METHOD OF IDENTIFYING A ROOT CAUSE OF A NETWORK EVENT

• US 20100138533A1
• Filed: 04/15/2008
• Published: 06/03/2010
• Est. Priority Date: 04/18/2007
• Status: Active Grant

• Current Assignee: System Technical Co., Ltd.
• Original Assignee: Zenulta Limited
• Inventors: Pauly, Duncan Gunther
• Granted Patent: US 8,214,480 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

A method of identifying a root cause of an event in a network of linked entities. The method comprises: defining a plurality of signatures, each signature comprising one or more classes, the classes being categorized by a taxonomy of classes; receiving a first message from the network; assigning one or more of the signatures to the first message; establishing a set of one or more hypotheses, each hypothesis identifying:a respective root cause; and one of the signatures assigned to the first message; receiving one or more subsequent messages from the network; determining whether each subsequent message matches a signature identified by a previously hypothesis; and generating an output based on the determination.

Typically the method involves an element of human interaction. Typically at least one of the signatures includes a class which encloses two or more subclasses categorized by the taxonomy of classes. The ability to define signatures including such higher level entity classes in the taxonomy enables a human user to generate, store and edit generic hypotheses quickly and intuitively, and/or provides an output which can be easily understood by a human user.

Claims

1. A method of identifying a root cause of an event in a network of linked entities, the method comprising:

a. defining a plurality of signatures, each signature comprising one or more classes, the classes being categorized by a taxonomy of classes;

b. receiving a first message from the network;

c. assigning one or more of the signatures to the first message;

d. establishing a set of one or more hypotheses, each hypothesis identifying;

i. a respective root cause; and

ii. one of the signatures assigned to the first message;

e. receiving one or more subsequent messages from the network;

f. determining whether each subsequent message matches a signature identified by a hypothesis established in step d; and

g. generating an output based on the determination in step f.

2. The method of claim 1 wherein at least one of the signatures comprises a plurality of envelope sets each comprising a set of classes;

wherein each envelope set is associated with one or more sub-events related to the root cause; and

wherein a signature is assigned to the first message in step c if the first message matches a set of classes in at least one of that signature'"'"'s envelope sets.

3. The method of claim 1 wherein at least one of the signatures comprises a message class categorized by a taxonomy of message classes and defining a message topic;

and steps c and f comprise matching a message class of the message with the message class of the signature.

4. The method of claim 1 wherein at least one of the signatures comprise one or more entity classes categorized by a taxonomy of entity classes, each entity class defining an entity type;

and steps c and f comprise matching an entity class of the message with the entity class of the signature.

5. The method of claim 1 wherein at least one of the signatures comprise one or more association classes categorized by a taxonomy of association classes, each association class defining a type of connection between two directly communicating entities;

and wherein steps c and f comprise matching an association class of the message with the association class of the signature.

6. The method of claim 1 wherein at least one of the signatures includes a class which encloses two or more subclasses categorized by the taxonomy of classes.

7. The method of claim 1 wherein the signatures are defined by a human in step a.

8. The method of claim 1 further comprising giving the one or more hypotheses scores, and amending the scores when the signatures associated with them match subsequent received messages.

9. The method of claim 8 further comprising promoting a hypothesis to an elected phase when its score reaches a predetermined level, increasing its score when the signature associated with it matches a message, and decreasing the score of any other co-existing hypotheses whose signature also matches the message.

10. The method of claim 1 wherein step f comprises comparing an observation time associated with the subsequent message with an event time associated with the hypothesis established in step d.

14. A network analysis engine configured to identify a root cause of an event in a network of linked entities by the method of claim 1.

15. A program or suite of programs for controlling the operating of a network analysis engine, the program(s) being arranged when executed to control the network analysis engine so as to operate in accordance with the method of claim 1.

11. A method of identifying a root cause of an event in a network of linked entities, the method comprising:

a. receiving a first message from the network;

b. establishing a first hypothesis associated with the first message;

c. receiving one or more subsequent messages from the network;

d. for each subsequent message;

i. establishing a new hypothesis, and;

ii. determining whether the subsequent message matches any previously established hypothesis by comparing an observation time associated with the message with an event time associated with the hypothesis; and

e. generating an output based on the determination in step d.ii.

12. The method of claim 11 further comprising defining a plurality of signatures, wherein any subsequent message which does not match one of the signatures does not establish a new hypothesis.

13. The method of claim 11 further comprising presenting the output to a user.

16. A network analysis engine configured to identify a root cause of an event in a network of linked entities by the method of claim 11.

17. A program or suite of programs for controlling the operating of a network analysis engine, the program(s) being arranged when executed to control the network analysis engine so as to operate in accordance with the method of claim 11.