System and method for using agent-based distributed reasoning to manage a computer network

• US 20060036670A1
• Filed: 06/21/2005
• Published: 02/16/2006
• Est. Priority Date: 06/21/2004
• Status: Active Grant

• Current Assignee: Scott A. Musman
• Original Assignee: Scott A. Musman
• Inventors: Musman, Scott A.
• Granted Patent: US 7,469,239 B2
• Time in Patent Office: Days
• US Class Current: 709/202
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

The present invention describes a system and method for using agent-based distributed reasoning to manage a computer network. In particular, the system includes interface agents to integrate event streams, distributed reasoning agents, and response agents, which run on hosts in the network. An interface agent monitors a resource in the network and reports an event to an appropriate distributed reasoning agent. The distributed reasoning agent, using one or more knowledge bases, determines a response to the event. An appropriate response agent implements the response. Characteristics of the reasoning agent'"'"'s mean that they can work together collaboratively, as well as implementing parallel algorithms.

Claims

1. An agent-based distributed reasoning system for managing a computer network with a plurality of hosts, the system comprising:

a plurality of interface agents running on the plurality of hosts, the plurality of interface agents assigned to monitor resources within the computer network;

a plurality of distributed reasoning agents running on the plurality of hosts, wherein the plurality of distributed reasoning agents is capable of accessing one or more knowledge bases of situations; and

a plurality of response agents running on the plurality of hosts, wherein an interface agent in the plurality interface agents sends an event occurring in an assigned resource to an appropriate distributed reasoning agent among the plurality of distributed reasoning agents, wherein the appropriate distributed reasoning agent, upon receiving the input, accesses the one or more knowledge bases to select a response and communicates the response to an appropriate response agent in the plurality of response agents, wherein the appropriate response agent implements the response to resolve the event, wherein the distributed reasoning agent is adapted to update the working memory of itself and other distributed reasoning agents, and wherein a the distributed reasoning agent is adapted to dynamically adapt the knowledge-base of itself and other reasoning agents.

2. The system of claim 1, wherein the resources in the computer network includes network management tools, network security tools, system security tools, operating system specific features, and system health tools.

3. The system of claim 2, wherein like components of the system are capable of being grouped together and managed as a single entity.

4. The system of claim 1, wherein the plurality of distributed reasoning agents consider inputs regarding multiple resources sent by one or more of the plurality of interface agents.

5. The system of claim 1, wherein the response includes invoking one or more situations in the one or more knowledge bases.

6. The system of claim 1, wherein the response can include dynamically updating the working memory of one or more of the reasoning agents.

7. The system of claim 1, wherein the modification of working memory as responses enables recognition of compound situations, sequences, patterns or frequencies of events across the plurality of hosts.

8. The system of claim 1, where the reasoning agents are adapted to query each other to determine the state and if necessary synchronize their knowledge-bases or working memory across the plurality of hosts.

9. The system of claim 1, where the reasoning agents are adapted to utilize their synchronized distributed knowledge-bases as working memory to implement parallel and distributed programs, allowing situation matching to occur locally even if other situation related events occur elsewhere.

10. The system of claim 1, wherein the plurality of distributed reasoning agents is capable of selecting a response when multiple situations in the one or more knowledge bases match the input.

11. The system of claim 10, wherein the plurality of distributed reasoning agents uses a precedence order to select a response.

12. The system of claim 11, wherein the precedence order is defined based on specificity and priority values.

13. The system of claim 10, wherein the plurality of distributed reasoning agents uses response function call-switches to select and order responses.

14. The system of claim 13, wherein the response function call-switches include active, always-fire, call-next, switches.

15. The system of claim 10, wherein the plurality of distributed reasoning agents uses a precedence order and response function call-switches to select the response.

16. The system of claim 10, wherein the response includes invoking one or more situations in the one or more knowledge bases.

17. The system of claim 1, wherein the plurality of situations includes situation templates.

18. The system of claim 17, wherein the situation templates are used to represent a generic event, add a new case, and/or analyze historical events.

19. The system of claim 1, wherein agents including the plurality of interface agents, the plurality of distributed reasoning agents, and the plurality of response agents are independent.

20. The system of claim 1, wherein situations in the one or more knowledge bases are adaptable.

21. The system of claim 1, wherein a failing agent is replaced by another agent.

22. A method for managing a computer network, the computer network having an agent-based framework with a plurality of agents, at least one of which is interface agent, distributed reasoning agent, and response agent;

the method comprising;

monitoring a resource in the computer network using an interface agent;

using the interface agent to report an event in the resource to an appropriate distributed reasoning agent;

selecting a response using the appropriate distributed reasoning agent; and

implementing the response using an appropriate response agent, wherein the appropriate distributed reasoning agent accesses one or more knowledge bases in the selecting step.

23. The method of claim 22, further comprising;

replacing a failing agent among the plurality of agents with another agent.

24. The method of claim 22, further comprising, dynamically updating the one or more knowledge bases and working memory.

25. The method of claim 22, wherein the modification of working memory as responses enables the recognition of compound situations, including sequences, patterns or frequencies of events.

26. The method of claim 22, where the plurality of reasoning agents query each other to determine the state and if necessary synchronize their knowledge-bases or working memory.

27. The system of claim 22, where the reasoning agents utilize their synchronized distributed knowledge-bases as working memory to implement parallel and distributed programs, allowing situation matching to occur locally even if other situation related events occur elsewhere.

28. The method of claim 24, wherein the updating step uses a plurality of situation templates.

29. The method of claim 22, further comprising:

representing an event using a situation template, wherein the situation template may be updated.

30. The method of claim 22, further comprising:

adding a new situation to the one or more knowledge bases using a situation template.

31. The method of claim 22, wherein the method is adapted to detect situations represented by patterns of events that are recognized by modifying working memory, by adding situation templates, and represent any event pattern that can be represented by a state-machine

32. The method of claim 22, further comprising:

analyzing historical data using a new situation created from a situation template.

33. The method of claim 32, wherein a result of the analyzing step is used in the response selecting step.

34. The method of claim 22, wherein the response selecting step further comprises:

resolving a conflict when multiple situations match an event.

35. The method of claim 34, wherein the resolving step uses a precedence order.

36. The method of claim 35, wherein the precedence order is defined based on specificity and priority values.

37. The method of claim 34, wherein the resolving step uses response function call-switches to possibly create a compound response.

38. The method of claim 37, wherein the response function call-switches include active, always-fire, and call-next switches.

39. The method of claim 34, wherein the resolving step uses a precedence order and response function call-switches.

40. A system for managing a computer network, the computer network having agent-based framework with a plurality of agents, at least one of which is an interface agent, distributed reasoning agent, and response agent, the system comprising:

a resource monitor to monitor a resource in the computer network using an interface agent;

a reporter, using the interface agent, an event in the resource to an appropriate distributed reasoning agent;

a selector to select a response using the appropriate distributed reasoning agent by accessing one or more knowledge bases; and

an implementer to implement the response using an appropriate response agent.

41. The system of claim 40, wherein the system is adapted to survive a failure without any service interruption.

42. The system of claim 40, wherein the system is adapted to replace a failing agent among the plurality of agents with another agent.

43. The system of claim 40, wherein the system is adapted to dynamically update the one or more knowledge bases and working memories amongst the plurality of reasoning agents.

44. The system of claim 40, wherein the system is adapted to resolve a conflict when multiple situations match the event.

45. A computer program product for managing a computer network, the computer network having agent-based framework with a plurality of agents, at least one of which is an interface agent, distributed reasoning agent, or response agent, the computer program product comprising:

computer readable program code configured to monitor a resource in the computer network using an interface agent;

computer readable program code configured to report, using the interface agent, an event in the resource to an appropriate distributed case-based reasoning agent;

computer readable program code configured to select a response using the appropriate distributed case-based reasoning agent by accessing one or more case-bases;

computer readable program code configured to implement the response using an appropriate response agent; and

a computer readable medium in which the computer readable program codes are embodied.