Methods and Apparatus to Characterize and Predict Network Health Status

• US 20100238814A1
• Filed: 03/18/2009
• Published: 09/23/2010
• Est. Priority Date: 03/18/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Chen, Min-Hsuan, Lu, David H., Ching, Chee, Chung, Li-Jin
• Granted Patent: US 8,171,134 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

Methods and apparatus to characterize and predict network health status are presented. A particular method of characterizing and predicting a health status of a network node includes receiving a plurality of report values associated with the network node, where each report value is one of alert and normal, and where each report value is received at a corresponding time. The method includes calculating a current report weight associated with a current report value received at a current time. When a first previous report value was received at a first previous time before the current time, the current report weight is calculated based at least partially on the current report value and at least partially on a first previous report weight associated with the first previous value. The method includes storing the current report weight at a memory device.

Claims

1. A method of characterizing and predicting a health status of a network node, the method comprising:

receiving a plurality of report values associated with the network node, wherein each report value is one of alert and normal, and wherein each report value is received at a corresponding time;

calculating a current report weight associated with a current report value received at a current time, wherein, when a first previous report value was received at a first previous time before the current time, the current report weight is calculated based at least partially on the current report value and at least partially on a first previous report weight associated with the first previous value; and

storing the current report weight at a memory device.

2. The method of claim 1, further comprising calculating the first previous report weight based at least partially on the first previous report value.

3. The method of claim 2, further comprising calculating the first previous report weight based at least partially on a second previous report weight associated with a second previous report value received at a second previous time before the first previous time.

4. The method of claim 1, wherein, when the current report value is alert and no report values were received previous to the current time during a predetermined time period, the current report weight is calculated based on a total number of report values associated with the network node to be received during the predetermined time period.

5. The method of claim 1, wherein when the current report value is normal, the current report weight is less than the first previous report weight.

6. The method of claim 1, wherein, when the current report value is alert, the current report weight is greater than the first previous report weight.

7. The method of claim 1, further comprising identifying the network node in a fading alert list when the current report weight fails to satisfy a first threshold value.

8. The method of claim 1, wherein a predetermined total number of report values are received within a predetermined total time period.

9. The method of claim 1, further comprising removing the network node from a fading alert list when the current report weight fails to satisfy a second threshold value.

10. The method of claim 1, further comprising identifying the network node in an active alert List when the current report weight is greater satisfies a first threshold value.

11. The method of claim 10, further comprising predicting a future report value associated with the network node, wherein the future report value is based at least partially on the active alert list.

12. The method of claim 1, further comprising determining a predicted next report value to be received at a time subsequent to the current time, wherein the predicted next report value is based at least partially on the current report weight.

13. A computer-readable storage medium comprising processor-executable instructions that when executed, cause a processor to:

calculate a report weight associated with a network node, wherein the report weight is based at least partially on a report value associated with the network node at a first time and at least partially on a first previous report value associated with the network node at a previous time; and

store the current report weight in a memory.

14. The computer-readable storage medium of claim 13, wherein the current report value is one of alert and normal and the first previous report value is one of alert and normal.

15. The computer-readable storage medium of claim 13, further comprising processor-executable instructions that when executed, cause the processor to calculate a first previous report weight based at least partially on the first previous report value.

16. The computer-readable storage medium of claim 15, wherein the report weight is less than or equal to the first previous report weight when the report value is normal.

17. The computer-readable storage medium of claim 15, wherein the report weight is greater than or equal to the first previous report weight when the report value is alert.

18. The computer-readable storage medium of claim 13, further comprising processor-executable instructions that when executed, cause the processor to calculate a predicted next report value that is one of normal and alert, wherein the predicted next report value is based at least partially on the report weight.

19. A system comprising:

a processor to receive a plurality of report values associated with a network node, each report value to be received at a corresponding time within a predetermined time period, the report values including a previous report value received at a previous time and a current report value received at a current time, wherein each report value comprises one of alert and normal; and

a memory device accessible to the processor, the memory device including;

a calculation module executable by the processor to calculate a current report weight associated with the current report value, the current report weight based at least partially on the previous report value and based at least partially on the current report value; and

an output module executable by the processor to store the current report weight.

20. The system of claim 19, wherein, when the current report value is normal, the calculated current report weight is less than or equal to a previous report weight, wherein the previous report weight is calculated based at least partially on the previous report value.

21. The system of claim 19, further comprising a prediction module to determine a predicted next report value that is one of normal and alert, wherein the predicted next report value is based at least partially on the current report weight.

22. The system of claim 19, wherein, when the current report value is alert, the current report weight is greater than or equal to a previous report weight associated with the previous report value.

23. The system of claim 19, further comprising a severity module executable by the processor to store a severity category associated with the network node, wherein the severity category is determined based on the current report weight.

24. The system of claim 23, wherein the severity category comprises one of critical, major, minor, and clear.

25. The system of claim 23, further comprising displaying the severity category associated with the network node on a display device.