subsequently enriched with additional fields and characterized by considering new types of alarms: alarms that involve more than a single device and specific alarms which are raised during planned maintenance operations. In the meantime, the dashboard was revisited and the necessary updates were implemented to display the extended analyses on the aforementioned new types of alarms. In the final phase, major focus was given to the specific alarms which are observed during maintenance operations and their respective clusters in order to study their characteristics and the impact of such alarms on the network. First of all, an analysis of the frequent patterns and the distributions of some significant attributes was carried out. Among the analyzed cases, one of the most relevant and recurrent alarm is related to the connection between two devices. Several machine learning models were implemented to verify whether there were distinguishable characteristics in the latter case of alarms and their consequent clusters with respect to others: a binary classification setup was adopted. For this purpose, also deep learning models were considered: alarms were analyzed using techniques adopted in the context of natural language processing. The obtained results revealed a strong similarity between the samples of the two aforementioned classes, highlighting the complexity of the problem and leaving room for further developments.