Systems and Methods for Automatic Profiling of Network Event Sequences

• US 20090132865A1
• Filed: 11/16/2007
• Published: 05/21/2009
• Est. Priority Date: 11/16/2007
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Laboratories America Inc (NEC Corporation)
• Inventors: Jiang, Guofei, Meng, Xiaoqiao, Zhang, Hui, Chen, Haifeng, Yoshihira, Kenji
• Granted Patent: US 8,200,797 B2
• Time in Patent Office: Days
• US Class Current: 714/48
• CPC Class Codes: H04L 41/0613 based on the type or category of the network elements
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

Systems and methods are disclosed that profile event sequences by creating a mixture model from the event sequences; estimating parameters for the mixture model; and applying the mixture model to profile the event sequences.

Claims

1. A method to profile event sequences, comprising:

a. creating a mixture model that simultaneously characterizes event pattern and time information;

b. estimating parameters for the mixture model; and

c. applying the mixture model to profile event sequences in computer networks.

2. The method of claim 1, wherein the mixture model comprises multiple first order Markov chains whose transitions have two parameters:

transition probability and transition rate.

3. The method of claim 1, comprising adding constraints to the mixture model by using domain knowledge.

4. The method of claim 1, comprising selecting a number of Markov chains in the mixture model by using domain knowledge.

5. The method of claim 1, comprising estimating parameters using an Expectation Maximization process.

6. The method of claim 1, comprising visualizing the mixture model.

7. The method of claim 6, comprising using dotted line to display transition and setting the ratio of dash length and dash gap in proportion to a function of average transition delay.

8. The method of claim 6, comprising setting the thickness of each transition line in proportion to transition probability

9. The method of claim 1, comprising detecting network anomalies based on the mixture model.

10. The method of claim 1, wherein the mixture model characterizes at least two behaviour aspects of massive event sequences.

11. A system to profile event sequences, comprising:

a. a mixture model that simultaneously characterizes event pattern and time information;

b. a parameter estimator coupled to the mixture model; and

c. a user interface module to apply the mixture model to profile event sequences in computer networks.

12. The system of claim 11, wherein the mixture model comprises multiple first order Markov chains whose transitions have two parameters:

transition probability and transition rate.

13. The system of claim 11, comprising adding constraints to the mixture model by using domain knowledge.

14. The system of claim 11, wherein the mixture model comprises a number of Markov chains selected by using domain knowledge.

15. The system of claim 11, wherein the parameter estimator comprises an Expectation Maximization process.

16. The system of claim 11, comprising a graphical user interface (GUI) to visualize the mixture model.

17. The system of claim 16, wherein the GUI uses dotted line to display transition and sets the ratio of dash length and dash gap in proportion to a function of average transition delay.

18. The system of claim 16, wherein the GUI sets the thickness of each transition line in proportion to transition probability.

19. The system of claim 11, comprising a verifier to detect network anomalies based on the mixture model.

20. The system of claim 11, wherein the mixture model characterizes at least two behaviour aspects of massive event sequences.