A device retrieves a first subset of events from data associated with a network, and determines one or more discriminating features of the first subset of events using a feature selection method. The device also retrieves one or more additional subsets of events, different than the first subset of events, from the data associated with the network, and cross validates the one or more discriminating features based on the one or more additional subsets of events. The device further detects a feature that is a root cause of a problem in the network based on the cross validated one or more discriminating features.