Method and apparatus in a data processing system for managing situations from correlated events

• US 6,928,556 B2
• Filed: 08/30/2001
• Issued: 08/09/2005
• Est. Priority Date: 08/30/2001
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Black, Steven C., Swart, RoseAnne, Debar, Herve, Garrison, John Michael
• Primary Examiner(s): ELAMIN, ABDELMONIEM I
• Application Number:
  US09/942,745
• Publication Number:
  US 20030051184A1
• Time in Patent Office: 1,440 Days
• Field of Search: 713/201, 713/400, 714/4, 714/26
• US Class Current: 726/6
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

A method, apparatus, and computer implemented instructions for handling a situation in a data processing system. In response to detecting a situation, an aging function is applied to the situation. Alerts regarding the situation based on the aging function are presented.

Claims

1. A method in a data processing system for handling a situation, the method comprising:

responsive to detecting a situation, selecting an aging function from a plurality of aging functions based on the detected situation, and applying the selected aging function to the situation; and

presenting alerts regarding the situation based on the aging function.

2. The method of claim 1, wherein the aging function is an exponential decay function wherein a severity for the detected situation decreases exponentially with respect to time if any additional situations of a same type as the detected situation are not detected during such time.

3. The method of claim 1, wherein the aging function includes a user settable threshold.

4. The method of claim 1, wherein the aging function is an increasing time function wherein a severity for the detected situation increases with respect to time if any additional situations of a same type as the detected situation are not detected during such time.

5. The method of claim 4, wherein the increasing time function is one of a linear function or an exponential function.

6. The method of claim 1, wherein the aging function is a decreasing half-life function wherein a severity for the detected situation decreases by half after a given time window has elapsed if no additional situations of a same type as the detected situation are detected during such time window.

7. The method of claim 1, wherein the aging function is a combination of a linear function and an exponential function.

8. The method of claim 1, wherein the presenting step comprises:

displaying the alert on a console.

9. The method of claim 1, wherein the situation is one of a denial of server, a suspicious Web server request, or an unauthorized access of a server.

10. A method in a data processing system for handling a situation that includes a set of events, the method comprising:

monitoring for events;

responsive to detecting an event, which triggers the situation, applying an aging function to the situation, wherein the aging function is used to identify a severity of the situation; and

presenting an alert for the situation based on the severity of the situation identified by the aging function, wherein a threshold at which the situation is triggered is based upon a correlation between the set of events.

11. The method of claim 10, wherein the aging function is selected from a plurality of aging functions based on the triggered situation.

12. The method of claim 11, wherein the correlation between the set of events is a severity of each of the events.

13. A data processing system comprising:

a bus system;

a communications unit connected to the bus system;

a memory connected to the bus system, wherein the memory includes a set of instructions; and

a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to apply an aging function to the situation in response to detecting a situation, and present alerts regarding the situation based on the aging function, wherein the aging function is selected from a plurality of aging functions based on the detected situation.

14. A data processing system for handling a situation, the data processing system comprising:

applying means, responsive to detecting a situation, for selecting an aging function from a plurality of aging functions based on the detected situation, and applying the selected aging function to the situation; and

presenting means for presenting alerts regarding the situation based on the aging function.

15. The data processing system of claim 14, wherein the aging function is a an exponential decay function wherein a severity for the detected situation decreases exponentially with respect to time if any additional situations of a same type as the detected situation are not detected during such time.

16. The data processing system of claim 14, wherein the aging function includes a user settable threshold.

17. The data processing system of claim 14, wherein the aging function is an increasing time function wherein a severity for the detected situation increases with respect to time if any additional situations of a same type as the detected situation are not detected during such time.

18. The data processing system of claim 17, wherein the increasing time function is one of a linear function or an exponential function.

19. The data processing system of claim 14, wherein the aging function is a decreasing half-life function wherein a severity for the detected situation decreases by half after a given time window has elapsed if no additional situations of a same type as the detected situation are detected during such time window.

20. The data processing system of claim 14, wherein the aging function is a combination of a linear function and an exponential function.

21. The data processing system of claim 14, wherein the presenting means comprises:

means for displaying the alert on a console.

22. The data processing system of claim 14, wherein the situation is one of a denial of server, a suspicious Web server request, or an unauthorized access of a server.

23. A computer program product in a computer readable medium for handling a situation, the computer program product comprising:

first instructions, responsive to detecting a situation, for selecting an aging function from a plurality of aging functions based on the detected situation, and applying the selected aging function to the situation; and

second instructions for presenting alerts regarding the situation based on the aging function.