Patent ID: 7813298

Claim:
A method, performed by a device associated with a network, comprising: retrieving, by the device, a first subset of events for analysis from data associated with the network; determining one or more discriminating features of the first subset of events using a feature selection method; retrieving one or more additional subsets of events, different than the first subset of events, for analysis from the data associated with the network; cross validating the one or more discriminating features based on the one or more additional subsets of events; and detecting a feature that is a root cause of a problem in the network based on the cross validated one or more discriminating features; wherein detecting a feature that is a root cause of a problem in the network further comprising: counting, if a feature has more than one value, a number of times a value resulted in a failure and a number of times the value resulted in a non-failure; determining a ratio of failures to non-failures for each value; and determining a value with a highest ratio to be the root cause of the problem.