Determining event causality including employment of causal chains

• US 20050288915A1
• Filed: 06/27/2005
• Published: 12/29/2005
• Est. Priority Date: 06/28/2004
• Status: Abandoned Application

• Current Assignee: Vantos, Inc. (GoSecure, Inc.)
• Original Assignee: Graniteedge Networks
• Inventors: Hines, Ken
• Application Number:
  US11/168,202
• Publication Number:
  US 20050288915A1
• Time in Patent Office: Days
• US Class Current: 703/17
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A causal relationship between two events occurs when a first event meaningfully precedes a second event and is identified by a causality module. The causality module analyzes multiple network events to determine through an evaluation of available network traffic and predecessor events whether the events are causally related. Reductions in both required storage space and search operations are obtained by tracing interrelated causal chains of network events.

Claims

1. A method to be performed on a computing device, comprising:

receiving data associated with occurrences of a plurality of events; and

determining causality of an event based at least in part on causal relationship of the event with other events, with the events organized into causality chains.

2. The method of claim 1, wherein at least one of the causality chains is associated with a device of a network.

3. The method of claim 2, wherein the device is a selected one from the group consisting of a desktop computer, a server, a router, a switch and a firewall.

4. The method of claim 1, wherein the method further comprises storing less than all the received data associated with occurrences of the plurality of events, with the events organized into causality chains.

5. The method of claim 4, wherein the storing comprises storing for an event, causal relationships with immediate predecessor events disposed in the various causality chains.

6. The method of claim 4, wherein the storing comprises storing the causal relationship in one or more tables.

7. The method of claim 6, wherein the one or more tables are of one or more types selected from the group consisting of linked tables, chunk allocated tables, hash tables, and chain index tables.

8. The method of claim 4, wherein the storing comprises storing causal relationship in one or more mixed counters.

9. The method of claim 8, wherein the mixed counters are of one or more types selected from the group consisting of consisting of binary mixed counters and ternary mixed counters.

10. The method of claim 1, further comprising providing the data associated with occurrences of the events, in response to detection of the occurrences, and the method further comprises monitoring for the occurrences.

11. A method to be performed on a computing device, comprising:

receiving data associated with occurrences of a plurality of events; and

storing for event causality determination purpose, less than all the received data associated with occurrences of the plurality of events, with the events organized into causality chains.

12. The method of claim 11, wherein at least one of causality chains is associated with a device of a network.

13. The method of claim 12, wherein the device is a selected one from the group consisting of a desktop computer, a server, a router, a switch and a firewall.

14. The method of claim 11, wherein the storing comprises storing for an event, causal relationship with at most immediate predecessor events disposed in the various causality chains.

15. The method of claim 14, wherein the storing comprises storing the causal relationship employing either one or more tables or one or more counters.

16. A device comprising:

a communication interface to receive data associated with occurrences of a plurality of events; and

a causality module coupled to the communication interface configured to determine causality of an event based at least in part on causal relationship of the event with other events, with the events being organized into causality chains.

17. The device as recited in claim 16, wherein at least one of causality chains is associated with a device of a network.

18. The device as recited in claim 17, wherein the device is a selected one from the group consisting of a desktop computer, a server, a router, a switch and a firewall.

19. The device as recited in claim 16, wherein the causality module is further configured to maintain less than all the received data associated with occurrences of the plurality of events, with the events organized into causality chains.

20. The device as recited in claim 19, wherein the causality module is further configured to store for an event, causal relationship data with at most immediate predecessor events disposed in the various causality chains.

21. The device as recited in claim 20, wherein the causality module is further configured to store the causal relationship data in one or more tables.

22. The device as recited in claim 21, wherein the one or more tables are of one or more types selected from the group consisting of linked tables, chunk allocated tables, hash tables, and chain index tables.

23. The device as recited in claim 20, wherein the causality module is further configured to store causal relationship data in one or more mixed counters.

24. The device as recited in claim 23, wherein the mixed counters are of one or more types selected from the group consisting of consisting of binary mixed counters and ternary mixed counters.

25. A system comprising:

at least one sensor configured to monitor for occurrences of a plurality of events and to report detected occurrences of events; and

at least one causality server having a communication interface and a causality module, the causality server being in communication with said at least one sensor, said communication interface being configured to receive from said at least one sensor data associated with occurrences of a plurality of events, and said causality module being configured to determine causality of an event based at least in part on causal relationship of the event with other events, with said events being organized into causality chains.

26. The system as recited in claim 25, wherein at least one of causality chains is associated with a device of a network.

27. The system as recited in claim 26, wherein the device is a selected one from the group consisting of a desktop computer, a server, a router, a switch and a firewall.

28. The system as recited in claim 25, wherein the causality module is configured to maintain the causal relationship data in one or more tables and/or one or more mixed counters.

29. The system as recited in claim 28, wherein the one or more tables is selected from the group consisting of linked causal table, chunk allocated tables, hash tables, and chain indexed tables.

30. The system as recited in claim 28, wherein the causal counter is selected from the group consisting of mixed counters, binary mixed counters, and ternary mixed counters.