System for decomposing events from managed infrastructures with prediction of a networks topology

• US 10,425,291 B2
• Filed: 11/13/2017
• Issued: 09/24/2019
• Est. Priority Date: 01/27/2015
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip, Harper, Robert
• Primary Examiner(s): Mirza, Adnan M
• Application Number:
  US15/811,667
• Publication Number:
  US 20180159744A1
• Time in Patent Office: 680 Days
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/01 Protocols

Abstract

An event clustering system is provided that in response to a time series infers a network topology. Matrices W and H are estimated as a local minimum. For each pair of nodes: (i) a computation of the convolution is made; a number of peaks within the convolution is a function of a delay; and a comparison is made to an average behavior of a pair of nodes that emits the same number of alerts. Alerts are only spread to adjacent nodes, alerts are caused by dysfunctional nodes that do not emit alerts, and a true topology coincides with the end of the recording.

Claims

1. An event clustering system, comprising:

a managed infrastructure with hardware components;

an extraction engine in communication with the managed infrastructure, the extraction engine extracting text components from event messages and convert them into words and subtexts;

a signalizer engine that includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine, the signalizer engine converting at least a portion of the event messages into a sequence of attributes that have text or numerical values indicative of a state of a hardware component and determining if collections of event messages share a common attribute, possessing either identically equal textual values, or values that are similar up to a pre-defined threshold with production of an output of clusters, and in response to production of the clusters one or more physical changes in a managed infrastructure hardware is made.