Service impact event analyzer for cloud SDN service assurance

• US 10,148,489 B2
• Filed: 09/01/2015
• Issued: 12/04/2018
• Est. Priority Date: 09/01/2015
• Status: Active Grant

• Current Assignee: Atlassian US, Inc. (Atlassian Corporation)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Wu, Tsong-Ho, Li, Wen-Jui, Lee, Shyhyann, Sun, Li-Chuan
• Primary Examiner(s): Vu, Viet D
• Assistant Examiner(s): Edwards, James A
• Application Number:
  US14/841,766
• Publication Number:
  US 20170063599A1
• Time in Patent Office: 1,190 Days
• Field of Search: None
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/091 Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV

Abstract

A service impact event analyzer is used to evaluate service assurance risk in cloud SDN networks. Using data fusion, an alarm subset dataset is generated from a raw trap dataset. Service impact events are identified in the subset dataset. The service impact events are categorized into service impacted event categories, and a model is created for associating the event categories with process function classes. Time durations of the service impact events are computed using correlated secondary alarms from the alarm subset dataset. The service assurance risk is evaluated using the model and the time duration.

Claims

1. A method, comprising:

identifying service impact events in an alarm dataset from a cloud software defined network, the service impact events including service alarms;

identifying alarm sources associated with the service impact events;

identifying impacted network service alarms provided in the cloud software defined network, the impacted network service alarms being identified according to the alarm sources;

identifying service alarm type classifications for the impacted network service alarms;

by a processor of a service impact event analyzer, identifying a service impact model comprising the service alarm type classifications and the service impact events, the model describing impacts of the service impact events on network services;

using the service impact model, identifying association rules of parent and child event relationships of a particular service impact event of the service impact events, so that a parent event is determined to be a primary event for root causes of trouble, and child events are determined to be correlated to the parent event, the parent event comprising a parent event time interval beginning at a parent event onset time and ending at a parent event clear time later than the parent event onset time, each child event comprising a child event time interval beginning at a child event onset time and ending at a child event clear time later than the child event onset time, wherein each child event is determined to be correlated to the parent event only if the child event is generated due to the parent event and the child event onset time is within the parent event time interval;

by the processor, computing a time duration of the particular service impact event by subtracting the parent event onset time from a particular child event clear time of the child events determined to be correlated to the parent event of the particular service impact event; and

by the processor, evaluating a risk area and degree of service assurance based on the time duration and on the service alarm type classifications.

2. The method of claim 1, wherein the identifying the particular service impact event in the alarm dataset further comprises identifying one of the service impact events having a severity exceeding a severity threshold.

3. The method of claim 1, further comprising:

receiving a raw trap data set; and

fusing data from the raw trap data set to generate the alarm dataset.

4. The method of claim 1, wherein the alarm dataset comprises, for each of a plurality of alarms, an alarm name, an alarm location, an alarm source, and event type, an onset time, a clear time, a severity and an event description.

5. The method of claim 1, wherein the evaluating the risk area and the degree of service assurance based on the time duration and on the service alarm type classifications further comprises evaluating a cloud orchestration policy based on a severity of the particular service impact event.

6. The method of claim 1, wherein the identifying service alarm type classifications further comprises identifying a predetermined process function class selected from a group consisting of an application processing class, a service messaging processing class and an application data processing class.

7. The method of claim 1, wherein the identifying the alarm sources associated with the service impact events further comprises identifying alarm sources by device names in a physical network.

8. The method of claim 1, wherein the identifying the alarm sources associated with the service impact events further comprises identifying alarm sources by Internet protocol addresses in a virtualized network.

9. The method of claim 1, wherein the identifying the alarm sources associated with the service impact events further comprises identifying a proxy-call session control function in a voice-over-Internet protocol system.

10. The method of claim 1, further comprising:

automatically tuning a cloud orchestration policy of the cloud software defined network based on the risk area and the degree of service assurance.

11. The method of claim 1, further comprising:

automatically scheduling predictive maintenance operations of the cloud software defined network based on the risk area and the degree of service assurance.

12. A service impact event analyzer for evaluating a cloud orchestration policy in a network, comprising a network interface, a processor and a computer-readable storage device having stored thereon computer readable instructions, wherein execution of the computer readable instructions by the processor causes the processor to perform operations comprising:

receiving a raw trap dataset from the network via the network interface;

fusing data from the raw trap data set to extract an alarm dataset;

identifying a service impact event in an alarm dataset, the service impact event including service alarms;

identifying alarm sources associated with the service impact event;

identifying impacted network service alarms provided in the cloud software defined network, the impacted network service alarms being identified according to the alarm sources;

identifying service alarm type classifications for the impacted network service alarms;

identifying a service impact model comprising the service alarm type classifications and the service impact events, the model describing impacts of the service impact events on network services;

using the service impact model, identifying association rules of parent and child event relationships of the service impact event, so that a parent event is determined to be a primary event for root causes of trouble, and child events are determined to be correlated to the parent event, the parent event comprising a parent event time interval beginning at a parent event onset time and ending at a parent event clear time later than the parent event onset time, each child event comprising a child event time interval beginning at a child event onset time and ending at a child event clear time later than the child event onset time, wherein each child event is determined to be correlated to the parent event only if the child event is generated due to the parent event and the child event onset time is within the parent event time interval;

computing a time duration of the service impact event by subtracting the parent event onset time from a particular child event clear time of the child events determined to be correlated to the parent event of the service impact event; and

evaluating a risk area and degree of service assurance based on the time duration and on the service alarm type classifications.

13. The service impact event analyzer of claim 12, wherein the identifying the service impact event in the alarm dataset further comprises identifying one of the service impact events having a severity exceeding a severity threshold.

14. The service impact event analyzer of claim 12, wherein the alarm dataset comprises, for each of a plurality of alarms, an alarm name, an alarm location, an alarm source, and event type, an onset time, a clear time, a severity and an event description.

15. The service impact event analyzer of claim 12, wherein the evaluating the risk area and the degree of service assurance based on the time duration and on the service alarm type classifications further comprises evaluating a cloud orchestration policy based on a severity of the service impact event.

16. The service impact event analyzer of claim 12, wherein the identifying service alarm type classifications further comprises identifying a predetermined process function class selected from a group consisting of an application processing class, a service messaging processing class and an application data processing class.

17. The service impact event analyzer of claim 12, wherein the identifying the alarm sources associated with the service impact events further comprises identifying a proxy-call session control function in a voice-over-Internet protocol system.

18. The service impact event analyzer of claim 12, wherein the operations further comprise:

automatically tuning a cloud orchestration policy of the cloud software defined network based on the risk area and the degree of service assurance.

19. The service impact event analyzer of claim 12, wherein the operations further comprise:

automatically scheduling predictive maintenance operations of the cloud software defined network based on the risk area and the degree of service assurance.

20. A computer-readable storage device having stored thereon computer readable instructions for evaluating a cloud orchestration policy in a network, wherein execution of the computer readable instructions by a processor causes the processor to perform operations comprising:

identifying service impact events in an alarm dataset from a cloud software defined network, the service impact events including service alarms;

identifying alarm sources associated with the service impact events;

identifying impacted network service alarms provided in the cloud software defined network, the impacted network service alarms being identified according to the alarm sources;

identifying service alarm type classifications for the impacted network service alarms;

identifying a service impact model comprising the service alarm type classifications and the service impact events, the model describing impacts of the service impact events on network services;

using the service impact model, identifying association rules of parent and child event relationships of a particular service impact event of the service impact events, so that a parent event is determined to be a primary event for root causes of trouble, and child events are determined to be correlated to the parent event, the parent event comprising a parent event time interval beginning at a parent event onset time and ending at a parent event clear time later than the parent event onset time, each child event comprising a child event time interval beginning at a child event onset time and ending at a child event clear time later than the child event onset time, wherein each child event is determined to be correlated to the parent event only if the child event is generated due to the parent event and the child event onset time is within the parent event time interval;

computing a time duration of the particular service impact event by subtracting the parent event onset time from a particular child event clear time of the child events determined to be correlated to the parent event of the particular service impact event; and

evaluating a risk area and degree of service assurance based on the time duration and on the service alarm type classifications.