Efficient filtered causal graph edge detection in a causal wavefront environment

• US 20070032986A1
• Filed: 08/03/2006
• Published: 02/08/2007
• Est. Priority Date: 08/05/2005
• Status: Abandoned Application

• Current Assignee: Vantos, Inc. (GoSecure, Inc.)
• Original Assignee: Graniteedge Networks
• Inventors: Hines, Ken, Klassen, Chris
• Application Number:
  US11/499,306
• Publication Number:
  US 20070032986A1
• Time in Patent Office: Days
• US Class Current: 702/183
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A causal relationship between two events occurs when a first event meaningfully precedes a second event and is identified by a causality module. The causality module analyzes causality of a selected subset of significant events of multiple events using efficient filtered causal graph edge detection in a causal wavefront environment. In various embodiments, efficient filtered causal graph edge detection includes derivation of an inserted event'"'"'s maximal predecessor set and minimal successor set. As a resultant, reductions in both required storage space and search operations are achieved.

Claims

1. A method to be performed on a computing device, comprising:

receiving selection for a subset of a plurality of events having event association data stored for event causality determination;

determining causality of the selected events through at least one of highest order predecessor events and lowest order successor events in causal chains of at least one of the selected events.

2. The method of claim 1, wherein said determining comprising determining causality relationship between a first and a second event through the highest order predecessor events and lowest order successor events in causal chains of the first event.

3. The method of claim 2, wherein said determining of causality relationship between the first and the second event comprises creating a chain relative maximal predecessor set having highest order predecessor events of the first event in each chain, for which any predecessor event of the first event exists.

4. The method of claim 3, wherein said creating of the chain relative maximal predecessor set comprises performing a binary search on a causal chain having at least one of the selected events.

5. The method of claim 4, wherein said binary search is performed employing wavefront values of the causal chain.

6. The method of claim 3, wherein said determining of causality relationship between the first and the second event further comprises reducing the chain relative maximal predecessor set to include only maximal predecessor events of the first event.

7. The method of claim 6, wherein said reducing comprises determining whether an event of the chain relative maximal predecessor set is a predecessor event of the first event.

8. The method of claim 2, wherein said determining of causality relationship between the first and the second event comprises creating a chain relative minimal successor set having lowest order successor events of the first event in each chain, for which any successor event of the first event exists.

9. The method of claim 8, wherein said creating of the chain relative minimal successor set comprises performing a binary search on a causal chain having at least one of the selected events.

10. The method of claim 9, wherein said binary search is performed employing wavefront values of the causal chain.

11. The method of claim 8, wherein said determining of causality relationship between the first and the second event further comprises reducing the chain relative minimal successor set to include only minimal successor events of the first event.

12. The method of claim 11, wherein said reducing comprises determining whether an event of the chain relative minimal successor set is a successor event of the first event.

13. The method of claim 1, further comprising generating a filtered graph with nodes and edges selectively connecting the nodes to represent the determined causality relationship between the first event and maximal predecessor and minimal successor events of the first event, with the nodes representing the events, and the edges representing causality relationships between the first event and the maximal predecessor and minimal successor events.

14. A method to be performed on a computing device, comprising:

receiving selection for a subset of a plurality of events having event association data stored for event causality determination;

determining causality of the selected events through at least one of maximal predecessor events and minimal successor events of at least one of the selected events.

15. The method of claim 14, wherein said determining comprising determining causality relationship between a first and a second event through the maximal predecessor events and the minimal successor events of the first event.

16. The method of claim 15, wherein said determining of causality relationship between the first and the second event comprises

creating a forward search set having events with no predecessor event that are predecessor events to the first event;

determining whether any of the events of the forward search set has no successor event;

recognizing any event of the forward search set with no successor event as a maximal predecessor event of the first event.

17. The method of claim 16, wherein said determining of causality relationship between the first and the second event further comprises

creating, if possible, a new forward search set to replace the previous forward search set, the new forward search set having successor events of the events of the previous forward search set that are also predecessor events of the first event;

and

repeating the determining and recognizing operations set forth in claim 16 for the replacement forward search set if the replacement forward search set is created.

18. The method of claim 15, wherein said determining of causality relationship between the first and the second event comprises

creating a backward search set having events with no successor events that are successor events to the first event;

determining whether any of the events of the backward search set has no predecessor event;

recognizing any event of the backward search set with no predecessor event as a minimal successor event of the first event.

19. The method of claim 18, wherein said determining of causality relationship between the first and the second event further comprises

creating, if possible, a new backward search set to replace the previous backward search set, the new backward search set having predecessor events of the events of the previous backward search set that are also successor events of the first event;

and

repeating the determining and recognizing operations set forth in claim 5 for the replacement backward search set if the replacement forward search set is created.

20. The method of claim 15, further comprising generating a filtered graph with nodes and edges selectively connecting the nodes to represent the determined causality relationship between the first event and the maximal predecessor and minimal successor events of the first event, with the nodes representing the events, and the edges representing causality relationships between the first event and the maximal predecessor and minimal successor events.

21. A device comprising:

a communication interface to receive selection for a subset of a plurality of events having event association data stored for event causality determination;

a causality module coupled to the communication interface configured to determine causality of the selected events through at least one of highest order predecessor events and lowest order successor events in causal chains of at least one of the selected events.

22. The device as recited in claim 21, wherein the causality module is configured to maintain data associated with causality between a first and a second event through the highest order predecessor events and lowest order successor events in causal chains of the first event.

23. The device as recited in claim 22, wherein the causality module is configured to create a chain relative maximal predecessor set having highest order predecessor events of the first event in each chain, for which any predecessor event of the first event exists.

24. The device as recited in claim 23, wherein the causality module is configured to perform a binary search on a causal chain having at least one of the selected events to create the chain relative maximal predecessor set.

25. The device as recited in claim 23, wherein the causality module is configured to reduce the chain relative maximal predecessor set to include only maximal predecessor events of the first event.

26. The device as recited in claim 22, wherein the causality module is configured to create a chain relative minimal successor set having lowest order successor events of the first event in each chain, for which any successor event of the first event exists.

27. The device as recited in claim 26, wherein the causality module is configured to perform a binary search employing wavefront values on a causal chain having at least one of the selected events to create the chain relative minimal successor set.

28. The device as recited in claim 26, wherein the causality module is configured to reduce the chain relative minimal successor set to include only minimal successor events of the first event by determining whether an event of the chain relative minimal successor set is a successor event of the first event.

29. The device as recited in claim 21, wherein the causality module is configured to generate a filtered graph with nodes and edges selectively connecting the nodes to represent the determined causality relationship between the first event and maximal predecessor and minimal successor events of the first event, with the nodes representing the events, and the edges representing causality relationships between the first event and the maximal predecessor and minimal successor events.

30. A device comprising:

a communication interface to receive selection for a subset of a plurality of events having event association data stored for event causality determination;

a causality module coupled to the communication interface configured to determine causality of the selected events through at least one of maximal predecessor events and minimal successor events of at least one of the selected events.

31. The device as recited in claim 30, wherein the causality module is configured to determine causality relationship between a first and a second event through the maximal predecessor events and the minimal successor events of the first event.

32. The device as recited in claim 31, wherein the causality module is configured to create a forward search set including events with no predecessor event that are predecessor events to the first event, the causality module being further configured to determine whether any of the events of the forward search set has no successor event and to recognize any event of the forward search set with no successor event as a maximal predecessor event of the first event.

33. The device as recited in claim 32, wherein the causality module is configured to create, if possible, a new forward search set to replace the previous forward search set, the new forward search set having successor events of the events of the previous forward search set that are also predecessor events of the first event, the causality module being further configured to repeat the determining and recognizing operations set forth in claim 32 for the replacement forward search set if the replacement forward search set is created.

34. The device as recited in claim 31, wherein the causality module is configured to create a backward search set including events with no successor event that are successor events to the first event, the causality module being further configured to determine whether any of the events of the backward search set has no predecessor event and to recognize any event of the backward search set with no predecessor event as a minimal successor event of the first event.

35. The device as recited in claim 34, wherein the causality module is configured to create, if possible, a new backward search set to replace the previous backward search set, the new backward search set having predecessor events of the events of the previous backward search set that are also successor events of the first event, the causality module being further configured to repeat the determining and recognizing operations set forth in claim 34 for the replacement backward search set if the replacement backward search set is created.