Method and apparatus of diagnosing network performance issues through correlative analysis

• US 20030225877A1
• Filed: 05/31/2002
• Published: 12/04/2003
• Est. Priority Date: 05/31/2002
• Status: Abandoned Application

• Current Assignee: Coradiant, Inc. (KKR & Co., Inc.)
• Original Assignee: Coradiant, Inc. (KKR & Co., Inc.)
• Inventors: Hu, Ying, Packman, Eric
• Application Number:
  US10/160,608
• Publication Number:
  US 20030225877A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408

Abstract

A method, apparatus, and computer-readable medium are provided for determining at least one relationship between a plurality of measures observed on at least one node in a network over a plurality of time samples. Each measure comprises a performance indication exhibited by the at least one node. The plurality of measures are collected from the at least one node, and compared to identify at least one relationship (in some cases, a correlation) between measures.

Claims

1. A method of determining at least one relationship between a plurality of measures observed on at least one node in a network over a plurality of time samples, wherein each measure comprises a performance indication exhibited by the at least one node, comprising the acts of:

(a) collecting the plurality of measures from the at least one node;

(b) comparing at least one measure with at least one other measure to identify at least one relationship between measures.

2. The method according to claim 1, wherein the plurality of measures are observed on a plurality of nodes.

3. The method according to claim 1, wherein the plurality of measures are observed on a single node.

4. The method according to claim 1, wherein the act (b) further comprises identifying at least one correlation between measures.

5. The method according to claim 4, further comprising an act of:

(c) sorting the at least one correlation to produce an ordered list of correlations.

6. The method according to claim 5 wherein the ordered list is sorted from a maximum to a minimum correlation.

7. The method according to claim 1, wherein act (a) further includes an act of normalizing at least two of the plurality of measures, and act (b) further includes an act of comparing at least one normalized measure with at least one other normalized measure.

8. The method according to claim 7, wherein the plurality of measures comprises at least two combinations of normalized measures, and comparing includes comparing at least one combination of normalized measures with at least one other combination of normalized measures.

9. The method according to claim 7 wherein normalizing a measure x includes calculating:

10. The method according to claim 4 wherein act (b) is performed by calculating:

11. The method according to claim 4 further including an act of:

(d) displaying at least one correlation to a user, via an output device, as a function of time.

12. The method according to claim 1, wherein intervals between time samples are uniform in length.

13. The method according to claim 1, wherein time samples are sequential.

14. An apparatus for determining at least one relationship between a plurality of performance measures observed on at least one node in a network over a plurality of time samples, wherein each measure comprises a performance indication exhibited by the at least one node, comprising:

a monitor to collect the plurality of measures from the at least one node;

a first processing engine executing instructions to compare at least one measure with at least one other measure to determine at least one relationship.

15. The apparatus according to claim 14, further comprising a second processing engine executing instructions to normalize at least two measures, and compare at least one normalized measure with at least one other normalized measure.

16. The apparatus according to claim 14, further comprising a storage element to store data defining the performance of the at least one node, wherein the data includes representations of at least one of a measure, a normalized measure, and a relationship.

17. The apparatus according to claim 14, further comprising an output device to display at least one relationship to a user as a function of time.

18. A computer-readable medium having instructions recorded thereon, which instructions, when executed, cause at least one processor in a computer system to:

(a) collect a plurality of measures from at least one node in a network, wherein the measures comprise performance indications exhibited by the at least one node;

(b) determine at least one relationship between at least one measure and at least one other measure.

19. The computer-readable medium according to claim 18, further comprising instructions defining identifying at least one correlation between measures.

20. The computer-readable medium according to claim 18, further comprising instructions defining normalizing at least two of the plurality of measures, and comparing at least one normalized measure with at least one other normalized measure.

21. The computer-readable medium according to claim 18, further comprising instructions defining producing at least two combinations of normalized measures, and comparing at least one combination of normalized measures with at least one other combination of normalized measures:

22. The computer-readable medium according to claim 19, further comprising instructions defining sorting the at least one correlation to produce an ordered list of correlations.

23. The computer-readable medium according to claim 22, further comprising instructions defining sorting the ordered list from a maximum to a minimum correlation.

24. The computer-readable medium according to claim 20, further comprising instructions defining normalizing at least one of the plurality of measures by:

25. The computer-readable medium according to claim 18, further comprising instructions defining determining a correlation by:

26. The computer-readable medium according to claim 18, further comprising instructions defining displaying at least one relationship to a user via an output device as a function of time.

27. A method of determining at least one relationship between a plurality of measures observed on at least one node in a network over a plurality of time samples, wherein each measure comprises a performance indication exhibited by the at least one node, comprising the act of:

(a) comparing at least one measure observed on a node with at least one other measure observed on a node to identify at least one relationship between measures.

28. The method according to claim 27, wherein the plurality of measures are observed on a plurality of nodes.

29. The method according to claim 27, wherein the plurality of measures are observed on a single node.

30. The method according to claim 27, wherein the act (a) further comprises identifying at least one correlation between measures.