Event correlation

• US 5,748,098 A
• Filed: 08/29/1995
• Issued: 05/05/1998
• Est. Priority Date: 02/23/1993
• Status: Expired due to Term

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Grace, Andrew
• Primary Examiner(s): Horabik, Michael
• Assistant Examiner(s): Beaulieu, Yonel
• Application Number:
  US08/507,314
• Time in Patent Office: 980 Days
• Field of Search: 340/825.16, 340/825.36, 340/825.32, 340/825.07, 340/506, 340/522, 370/242, 370/245, 455/67.1, 395/200.11, 395/180, 395/181, 395/182.18, 395/183.01
• US Class Current: 702/181
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04M 3/08 Indicating faults in circuits or apparatus
• CPC Class Codes: H04M 3/247 Knowledge-based maintenance systems
• CPC Class Codes: H04Q 2213/13521 fault management
• CPC Class Codes: H04Q 3/0075 Fault management techniques

Abstract

Simultaneous events reported to an equipment management system are compared with historical data in order to establish whether there is a relationship between the events. Historical data is used to determined the statistical probability of the events occurring independently simultaneously. If this probability is below a predetermined threshold this will suggest that the events are not independent, but are relaxed. Such relationships are alerted to an operator, for example by highlighting or grouping on a screen display, assisting the operator in identification of related events, without the need for prior knowledge of the relationships in the system. The events may be alarms generated by faults in a network. The identification of related faults at different points in the network assists identification of their common cause. The historical database may be updated by further event occurrences as they are reported to the equipment management system, thereby enlarging the database to make the results more statistically accurate. Events may be reported to the system automatically or by human agency. To allow for systematic delays in event reporting, alarms from one source may be compared with alarms from another source occurring a fixed time later or earlier.

Claims

1. A method for automatically processing alarm signals in a network management system for a telecommunications network, said method comprising:

generating alarm signals in the telecommunications network as a result of alarm conditions occurring in a plurality of components of the telecommunications network,

transmitting alarm signals from the telecommunications network to the network management system,

storing historical data concerning the times at which alarm conditions occur in the telecommunications network during a reference time period in a store forming part of the network management system,

identifying alarm conditions occurring in the telecommunications network within one of a number of predetermined temporal windows,

correlating the identified alarm conditions by analysing the historical data to determine the statistical probabilities of pairs of the identified alarm conditions occurring by chance within the same temporal window, and

displaying at least some of the statistical probabilities on a display device of the network management system.

2. A method as in claim 1 further comprising:

selecting one of the identified alarm conditions, and

for each of the remaining identified alarm conditions, determining the statistical probability of that alarm condition and the selected alarm condition occurring by chance in the same temporal window.

3. A method as in claim 2 further comprising:

ranking the statistical probabilities in ascending order of magnitude.

4. A method as in claim 3 further comprising:

identifying the statistical probabilities which are below a predetermined threshold value.

5. A method as in claim 4 further comprising:

highlighting on the display device said statistical probabilities which are below the predetermined threshold value.

6. A method as in claim 1 wherein:

the reference time period is divided into a plurality of temporal windows of equal duration and the statistical probability of a pair of alarm conditions AR_m and AR_n occurring by chance in the same temporal window is determined by the following expression;

##EQU4## where;

k number of temporal windows in which AR_m occurs

r probability of AR_m being active in one of the temporal windows

p=number of temporal windows in which events AR_m and AR_n both occur;

when testing the dependency of AR_n upon AR_m.

7. A method as in claim 1 wherein:

the step of storing historical data relating to the times at which alarm conditions occur is repeated periodically by adding data relating to alarm conditions occurring within the predetermined temporal windows.

8. A network management system for automatically processing alarm signals, said system comprising:

means for generating alarm signals generated by monitors as a result of alarm conditions occurring in a plurality of components of a telecommunications network,

receiving means for receiving said alarm signals,

storing means for storing historical data including a representation of the times at which alarm conditions occur in the telecommunications network during a reference time period,

correlating means for correlating alarm conditions identified as occurring within a predetermined temporal window,

said correlating means including means for determining the statistical probabilities of pairs of the identified alarm conditions occurring by chance within the some temporal window, and

means for displaying at least some of the statistical probabilities determined by the correlating means.

9. A network management system as in claim 8 wherein the network management system includes:

means for permitting an operator of the system to select one of the identified alarm conditions,

said correlating means including means for determining the statistical probability of each of the remaining alarm conditions occurring by chance in the same temporal window as the selected alarm condition.

10. A network management system as in claim 9 wherein:

the correlating means includes means for ranking the statistical probabilities in ascending order of magnitude.

11. A network management system as in claim 8 wherein:

the reference time period is divided into a plurality of temporal windows of equal duration, and

the correlating means includes means for determining the statistical probability of a pair of alarm conditions AR_m and AR_n occurring by chance in the some temporal window by the following expression;

##EQU5## where;

k=number of temporal windows in which AR_m occurs

r=probability of AR_m being active in one of the temporal windows

p=number of temporal windows in which events AR_m and AR_n both occur

when testing the dependency of AR_n upon AR_m.

12. A network management system as in claim 8 wherein the network management system includes means for periodically supplying data held in the receiving means to the storing means.

13. A network management system as in claim 8 wherein the network management system includes means for manually supplying data on alarm conditions to the receiving means.

14. A self-learning adaptive network management system comprising:

network condition detectors distributed within the network and disposed to generate respectively corresponding alarm signals in response to detected abnormalities;

an alarm monitoring means connected to receive said alarm signals and to assign the occurrence of each to an associated time;

a historical data storage means connected to receive and store historical data representing the identity of alarm signals historically received in the past from the network;

correlation means connected to process said stored historical data and generate statistical data therefrom representing the probability of a predetermined plurality of predetermined alarm signals independently occurring within the same time window by chance; and

means for using said statistical data to identify and display concurrently received new incoming alarm signals that are most probably not independent occurrences but, instead, are most probably inter-dependent related alarm conditions.

15. A self-learning adaptive network management system as in claim 14 wherein new incoming alarm signals within a common time window are displayed with a visual indication of the relative probability that such alarms are inter-dependent related alarm conditions.

16. A self-learning adaptive network management system as in claim 15 wherein said new incoming alarm signals are displayed in a sequence related to the relative probability of such alarms being inter-dependent and related.

17. A self-learning adaptive network management system as in claim 15 wherein a plurality of new incoming alarm signals are visually distinguished on a display if they have a relative probability of being independent occurrences that is below a predetermined threshold.

18. A method for self-learning adaptive network management, said method comprising:

generating alarm signals in response to detected abnormalities within the network;

receiving said alarm signals and assigning the occurrence of each to an associated time;

storing historical data representing the identity of alarm signals historically received in the past from the network;

processing said stored historical data to generate statistical data representing the probability of a predetermined plurality of predetermined alarm signals independently occurring within the same time window by chance; and

using said statistical data to identify and display concurrently received new incoming alarm signals that are most probably not independent occurrences but, instead, are most probably inter-dependent related alarm conditions.

19. A method as in claim 18 wherein new incoming alarm signals within a common time window are displayed with a visual indication of the relative probability that such alarms are inter-dependent related alarm conditions.

20. A method as in claim 19 wherein said new incoming alarm signals are displayed in a sequence related to the relative probability of such alarms being inter-dependent and related.

21. A method as in claim 19 wherein a plurality of new incoming alarm signals are visually distinguished on a display if they have a relative probability of being independent occurrences that is below a predetermined threshold.