METHOD AND APPARATUS FOR ANALYZING SYSTEM EVENTS

• US 20110119219A1
• Filed: 11/16/2010
• Published: 05/19/2011
• Est. Priority Date: 11/17/2009
• Status: Active Grant

• Current Assignee: Hawk Network Defense Inc.
• Original Assignee: Jerome G. Naifeh
• Inventors: Naifeh, Jerome G., Naifeh, Gregory P., Shelton, Timothy J.
• Granted Patent: US 8,560,481 B2
• Time in Patent Office: Days
• US Class Current: 706/47
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0636 based on a decision tree analysis

Abstract

An apparatus and an associated method facilitate analysis of events associated with a network system. Event occurrence items are compared with event rules of an event rule set to determine whether the items are potentially significant. If considered to be potentially significant, a scorer assigns a score to the event occurrence item to provide a relative indication of the potential significance of the event occurrence item.

Claims

1. An apparatus for facilitating analysis of system events, said apparatus comprising:

a collected-event matcher configured to identify collected system-event items that match at least an event rule of an event-rule set; and

a scorer configured to score each system-event information item identified by said collected-event matcher using at least a scoring rule of a scoring-rule set, the score of each scored system-event information item used to prioritize the scored system-event information items.

2. The apparatus of claim 1 further comprising a data collector configured to collect the system-event items.

3. The apparatus of claim 1 further comprising a normalizer configured to normalize collected system-event items that match the at least the event rule of the event-rule set.

4. The apparatus of claim 3 wherein said scorer is configured to score each system-event information item identified by said collected-event matcher, once normalized by said normalizer.

5. The apparatus of claim 1 wherein said scorer is configured to sum comparison results of comparison of each system-event information item identified by said collected-invent matcher with each scoring rule of the scoring-rule set.

6. The apparatus of claim 1 further including a prioritizer configured to prioritize the scored system-event information items sequentially according to the score associated with each scored system-event information item.

7. The apparatus of claim 1 wherein the at least one scoring rule of the scoring-rule set comprises a Bayesian score generated pursuant to pattern matching.

8. The apparatus of claim 1 wherein the event-rule set comprise a set of end rules of a rule group of a plurality of rule groups.

9. The apparatus of claim 8 wherein said collected-event matcher is further configured to select the rule group of the plurality of rule groups that contain the set of end rules comprising the event-rule set.

10. The apparatus of claim 1 wherein the event-rule set comprises a nested set of end rules.

11. The apparatus of claim 1 wherein the event-rule set comprises a trigger and nested set of end rules.

12. A method for facilitating analysis of system events, said method comprising:

identifying collected system-event items that match at least an event rule of an event-rule set; and

scoring each system-event item identified during said identifying using at least a scoring rule of a scoring rule set, the score of each scored system-event item used to prioritize the scored system-event items.

13. The method of claim 12 further comprising collecting the system-event items.

14. The method of claim 12 further comprising normalizing collected system-event items that match the at least the event rule of the event-rule set.

15. The method of claim 12 further comprising prioritizing the scored system-events.

16. The method of claim 15 further comprising displaying indications of the scored system-events, once prioritized during said prioritizing.

17. The method of claim 12 wherein said scoring comprises summing comparison results of comparison of each system-event information item identified during said matching with each scoring rule of the scoring rule set.

18. The method of claim 17 wherein further comprising comparing each system-event information identified during said matching with each scoring rule of the scoring rule set.

19. The method of claim 12 wherein said identifying comprises selecting a rule group of a plurality of rule groups that contain a set of end rules comprising the end-rule set.

20. A method for facilitating analysis of a medical-center computer system, said method comprising:

identifying collected computer system event items that match at least one computer system event rule of a computer system event rule set; and

scoring each computer system event item identified during said identifying using at least one scoring rule of a scoring rule set;

prioritizing scored computer system event using the score of each scored computer system event item; and

analyzing a prioritized list of scored system event items.