Method and apparatus in a data processing system for managing situations from correlated events

• US 20030051184A1
• Filed: 08/30/2001
• Published: 03/13/2003
• Est. Priority Date: 08/30/2001
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Debar, Herve, Garrison, John Michael, Black, Steven C., Swart, RoseAnne
• Granted Patent: US 6,928,556 B2
• Time in Patent Office: Days
• US Class Current: 713/400
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

A method, apparatus, and computer implemented instructions for handling a situation in a data processing system. In response to detecting a situation, an aging function is applied to the situation. Alerts regarding the situation based on the aging function are presented.

Claims

1. A method in a data processing system for handling a situation, the method comprising:

responsive to detecting a situation, applying an aging function to the situation; and

presenting alerts regarding the situation based on the aging function.

2. The method of claim 1, wherein the aging function is a decay function.

3. The method of claim 1, wherein the aging function includes a user settable threshold.

4. The method of claim 1, wherein the aging function is an increasing time function.

5. The method of claim 4, wherein the increasing time function is one of a linear function or an exponential function.

6. The method of claim 1, wherein the aging function is a decreasing function.

7. The method of claim 6, wherein the decreasing function is a half-life function.

8. The method of claim 1, wherein the presenting step comprises:

displaying the alert on a console.

9. The method of claim 1, wherein the situation is one of a denial of server, a suspicious Web server request, or an unauthorized access of a server.

10. A method in a data processing system for handling a situation, the method comprising:

monitoring for events;

responsive to detecting an event, which triggers a situation, applying an aging function to the situation, wherein the aging function is used to identify a severity of the situation; and

presenting an alert for the situation based on the severity of the situation identified by the aging function.

11. The method of claim 10, wherein the situation includes a set of events.

12. The method of claim 11, wherein the set of events form a denial of service attack.

13. A data processing system comprising:

a bus system;

a communications unit connected to the bus system;

a memory connected to the bus system, wherein the memory includes a set of instructions; and

a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to apply an aging function to the situation in response to detecting a situation; and

present alerts regarding the situation based on the aging function.

14. A data processing system for handling a situation, the data processing system comprising:

applying means, responsive to detecting a situation, for applying an aging function to the situation; and

presenting means for presenting alerts regarding the situation based on the aging function.

15. The data processing system of claim 14, wherein the aging function is a decay function.

16. The data processing system of claim 14, wherein the aging function includes a user settable threshold.

17. The data processing system of claim 14, wherein the aging function is an increasing time function.

18. The data processing system of claim 17, wherein the increasing time function is one of a linear function or an exponential function.

19. The data processing system of claim 14, wherein the aging function is a decreasing function.

20. The data processing system of claim 19, wherein the decreasing function is a half-life function.

21. The data processing system of claim 14, wherein the presenting means comprises:

means for displaying the alert on a console.

22. The data processing system of claim 14, wherein the situation is one of a denial of server, a suspicious Web server request, or an unauthorized access of a server.

23. A computer program product in a computer readable medium for handling a situation, the computer program product comprising:

first instructions, responsive to detecting a situation, for applying an aging function to the situation; and

second instructions for presenting alerts regarding the situation based on the aging function.