Method and system for predicting causes of network service outages using time domain correlation

• US 7,383,191 B1
• Filed: 11/28/2000
• Issued: 06/03/2008
• Est. Priority Date: 11/28/2000
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carroll, John, Marks, Felix, Herring, David, Coleman, Neil, O'Grady, Rehan
• Primary Examiner(s): Hayes; John W.
• Assistant Examiner(s): CAMPBELL, SHANNON S
• Application Number:
  US09/724,025
• Time in Patent Office: 2,744 Days
• Field of Search: 702/34, 702/179, 702/181, 702/182, 702/183, 702/184, 702/185, 705/7, 705/11, 705/400, 705/1, 724/25, 724/37, 724/39, 724/47, 724/48, 379/111, 395/200
• US Class Current: 705/1.1
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5025 by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps

Abstract

Methods and systems are described for predicting the likely causes of service outages using only time information, and for predicting and the likely costs of service outages. The likely causes are found by defining a narrow likely cause window around an outage based on service quality and/or service usage data, and correlating service events to the likely cause window in the time domain to find a probability distribution for the events. The likely costs are found by measuring usage loss and duration for a given point during an outage and using cost component functions of the time and usage to extrapolate over the outage. These cause and cost predictions supply service administrators with tools for making more informed decisions about allocation of resources in preventing and correcting service outages.

Claims

1. A method for analyzing a potential cause of a change in a service, wherein service quality of the service is monitored, usage of the service is measured, and service events are detected, the method comprising:

determining a service change time window based at least in part upon a change in service quality between a first working state and a second, non-working state, and upon a change in service usage amount, the service change time window encompassing at least part of a service outage;

retrieving data representing a plurality of detected events and a-corresponding times in which the events occurred;

computing a probability for each of the detected events that each of the detected events caused the service change based at least in part on a correlation between the event time and the service change time window;

determining whether one or more other events of a type identical to one of the detected events occurred;

and wherein computing the probability comprises computing the probability using at least in part a false occurrence weighting function which decreases the probability of the detected event as the cause of the service change for instances in which the detected event occurred outside the service change time window.

2. The method of claim 1, wherein determining the service change time window comprises determining a service failure time window based upon the change in service quality and narrowing the service failure time window to the service change time window based upon the service usage amount measured during that service failure time window.

3. The method of claim 2, wherein the service quality is monitored through periodic polling of the service quality, and comprising determining the service failure time window as bounded by a polled point of the first working state and a polled point of the second, non-working state.

4. The method of claim 1, wherein computing the probability comprises computing the probability using at least in part a time weighting function which decreases exponentially with the distance between the event time and the service change time window.

5. The method of claim 1, comprising storing historical data associating occurrences of prior events with prior service changes, and wherein computing the probability that one of the detected events caused the service change comprises computing the probability based at least in part on the historical data.

6. The method of claim 5, wherein storing historical data comprises storing data representing instances in which prior events occurred within prior service change time windows, and wherein computing the probability that the detected event caused the service change comprises using at least in part a positive occurrence weighting function which increases the probability of the detected event as the cause of the service change based on instances in the historical data in which a prior event of a type identical to the detected event occurred within a prior service change time window.

7. The method of claim 5, wherein storing historical data comprises storing data representing instances in which prior events were identified as having caused prior service changes, and wherein computing the probability that the detected event caused the service change comprises using at least in part a historical weighting function which increases the probability of the detected event as the cause of the service change based on instances in the historical data in which a prior event of a type identical to the detected event was identified as having caused a prior service change.

8. The method of claim 1, wherein computing probabilities comprises computing the probabilities such that the total of all computed probabilities is 1.

9. The method of claim 1, wherein the service comprises service over a communication network and wherein the detected events include a network event.

10. The method of claim 1, wherein the service comprises service provided by an application program and wherein the detected events include comprises an application program event.

11. The method of claim 1, wherein the service change is a service outage, comprising determining the service change time window as a change in service quality from the first working state to the second, non-working state.

12. The method of claim 1, wherein the service change is a service recovery, comprising determining the service change time window as a change in service quality from the second, non-working state to the first, working state.

13. The method of claim 1, wherein determining the service change time window comprises detecting a change in service quality by detecting a step change in measured usage.

14. A method for analyzing potential causes of a service change, the method comprising:

determining a service change time window encompassing a change of service between a first working state and a service outage, the service change being determined at least in part based on measured service usage levels;

detecting occurrences of a set of events;

retrieving data representing the plurality of detected events and corresponding times in which the events occurred, wherein the set of events are within a given time prior to and during the service change time window, each occurrence of an event being associated with a time at which the event occurred;

computing a probability distribution for the set of events, which probability distribution determines for each event in the set the probability that the detected event caused the service change, the probability distribution being based at least in part on relations between the time of each event occurrence and the service change time window; and

wherein computing the probability includes using two or more second functions selected from the group consisting of;

a time weighting function which decreases exponentially the probability of a given event as the cause of the service change with the distance between the given event time and the service chance time window;

a false occurrence weighting function which decreases the probability of a given event as the cause of the service change for instances in which events of the same type as the given event occurred outside the service change time window;

a positive occurrence weighting function which increases the probability of a given event as the cause of the service change based on instances stored in a historical database in which events of the same type as the given event occurred within a prior service change time window; and

a historical weighting function which increases the probability of a given event as the cause of the service change based on instances in the historical database in which events of the same type as the given event were identified as having caused a prior service outage.

15. The method of claim 14, wherein computing the probability distribution for the set of events comprises computing the probability distribution using a first weighting function which is the product of two or more second weighting functions.

16. The method of claim 14, wherein the step of computing the probability distribution comprises using a first weighting function which is the product of the time weighting function, false occurrence weighting function, positive occurrence weighting function, and user weighting function.

17. The method of claim 14, comprising monitoring service quality, and wherein determining the service change time window comprises determining a service failure time window based upon a change in monitored service quality and narrowing the service failure time window to the service change time window based upon the service usage amount measured during that service failure time window.

18. The method of claim 17, wherein the service quality is monitored through periodic polling of the service quality, and comprising determining the service failure time window as bounded by a polled point of the first working state and a polled point of the second, non-working state.

19. The method of claim 14, comprising computing the probability distribution such that the total of all probabilities in the distribution is 1.

20. The method of claim 14, wherein the service comprises service over a communication network and wherein the detected events comprise network events.

21. The method of claim 14, wherein the service comprises service provided by an application program and wherein the detected events comprise application program events.

22. The method of claim 14, wherein the service change is a service outage, comprising determining the service change time window as a change in service from the first working state to the second, non-working state.

23. The method of claim 14, wherein the service change is a service recovery, comprising determining the service change time window as a change in service from the second, non-working state to the first, working state.

24. The method of claim 14, wherein determining the service change time window comprises detecting a step change in measured usage.

25. A network monitoring system comprising:

a service monitor for monitoring quality of service on the network;

a usage meter for measuring usage of the network;

an event detector for detecting a plurality of network events and corresponding times at which the network events occur; and

a probable cause engine, coupled to receive data from the service monitor, usage meter, and the event detector, the probable cause engine including a processing device that, in response to executable instructions, is operative to;

set setting a service change time window based upon data received from the service monitor or usage meter, the service change time window encompassing at least part of an occurrence of a service outage in the network;

determine determining which of the network events detected by the event detector is the most likely cause of a service change including computing a probability for each of the detected events that each of the detected events caused the service change based at least in part on a correlation between the event time and service change time window;

determining whether one or more other events of a type identical to one of the detected events occurred; and

wherein computing the probability comprises computing the probability using at least in part a false occurrence weighting function which decreases the probability of the detected event as the cause of the service change for instances in which the detected event occurred outside the service change time window.

26. A computer readable medium storing program code for, when executed, causing a computer to perform a method for analyzing a potential cause of a an change in a service, wherein service quality of the service is monitored, usage amount of the service is measured, and service events are detected, the method comprising:

determining a service change time window based at least in part upon a change in service quality between a first working state and a second, non-working state, and upon a change in service usage amount, the service change time window encompassing at least part of a service outage;

retrieving data representing a plurality of detected events and a-corresponding times in which the events occurred;

computing a probability for each of the detected events that each of the detected events caused the service change based at least in part on a correlation between the event time and the service change time window;

determining whether one or more other events of a type identical to one of the detected events occurred; and

wherein computing the probability comprises computing the probability using at least in part a false occurrence weighting function which decreases the probability of the detected event as the cause of the service change for instances in which the detected event occurred outside the service change time window.

27. Computer readable media comprising program code that, when executed by a programmable microprocessor, causes the programmable microprocessor to execute a method for analyzing potential cause of a service change, the method comprising:

determining a service change time window encompassing a change of service between a first working state and a service outage, the service change being determined at least in part based on measured service usage levels;

detecting occurrences of a set of events;

retrieving data representing the plurality of detected events and corresponding times in which the events occurred, wherein the set of events are within a given time prior to and during the service change time window, each occurrence of an event being associated with a time at which the event occurred;

computing a probability distribution for the set of events, which probability distribution determines for each event in the set the probability that the detected event caused the service change, the probability distribution being based at least in part on relations between the time of each event occurrence and the service change window;

wherein computing the probability includes using two or more second functions selected from the group consisting of;

a time weighting function which decreases the probability of a given event as the cause of the service change with the distance between the given event time and the service change time window;

a false occurrence weighting function which decreases the probability of a given event as the cause of the service change for instances in which events of the same type as the given event occurred outside the service change time window;

a positive occurrence weighting function which increases the probability of a given event as the cause of the service change based on instances stored in a historical database in which events of the same type as the given event occurred within a prior service change time window; and

a historical weighting function which increases the probability of a given event as the cause of the service change based on instances in the historical database in which events of the same type as the given event were identified as having caused a prior service outage.

28. The computer readable media comprising program code of claim 27 that, when executed by a programmable microprocessor, causes the programmable microprocessor to execute a method for analyzing potential cause of a service change;

wherein computing the probability distribution for the set of event comprises computing the probability distribution using a first weighting function which is the product of two or more second weighting functions.

29. The computer readable media comprising program code of claim 27 that, when executed by a programmable microprocessor, causes the programmable microprocessor to execute a method for analyzing potential cause of a service change, the method comprising monitoring service quality, an wherein determining the service change time window comprises determining a service failure time window based upon a change in monitored service quality and narrowing the service failure time window to the service change time window based upon the service usage amount measured during the service failure time window.

30. The computer readable media comprising program code of claim 27 that, when executed by a programmable microprocessor, causes the programmable microprocessor to execute a method for analyzing potential cause of a service change, the method comprising computing the probability distribution such that the total of all probabilities in the distribution is 1.

31. The computer readable media comprising program code of claim 27 that, when executed by a programmable microprocessor, causes the programmable microprocessor to execute a method for analyzing potential cause of a service change, wherein the service comprises service over a communication network and wherein the detected events comprise network events.

32. The computer readable media comprising program code of claim 27 that, when executed by a programmable microprocessor, causes the programmable microprocessor to execute a method for analyzing potential cause of a service change, wherein the service comprises service provided by an application program and wherein the detected events comprise application program events.

33. The computer readable media comprising program code of claim 27 that, when executed by a programmable microprocessor, causes the programmable microprocessor to execute a method for analyzing potential cause of a service change, wherein the service change is a service outage, comprising determining the service change time window as a change in service from the first working state to the second, non-working state.