A computer-implemented method comprising: obtaining a set of data records, wherein the data records include respective pluralities of tuples characterizing operation of communication sessions in a network, wherein the tuples contain signatures representing features and values, wherein the features and values identify hardware or software components related to the network that were involved in the communication sessions; determining a 2-signature tuple present in at least one of the data records, wherein the 2-signature tuple is composed of a first signature and a second signature; calculating, for the 2-signature tuple, a first gain representing an overall relative inefficiency of the communication sessions involving the 2-signature tuple compared to relative inefficiencies of the communication sessions involving the first signature or the second signature; determining that the first gain exceeds a first pre-determined threshold, which, preferably, is between 0.05 and 0.4; based on determining that the first gain exceeds the first pre-determined threshold, (i) filtering the communication sessions involving the 2-signature tuple to create a subset of the communication sessions involving 1-signatures for which a size of the subset exceeds a second pre-determined threshold, which, preferably, is between 0.8 and 1.0, and (ii) calculating a second gain representing the overall relative inefficiency of the communication sessions involving the 2-signature tuple compared to relative inefficiencies of the communication sessions involving the 1-signatures for which the size of the subset exceeds the second pre-determined threshold; determining that the second gain exceeds the first pre-determined threshold; and based on determining that the second gain exceeds the first pre-determined threshold, identifying the features and values that are represented by the first signature and the second signature as units of the hardware or software components that are incompatible. obtaining a set of data records, wherein the data records include respective pluralities of tuples characterizing operation of communication sessions in a network, wherein the tuples contain signatures representing features and values, wherein the features and values identify hardware or software components related to the network that were involved in the communication sessions; determining a 2-signature tuple present in at least one of the data records, wherein the 2-signature tuple is composed of a first signature and a second signature; calculating, for the 2-signature tuple, a first gain representing an overall relative inefficiency of the communication sessions involving the 2-signature tuple compared to relative inefficiencies of the communication sessions involving the first signature or the second signature; determining that the first gain exceeds a first pre-determined threshold, which, preferably, is between 0.05 and 0.4; based on determining that the first gain exceeds the first pre-determined threshold, (i) filtering the communication sessions involving the 2-signature tuple to create a subset of the communication sessions involving 1-signatures for which a size of the subset exceeds a second pre-determined threshold, which, preferably, is between 0.8 and 1.0, and (ii) calculating a second gain representing the overall relative inefficiency of the communication sessions involving the 2-signature tuple compared to relative inefficiencies of the communication sessions involving the 1-signatures for which the size of the subset exceeds the second pre-determined threshold; determining that the second gain exceeds the first pre-determined threshold; and based on determining that the second gain exceeds the first pre-determined threshold, identifying the features and values that are represented by the first signature and the second signature as units of the hardware or software components that are incompatible.