Filtering Redundant Events Based On A Statistical Correlation Between Events

• US 20100100775A1
• Filed: 10/21/2008
• Published: 04/22/2010
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Rahman, Moshiur, Slutsman, Lev
• Granted Patent: US 8,166,351 B2
• Time in Patent Office: Days
• US Class Current: 714/47
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

Methods, systems, and computer-readable media for filtering redundant fault events from an event stream generated by devices on a network based on a statistical correlation between fault events are provided. Event history data is collected from the fault events generated by devices on the network over a period of time. Statistical correlations are computed between each distinct pair of fault events in the event history data. Based on the statistical correlations, a list of redundant fault events and associated significant events is identified. The list of redundant events and associated significant events is utilized to filter the redundant fault events from the event stream generated by the devices on the network.

Claims

1. A method of filtering fault events generated in a network environment, comprising:

collecting event history data over a period of time, the event history data comprising a record of each fault event generated by a device in the network environment during the period of time;

computing a statistical correlation between each distinct pair of fault events from the event history data;

identifying redundant fault events based on the statistical correlation between each distinct pair of fault events; and

filtering redundant fault events from an event stream generated by the device in the network environment.

2. The method of claim 1, wherein computing the statistical correlation between a distinct pair of fault events comprises calculating a conditional probability of a second event of the distinct pair occurring substantially simultaneously with a first event of the distinct pair given that the first event has occurred, and wherein identifying redundant fault events comprises identifying distinct pairs of fault events having the conditional probability exceeding a threshold probability.

3. The method of claim 2, wherein the first event and the second event are determined to be substantially simultaneously occurring when the first event and the second event occur within a specific timeframe in the event history data.

4. The method of claim 1, further comprising;

determining one or more event expressions comprising Boolean operations between a plurality of fault events;

computing a statistical correlation between each distinct pair of the one or more event expressions and the fault events from the event history data; and

identifying redundant fault events based on the statistical correlation between each distinct pair of the one or more event expressions and the fault events from the event history data.

5. The method of claim 1, wherein the statistical correlation between each distinct pair of fault events is computed only for distinct pairs of fault events occurring in a particular segment of the network environment.

6. The method of claim 1, wherein the record of each fault event in the event history data comprises an event type identifier and a timestamp indicating when each fault event occurred.

7. The method of claim 1, wherein the network environment is an Internet Protocol (IP) network.

8. A system for filtering fault events generated in a network environment, comprising:

a data collection module operative to collect event history data over a period of time, the event history data comprising a record of each fault event generated by a device in the network environment during the period of time;

a statistical modeling module operative to compute a statistical correlation between each distinct pair of fault events from the event history data and identify redundant fault events based on the statistical correlation between each distinct pair of fault events; and

a statistical correlation filter module operative to filter redundant fault events from an event stream generated by the device in the network environment.

9. The system of claim 8, wherein computing the statistical correlation between a distinct pair of fault events comprises calculating a conditional probability of a second event of the distinct pair occurring substantially simultaneously with a first event of the distinct pair given that the first event has occurred, and wherein identifying redundant fault events comprises identifying distinct pairs of fault events having the conditional probability exceeding a threshold probability.

10. The system of claim 9, wherein the first event and the second event are determined to be substantially simultaneously occurring when the first event and the second event occur within a specific timeframe in the event history data.

11. The system of claim 8, wherein the statistical modeling module is further operative to:

accept one or more event expressions comprising Boolean operations between a plurality of fault events;

compute a statistical correlation between each distinct pair of the one or more event expressions and the fault events from the event history data; and

identify redundant fault events based on the statistical correlation between each distinct pair of the one or more event expressions and the fault events from the event history data.

12. The system of claim 8, wherein the statistical correlation between each distinct pair of fault events is computed only for fault events occurring in a particular segment of the network environment.

13. The system of claim 8, wherein the record of each fault event in the event history data comprises an event type identifier and a timestamp indicating when each fault event occurred.

14. The system of claim 8, wherein the network environment is an Internet Protocol (IP) network.

15. A computer readable storage medium having computer executable instructions stored thereon that, when executed by a computer, cause the computer to:

collect event history data comprising a record of each of a plurality of fault events generated by devices on a network during a period of time;

for each distinct pair of the plurality fault events from the event history data, calculate a conditional probability of a second event of the pair occurring substantially simultaneously with a first event of the pair given that the first event has occurred;

receive a threshold probability value; and

generate a list of redundant fault events from each distinct pair of the plurality of fault events having a conditional probability exceeding the threshold probability.

16. The computer readable storage medium of claim 15, wherein the list of redundant fault events is utilized to filter redundant fault events from an event stream generated by devices on the network.

17. The computer readable storage medium of claim 15, wherein the first event and the second event are determined to be substantially simultaneously occurring when the first event and second event occur within a specific timeframe in the event history data.

18. The computer readable storage medium of claim 15, having further computer executable instructions stored thereon that, when executed by a computer, cause the computer to:

receive one or more event expressions comprising Boolean operations between fault events;

for each distinct pair of the one or more event expressions and the plurality of fault events from the event history data, calculate a conditional probability of the fault event occurring substantially simultaneously with a condition defined by the event expression given that the condition defined by the event expression has occurred; and

generate a list of redundant fault events from each distinct pair of the one or more event expressions and the plurality of fault events from the event history data having a conditional probability exceeding the threshold probability.

19. The computer readable storage medium of claim 15, wherein the conditional probability of a second event of the pair occurring substantially simultaneously with a first event of the pair are calculated only for distinct pairs of fault events occurring in a particular segment of the network.

20. The computer readable storage medium of claim 15, wherein the network is an Internet Protocol (IP) network.