System and method for using agent-based distributed reasoning to manage a computer network

• US 7,469,239 B2
• Filed: 06/21/2005
• Issued: 12/23/2008
• Est. Priority Date: 06/21/2004
• Status: Expired due to Fees

• Current Assignee: Scott A. Musman
• Original Assignee: Scott A. Musman
• Inventors: Musman, Scott A.
• Primary Examiner(s): STARKS, WILBERT L
• Application Number:
  US11/156,471
• Publication Number:
  US 20060036670A1
• Time in Patent Office: 1,281 Days
• Field of Search: 706/46, 706/45, 706/12, 704/9, 370/342, 89/11.1
• US Class Current: 706/46
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

The present invention describes a system and method for using agent-based distributed reasoning to manage a computer network. In particular, the system includes interface agents to integrate event streams, distributed reasoning agents, and response agents, which run on hosts in the network. An interface agent monitors a resource in the network and reports an event to an appropriate distributed reasoning agent. The distributed reasoning agent, using one or more knowledge bases, determines a response to the event. An appropriate response agent implements the response. Characteristics of the reasoning agent'"'"'s mean that they can work together collaboratively, as well as implementing parallel algorithms.

Claims

1. An agent-based distributed reasoning system for resolving an event on a computer network having components comprising a plurality of hosts, the system comprising:

a plurality of interface agents running on the plurality of hosts, each of the plurality of interface agents running on an assigned component and monitoring a respective resource thereon;

a plurality of distributed reasoning agents running on the plurality of hosts, each of the plurality of distributed reasoning agents having both at least one respective knowledge base of situations and a respective working memory, and wherein each of the distributed reasoning agents is capable of synchronizing its knowledge base and working memory with the knowledge bases and working memories of other reasoning agents in at least one subset of less than all the reasoning agents in the plurality thereof; and

a plurality of response agents running on the plurality of hosts;

wherein an interface agent in the plurality thereof formats and reports an event occurring in its assigned resource to one of the distributed reasoning agents to which the interface agent is connected;

wherein the distributed reasoning agent receiving the report of the event;

accesses the at least one respective knowledge base and selects a response therefrom;

synchronizes all the knowledge bases and working memories associated with the reasoning agents in the at least one subset and thereby enables recognition of compound sequences, patterns and chains of events across the plurality of resources; and

communicates the response to one of a plurality of response agents running on the plurality of hosts to resolve the event.

2. The system of claim 1, wherein the resources within the computer network comprise network management tools, network security tools, system security tools, operating system specific features, and system health tools.

3. The system of claim 1, wherein the response agent receiving the response resolves the response against another response received from at least one other distributed reasoning agent of the plurality thereof to resolve the event.

4. The system of claim 1, wherein the response includes invoking one or more situations in the at least one knowledge base.

5. The system of claim 1, wherein the reasoning agents in the subset utilize their knowledge bases and working memories to implement parallel and distributed reasoning programs, allowing situation matching to occur locally using the synchronized knowledge bases and working memories even if other situation related events are not reported by the interface agent to the reasoning agent to which it is connected.

6. The system of claim 1, wherein the distributed reasoning agent receiving the report selects a response when multiple situations in the respective knowledge base match the event.

7. The system of claim 1, wherein the situations comprise at least one situation template.

8. A method for responding to an event on a computer network comprising a plurality of hosts, the network having an agent-based framework with a plurality of agents comprising at least one interface agent connected to at least one of a second plurality of distributed reasoning agents, and a third plurality of response agents;

the method comprising;

monitoring, by means of the at least one interface agent, a resource in the computer network for the event;

formatting and reporting, by means of the interface agent, the event in the resource to a connected one of the distributed reasoning agents;

querying, by means of the connected one of the reasoning agents, at least one other of the plurality of agents, receiving information related to the event therefrom, and thereafter

selecting a response to the event using the connected one of the distributed reasoning agents; and

implementing the response to the event using a selected response agent.

9. The method of claim 8, wherein the connected one of the reasoning agents and another of the first plurality of reasoning agents can query each other to determine a state of the network.

10. The method of claim 8, wherein the connected one of the reasoning agents and another reasoning agent utilize respective knowledge bases and working memories to implement parallel and distributed reasoning programs, allowing situation matching to occur locally even if other situation related events occur elsewhere.

11. The method of claim 8,wherein the selected response agent collaborates with other response agents in the third plurality thereof to resolve the event.

12. The method of claim 8, further comprising a step of adding a new situation to a knowledge base of the connected one of the distributed reasoning agents using a situation template.

13. The method of claim 8, wherein the method detects situations represented by sequences and patterns of events that are recognized by modifying working memory, by adding situation templates, and by representing any event pattern that can be represented by a state-machine.

14. The method of claim 8, further comprising a step of analyzing historical data using a new situation created from a situation template.

15. A system for managing a computer network, the computer network comprising a plurality of hosts, the computer network having an agent-based framework with a plurality of agents comprising at least one interface agent connected to at least one of a second plurality of distributed reasoning agents, and at least a third plurality of response agents,

wherein:

the at least one interface agent formats and reports an event in an assigned resource to the at least one distributed reasoning agent to which it is connected;

the at least one distributed reasoning agent receiving the report communicates information concerning the event to at least one other of the plurality of distributed reasoning agents, whereafter the at least one other distributed reasoning agent selects a response; and

communicates the response to one or more of the response agents to resolve the event.

16. The system of claim 15, wherein two or more of the response agents coordinate response information to resolve the event.

17. A computer program product for managing a computer network comprising a plurality of hosts, the computer network having an agent-based framework with a plurality of agents, at least one of which is an interface agent, at least a second plurality of which are distributed reasoning agents, and at least another of which is a response agent, the computer program product comprising:

computer readable program code configured to monitor a resource in the computer network using the interface agent;

computer readable program code configured to format and report, using the interface agent, an event in the resource to a distributed reasoning agent to which it is connected;

computer readable program code configured to select a response using the connected distributed reasoning agent by accessing at least one knowledge base associated with the connected reasoning agent and by thereafter synchronizing knowledge bases and working memories associated with other distributed reasoning agents in a subset of the plurality thereof, the subset consisting of less than all the reasoning agents in the plurality thereof, and utilize the synchronized knowledge bases and working memories to enable

recognition of compound sequences, patterns and chains of events across the plurality of hosts;

computer readable program code configured to implement the response using the response agent;

and a computer readable medium in which the computer readable program codes are embodied.