Methods, apparatus, and systems for distributed hypothesis testing in autonomic processing machines

• US 7,603,461 B2
• Filed: 06/29/2005
• Issued: 10/13/2009
• Est. Priority Date: 06/29/2005
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Crosby, Simon, Agosta, John Mark, Dash, Denver
• Primary Examiner(s): Winder; Patrice
• Assistant Examiner(s): NGUYEN, MINH CHAU
• Application Number:
  US11/172,438
• Publication Number:
  US 20070005753A1
• Time in Patent Office: 1,567 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Methods, apparatus, and systems are provided for distributed hypothesis testing in autonomic processing machines. Evidence about a network resource is gathered or contributed to and associated with a hypothesis about the network resource. The evidence is processed to determine whether a decision can be made with respect to activities or problems associated with the network resource. The hypothesis, the evidence, and the contributed evidence are propagated over a network to other network nodes or participants.

Claims

1. A machine-implemented method, comprising:

detecting an event and determining whether the event contributes to an existing hypothesis about a network resource or if the event warrants a new hypothesis;

updating collaborative evidence associated with the existing hypothesis or the new hypothesis in response to the event;

deciding whether the evidence meets a threshold for confirming a problem with the network resource or denying the problem with the network resource; and

propagating the existing hypothesis or the new hypothesis along with the updated evidence to one or more other network participants, wherein the existing hypothesis or the new hypothesis is represented as a message that includes an identity of a detector for the event, an identity of the network resource, and the updated evidence, the updated evidence including a positive value when the updated evidence confirms the hypothesis and a negative value when the updated evidence contradicts the hypothesis, and wherein the message is sent to the one or more network participants, the detector also has an associated sensitivity that is an accuracy profile for the detector in identifying the problem, the sensitivity is equal to a total number of true positive problems identified by the detector divided by a sum comprising the total number of the true positives problems plus a total number of false negative problems identified by the detector, and wherein the sensitivity is derived from a confusion matrix that is a table of properties representing an ability of the detector to detect previous problems.

2. The method of claim 1, wherein updating further includes at least one of:

formulating or contributing to a new evidence vector associated with the new hypothesis; and

incrementally contributing to an existing evidence vector associated with the existing hypothesis.

3. The method of claim 2, wherein deciding further includes:

aggregating a weight of the evidence vector to acquire a summed value; and

comparing the weight of the evidence against the threshold to decide whether to confirm or deny the existing hypothesis or the new hypothesis.

4. The method of claim 2 further comprising:

weighting some portions of the evidence associated with the evidence vector differently in response to identities associated with the one or more other network participants; and

comparing the weight of the evidence against the threshold to decide whether to confirm or deny the existing hypothesis or the new hypothesis.

5. The method of claim 1 further comprising, generating the new hypothesis independent of the event.

6. The method of claim 1 further comprising, taking one or more autonomous actions in response to existing hypothesis or the new hypothesis.

7. The method of claim 1, wherein detecting further includes identifying the event within a local environment of a network node.

8. The method of claim 1 further comprising at least one of:

merging evidence received which is associated with a same hypothesis and which is partially duplicated if received from multiple ones of the one or more other network participants;

merging the new hypothesis with the existing hypothesis if related to the same hypothesis;

propagating the evidence and the new hypothesis or the existing hypothesis to the one or more other network participants;

accelerating the propagation or raising an alarm to the one or more other network participants if the existing of new hypothesis is confirmed; and

sequentially notifying originators of and/or contributors to the existing hypothesis, if the existing hypothesis is denied.

9. A machine-accessible medium stores associated instructions, which when processed, result in a machine performing:

locally collecting evidence on a network node about a hypothesis;

updating the evidence to an evidence vector associated with the hypothesis, wherein the evidence vector includes an identity for a detector of an event that led to the collection of the evidence, an identity for the network node, and the evidence, and wherein the evidence includes negative evidence that contradicts the hypothesis, which is represented as a negative value within the hypothesis, or the hypothesis includes positive evidence that confirms the hypothesis, which is represented as a positive value within the hypothesis, the detector also has an associated sensitivity that is an accuracy profile for the detector in identifying a problem, the sensitivity is equal to a total number of true positive problems identified by the detector divided by a sum comprising the total number of the true positives problems plus a total number of false negative problems identified by the detector, and wherein the sensitivity is derived from a confusion matrix that is a table of properties representing an ability of the detector to detect previous problems;

determining whether the hypothesis can be confirmed or denied; and

propagating the evidence vector to other network participants over a network, if the hypothesis is neither confirmable nor deniable.

10. The medium of claim 9, further including instructions to sequentially notify one or more originators of and/or contributors to the hypothesis if the evidence and the evidence vector deny the hypothesis.

11. The medium of claim 10, further including instructions to merge the evidence vector with another evidence vector is both of the vectors are associated with the same hypothesis.

12. The medium of claim 10, further including instructions to combine two separate hypotheses into the hypothesis if the two separate hypotheses are related or the same.

13. The medium of claim 9, further including instructions to initially generate the hypothesis and the evidence vector.

14. The medium of claim 13, further including instructions to raise an alarm that is communicated to the one or more other network participants if the evidence and the evidence vector confirm the hypothesis.

15. An apparatus, comprising:

a network node; and

a problem detection service to process within a local environment of the network node, wherein the problem detection service is to generate or to contribute to a hypothesis associated with a network resource and wherein the problem detection service is to propagate the evidence and contributed evidence, which is locally resolved on the network node, over a network to other network nodes, and wherein the problem detection service represents the hypothesis as an identity for the problem detection service, an identity for the network resource, and the evidence, and wherein the evidence is a positive value when it confirms the hypothesis and is a negative value when it contradicts the hypothesis, the problem detection service also has an associated sensitivity that is an accuracy profile for the problem diction service in identifying a problem, the sensitivity is equal to a total number of true positive problems identified by the problem detection service divided by a sum comprising the total number of the true positives problems plus a total number of false negative problems identified by the problem detection service, and wherein the sensitivity is derived from a confusion matrix that is a table of properties representing an ability of the problem detection service to detect previous problems.

16. The apparatus of claim 15, wherein the problem detection service is to propagate the hypothesis and the evidence or the contributed evidence as a vector to the other network nodes via at least one of a gossip protocol and a message passing mechanism.

17. The apparatus of claim 16, wherein the problem detection service is to weight different portions of the vector in response to identities associated with the other network nodes.

18. The apparatus of claim 15, wherein the problem detection service is to merge multiple hypotheses into the hypothesis or is to merge multiple evidence vectors associated with the evidence or the contributed evidence.

19. The apparatus of claim 15, wherein the problem detection service is to aggressively notify the other network nodes of a determination that the hypothesis is true.

20. The apparatus of claim 15, wherein the problem detection service is to process the evidence and the contributed evidence to contribute to a decision as to whether the network resource is at least one of an attacker of the network node, a service using the network node to attack the other network nodes, or an application processing on the network node that fails or has a performance problem.

21. A system, comprising:

a network node;

a problem detection service to process within a local environment of the network node, wherein the problem detection service is to generate or to contribute to a hypothesis associated with a network resource and wherein the problem detection service is to propagate the evidence and contributed evidence, which is locally resolved on the network node, over a network to other network nodes, and wherein the problem detection service represents the hypothesis as an identity for the problem detection service, an identity for the network resource, and the evidence, and wherein the evidence is a positive value when it confirms the hypothesis and is a negative value when it contradicts the hypothesis, the problem detection service also has an associated sensitivity that is an accuracy profile for the problem diction service in identifying a problem, the sensitivity is equal to a total number of true positive problems identified by the problem detection service divided by a sum comprising the total number of the true positives problems plus a total number of false negative problems identified by the problem detection service, and wherein the sensitivity is derived from a confusion matrix that is a table of properties representing an ability of the problem detection service to detect previous problems; and

a display to present information associated with the hypothesis, the evidence, the contributed evidence, the problem detection service, the network node, the network resource, or the other network nodes.

22. The system of claim 21 further comprising, a printer to print the information.

23. The system of claim 21 further comprising, a log to record the information.