The disclosure relates to technology for determining a root cause of anomalous behaviors in networks. First indicators (KQIs) are categorized into first groups (states) and second indicators (KPIs) are categorized into second groups. A conditional probability is estimated by calculating a probability that the second indicators will result in degradation of the first indicators based on historical data using association rule learning. The second indicators having the conditional probability associated with degradation of the first indicators are mapped to a corresponding one of the first groups in a probabilistic network structure based on a detected degradation of the first indicators in the historical data. Then it is determined whether the second indicators mapped to the corresponding first groups satisfy a threshold when degradation of the first indicators is detected, and each of the second indicators resulting in degradation of the first indicator are ranked according to a corresponding conditional probability.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method for determining a root cause of anomalous behaviors in a network, comprising categorizing each of one or more first indicators into a corresponding one of a plurality of first groups and each of one or more second indicators into a corresponding one of a plurality of second groups; estimating a conditional probability by calculating a probability that the one or more second indicators will result in a degradation of one of the first indicators based on historical data of the one or more first and second indicators using association rule learning; mapping the one or more second indicators having the conditional probability associated with degradation of the one of the first indicators to a corresponding one of the plurality of first groups in a probabilistic network structure based on a detected degradation of the one of the first indicators in the historical data; and determining whether the one or more second indicators mapped to the corresponding one of the plurality of first groups satisfies a threshold when degradation of the one of the first indicators is detected, and ranking each of the one or more second indicators that results in the degradation of the one of the first indicators according to a corresponding conditional probability. 2. The method of claim 1, further comprising outputting a list of the root causes for the degraded one of the first indicators based on the conditional probability associated with each of the one or more second indicators satisfying the threshold. 3. The method of claim 1, further comprising receiving a first data set including the one or more first indicators indicative of a quality of service associated with a source in the network, and receiving a second data set including the one or more second indicators indicative of a performance level associated with the source in the network. 4. The method of claim 3, further comprising: collecting the first data set and the second data set over a time interval; and quantizing the collected first data set and the second data set to define the first and second groups. 5. The method of claim 1, further comprising: constructing a data tree including one of the first indicators and the second indicators from one of the plurality of first groups and the plurality of second groups, respectively, that includes at least one rare indicator; and extracting at least one of frequent items, data rules and associated probabilities from the data tree by application of the association rule learning, wherein the frequent items model a co-occurrence of different items and the data rules model a relationship between the first and second indicators based on the associated probabilities. 6. The method of claim 1, further comprising: traversing the probabilistic network structure to predict a root cause set associated with degradation of a first indicator, wherein the root cause set comprises one or more of the second indicators; and adjusting the probabilistic network structure based on changes to the probabilities between the first indicators and one or more of the second indicators. 7. The method of claim 1, wherein the association rule learning is implemented using at least one of a modified FP-growth algorithm and a bottom-up algorithm. 8. The method of claim 1, wherein the conditional probability is defined by Pij=P(KQIjε[dlj,duj]|KPIiε[tli,tui]), where d and t are pre-defined thresholds. 9. The method of claim 1, wherein the thresholds are time-varying for different time slots. 10. The method of claim 1, wherein the threshold is one of lift, support and confidence. 11. The method of claim 10, wherein the data rules are ranked according to a measured value of at least one of the lift, the support and the confidence, where Lift = P   ( A ⋂ B ) P   ( A )  P   ( B ) ,  Support = count   ( A ⋂ B ) count   ( D ) , and  Confidence = count   ( A ⋂ B ) count   ( A ) , where P is defined as a pattern, D is defined as a total of the first and second data sets, and A and B are defined as variables representing data in the first and second data sets. 12. The method of claim 1, wherein the probabilistic network structure is a probabilistic finite state machine. 13. A non-transitory computer-readable medium storing computer instructions for determining a root cause of anomalous behaviors in a network, that when executed by one or more processors, perform the steps of: categorizing each of one or more first indicators into a corresponding one of a plurality of first groups and each of one or more second indicators into a corresponding one of a plurality of second groups; estimating a conditional probability by calculating a probability that the one or more second indicators will result in a degradation of one of the first indicators based on historical data of the one or more first and second indicators using association rule learning; mapping the one or more second indicators having the conditional probability associated with degradation of the one of the first indicators to a corresponding one of the plurality of first groups in a probabilistic network structure based on a detected degradation of the one of the first indicators in the historical data; and determining whether the one or more second indicators mapped to the corresponding one of the plurality of first groups satisfies a threshold when degradation of the one of the first indicators is detected, and ranking each of the one or more second indicators that results in the degradation of the one of the first indicators according to a corresponding conditional probability. 14. The non-transitory computer-readable medium of claim 13, the one or more processors further performing the step of outputting a list of the root causes for the degraded one of the first indicators based on the conditional probability associated with each of the one or more second indicators satisfying the threshold. 15. The non-transitory computer-readable medium of claim 13, the one or more processors further performing the step of receiving a first data set including the one or more first indicators indicative of a quality of service associated with a source in the network, and receiving a second data set including the one or more second indicators indicative of a performance level associated with the source in the network. 16. The non-transitory computer-readable medium of claim 15, the one or more processors further performing the steps of: collecting the first data set and the second data set over a time interval; and quantizing the collected first data set and the second data set to define the first and second groups. 17. The non-transitory computer-readable medium of claim 13, the one or more processors further performing the steps of: constructing a data tree including one of the first indicators and the second indicators from one of the plurality of first groups and the plurality of second groups, respectively, that includes at least one rare indicator; and extracting at least one of frequent items, data rules and associated probabilities from the data tree by application of the association rule learning, wherein the frequent items model a co-occurrence of different items and the data rules model a relationship between the first and second indicators based on the associated probabilities. 18. The non-transitory computer-readable medium of claim 13, the one or more processors further performing the steps of: traversing the probabilistic network structure to predict a root cause set associated with degradation of a first indicator, wherein the root cause set comprises one or more of the second indicators; and adjusting the probabilistic network structure based on changes to the probabilities between the first indicators and one or more of the second indicators. 19. The non-transitory computer-readable medium of claim 13, wherein the association rule learning is implemented using at least one of a modified FP-growth algorithm and a bottom-up algorithm. 20. The non-transitory computer-readable medium of claim 13, wherein the conditional probability is defined by Pij=P(KQIjε[dlj,duj]|KPIiε[tli,tui]), where d and t are pre-defined thresholds. 21. The non-transitory computer-readable medium of claim 13, wherein the thresholds are time-varying for different time slots. 22. The non-transitory computer-readable medium of claim 13, wherein the probabilistic network structure is a probabilistic finite state machine. 23. A device for determining a root cause of anomalous behaviors in a network, comprising: a non-transitory memory storing instructions; and one or more processors in communication with the non-transitory memory, wherein the one or more processors execute the instructions to: categorize each of one or more first indicators into a corresponding one of a plurality of first groups and each of one or more second indicators into a corresponding one of a plurality of second groups; estimate a conditional probability by calculating a probability that the one or more second indicators will result in a degradation of one of the first indicators based on historical data of the one or more first and second indicators using association rule learning; map the one or more second indicators having the conditional probability associated with degradation of the one of the first indicators to a corresponding one of the plurality of first groups in a probabilistic network structure based on a detected degradation of the one of the first indicators (KQIs) in the historical data; and determine whether the one or more second indicators mapped to the corresponding one of the plurality of first groups satisfies a threshold when degradation of the one of the first indicators is detected, and rank each of the one or more second indicators that results in the degradation of the one of the first indicators according to a corresponding conditional probability. 24. The device of claim 23, the one or more processors further execute the instructions to output a list of the root causes for the degraded one of the first indicators based on the conditional probability associated with each of the one or more second indicators satisfying the threshold. 25. The device of claim 23, the one or more processors further execute the instructions to: construct a data tree including one of the first indicators and the second indicators from one of the plurality of first groups and the plurality of second groups, respectively, that includes at least one rare indicator; and extract at least one of frequent items, data rules and associated probabilities from the data tree by application of the association rule learning, wherein the frequent items model a co-occurrence of different items and the data rules model a relationship between the first and second indicators based on the associated probabilities. 26. The device of claim 23, the one or more processors further execute the instructions to: traverse the probabilistic network structure to predict a root cause set associated with degradation of a first indicator, wherein the root cause set comprises one or more of the second indicators; and adjust the probabilistic network structure based on changes to the probabilities between the first indicators and one or more of the second indicators.