PREDICTING PROBLEM EVENTS FROM MACHINE DATA

• US 20180005127A1
• Filed: 06/29/2016
• Published: 01/04/2018
• Est. Priority Date: 06/29/2016
• Status: Abandoned Application

• Current Assignee: Nokia of America Corporation (Nokia Corporation)
• Original Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Inventors: Akyamac, Ahmet, Uzunalioglu, Huseyin
• Application Number:
  US15/196,264
• Publication Number:
  US 20180005127A1
• Time in Patent Office: Days
• CPC Class Codes: G06N 5/046 Forward inferencing; Production systems
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/5025 by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade

Abstract

The present disclosure generally discloses a problem event prediction capability. The problem event prediction capability may be configured to predict various types of problem events (e.g., customer problems, customer tickets, customer outages, network problems, network tickets, network outages, or the like, as well as various combinations thereof) based on various types of asynchronous machine data (e.g., alarms, alerts, triggers, machine logs, machine messages, diagnostic logs, diagnostic messages, or the like, as well as various combinations thereof). The problem event prediction capability may be configured to generate a set of problem prediction rules based on historical machine data and to apply the problem prediction rules to observed machine data in order to predict various types of problem events.

Claims

1. An apparatus, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to;

receive a set of problem prediction rules and information indicative of a length of an observation window, wherein the information indicative of the length of the observation window is based on a length of an analysis time period used to create at least one of the problem prediction rules based on analysis of historical problem data and historical machine data;

receive machine data generated by a device within the observation window; and

identify a predicted problem event associated with the device based on a determination that the machine data matches one of the problem prediction rules.

2. The apparatus of claim 1, wherein the analysis time period comprises a predictive time epoch used as a look-back time interval from problem events or a machine data range used as look-ahead time interval that is advanced toward problem events.

3. The apparatus of claim 1, wherein the processor is configured to:

receive information indicative of a length of a prediction time within which predicted problem events are predicted to occur.

4. The apparatus of claim 3, wherein the length of the prediction time is based on an average time difference, between a last machine data record in an epoch and a time of a reported problem event, observed during creation of at least one of the problem prediction rules.

5. The apparatus of claim 3, wherein the length of the prediction time is based on the length of the analysis time period, wherein the analysis time period comprises a predictive time epoch used as a look-back time interval from problem events.

6. The apparatus of claim 1, wherein the processor is configured to:

receive information indicative of a length of a hold-off timer during which duplicate predicted problem response actions are to be prevented from being initiated.

7. The apparatus of claim 6, wherein the length of the hold-off timer is based on the length of the analysis time period, wherein the analysis time period comprises a predictive time epoch used as a look-back time interval from problem events.

8. The apparatus of claim 6, wherein the length of the hold-off timer is based on a length of a pattern check interval configured as a sliding window to check for duplicate patterns during creation of at least one of the problem prediction rules.

9. A method, comprising:

receiving a set of problem prediction rules and information indicative of a length of an observation window, wherein the information indicative of the length of the observation window is based on a length of an analysis time period used to create at least one of the problem prediction rules based on analysis of historical problem data and historical machine data;

receiving machine data generated by a device within the observation window; and

identifying a predicted problem event associated with the device based on a determination that the machine data matches one of the problem prediction rules.

10. An apparatus, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to;

receive historical problem event data associated with a device, the device comprising a network device or a customer device;

receive historical machine data generated by the device;

create, based on a predictive time epoch, a temporal association between the historical problem event data associated with the device and the machine data generated by the device; and

generate a problem prediction rule associated with the device based on the temporal association between the historical problem event data associated with the device and the machine data generated by the device.

12. The apparatus of claim 10, wherein, to create the temporal association between the historical problem event data associated with the device and the machine data generated by the device, the processor is configured to:

identify, within the historical problem event data, a problem event associated with the device and having a reporting time associated therewith;

determine a predictive time epoch preceding the reporting time associated with the problem event;

identify, from the historical machine data, one or more machine data records falling outside of the predictive time epoch; and

create the temporal association by creating an association between the problem event and the one or more machine data records falling outside of the predictive time epoch.

13. The apparatus of claim 10, wherein, to create the temporal association between the historical problem event data associated with the device and the machine data generated by the device, the processor is configured to:

identify, within the historical problem event data, a problem event associated with the device and having a reporting time associated therewith;

determine a predictive time epoch preceding the reporting time associated with the problem event;

determine, from the historical machine data, that no machine data records fall within the predictive time epoch; and

create the temporal association by creating an association between the problem event and an indication that no machine data records fall within the predictive time epoch.

14. The apparatus of claim 10, wherein, to create the temporal association between the historical problem event data associated with the device and the machine data generated by the device, the processor is configured to:

identify, within the historical machine data, one or more machine data records;

determine, from the historical problem event data, that no problem event is associated with the one or more machine data records;

create a phantom problem event based on a determination that no problem event is associated with the one or more machine data records, the phantom problem event having associated therewith a phantom reporting time determined based on a historical distribution of problem event reporting times in the historical problem event data;

determine a predictive time epoch preceding the phantom reporting time associated with the phantom problem event; and

create the temporal association by creating an association between the one or more machine data records and an indication that no problem event is associated with the one or more machine data records.

15. The apparatus of claim 10, wherein the processor is configured to:

determine a length of the predictive time epoch based on at least one of a time of day of the historical problem event data or an arrival rate of problem events in the historical problem event data.

16. The apparatus of claim 10, wherein the historical machine data comprises a machine report having a creation time associated therewith, wherein the processor is configured to:

modulate the creation time associated with the machine report based on at least one of a first type of modulation representing a delay in delivery of the machine report or a second type of modulation representing delivery of the machine report in a bulk delivery with at least one other machine report.

17. The apparatus of claim 10, wherein the processor is configured to create the temporal association between the historical problem event data associated with the device and the machine data generated by the device based on a machine data range.

18. The apparatus of claim 17, wherein, to create the temporal association between the historical problem event data associated with the device and the machine data generated by the device, the processor is configured to:

identify, within the historical problem event data, a problem event associated with the device and having a reporting time associated therewith;

group a set of machine records, of the machine data generated by the device, having respective creation times occurring within the machine data range; and

create the temporal association by creating an association based on a determination as to whether the reporting time associated with the problem event falls within a time window after the machine data range, wherein the time window is the predictive time epoch.

19. The apparatus of claim 18, wherein the processor is configured to:

advance the machine data range as a sliding window in a direction toward the reporting time of the problem event; and

advance a pattern check interval as a sliding window to check for duplicate patterns identified based on advancement of the machine data range.

11. The apparatus of claim 11, wherein, to create the temporal association between the historical problem event data associated with the device and the machine data generated by the device, the processor is configured to:

identify, within the historical problem event data, a problem event associated with the device and having a reporting time associated therewith;

determine a predictive time epoch preceding the reporting time associated with the problem event;

identify, from the historical machine data, one or more machine data records falling within the predictive time epoch; and

create the temporal association by creating an association between the problem event and the one or more machine data records falling within the predictive time epoch.

20. A method, comprising:

receiving, by a processor, historical problem event data associated with a device, the device comprising a network device or a customer device;

receiving, by the processor, historical machine data generated by the device;

creating, by the processor based on a predictive time epoch, a temporal association between the historical problem event data associated with the device and the machine data generated by the device; and

generating, by the processor, a problem prediction rule associated with the device based on the temporal association between the historical problem event data associated with the device and the machine data generated by the device.