Method and apparatus for context-sensitive event correlation with external control in situation-based management

• US 7,788,109 B2
• Filed: 04/02/2005
• Issued: 08/31/2010
• Est. Priority Date: 04/03/2004
• Status: Expired due to Fees

• Current Assignee: Altusys Corp.
• Original Assignee: Altusys Corp.
• Inventors: Jakobson, Gabriel, Lewis, Lundy M., Buford, John F.
• Primary Examiner(s): Ouellette; Jonathan
• Application Number:
  US10/907,486
• Publication Number:
  US 20050222811A1
• Time in Patent Office: 1,977 Days
• Field of Search: 705/1, 705/1.1
• US Class Current: 705/1.1
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/147 for predicting network behaviour

Abstract

Method and apparatus for situation-based management of natural and artificial systems using event correlation and a situation manager. Input is provided from multiple sources in the form of a collection of events. A first level of processing performs event correlation over the collection of events and infers new events and new qualities of events. A second level of processing manages situations based on the collection of events, where situations are recognized, maintained, and given a degree of confidence. Situations are periodically updated based on incoming events. The assertion of a situation may call for information from external sources, provide information for external sources, and provide control instructions to external sources. Given a current situation, past, and possible future situations are inferred. Additionally, a method and apparatus for bi-directional communication between the event correlator and situation manager.

Claims

1. A method of providing context-sensitive information in situation-based management, the method comprising:

receiving a collection of events at a situation manager process running on a first machine;

creating a situation with the situation manager process based on the collection of events, wherein at least a portion of the created situation is incomplete or conflictive with another situation;

determining desired context-sensitive information with the situation manager process based on the created situation, wherein the desired context-sensitive information is not included in the collection of events received by the situation manager process; and

providing a request for the desired context-sensitive information from the situation manager process to a resource.

2. The method of claim 1, wherein providing the request for the desired context-sensitive information includes providing the request to an event correlator process running on one of the first machine or a second machine.

3. The method of claim 2, wherein the event correlator processes operates as an event manager.

4. The method of claim 1, wherein providing the request for the desired context-sensitive information includes providing the request to a situation viewer.

5. The method of claim 1, wherein providing the request for the desired context-sensitive information includes providing the request to a data fusion resource.

6. The method of claim 1, wherein providing the request for the desired context-sensitive information includes providing the request to a signal fusion resource.

7. The method of claim 1, wherein determining the desired context-sensitive information includes at least one of:

determining incomplete information;

determining inconsistent information; and

determining inferred information.

8. The method of claim 1, wherein providing the request for the desired context-sensitive information includes withdrawal of the request for the desired context-sensitive information.

9. The method claim 1, wherein providing the request for the desired context-sensitive information includes providing control instructions.

10. An apparatus comprising:

a first processor configured to run an event correlator process to produce a collection of events; and

a second processor configured to run a situation manager process operatively coupled to the event correlator process to receive as an input the collection of events produced by the event correlator process, wherein the situation manager process creates a situation based on the collection of events, determines desired context-sensitive information not included in the collection of events received from the event correlator process based on the created situation, and provides a request for the desired context-sensitive information as an output to a resource operatively coupled to the situation manager process.

11. The apparatus of claim 10, wherein the resource includes the event correlator process.

12. The apparatus of claim 11, wherein the event correlator processes operates as an event manager.

13. The apparatus of claim 10, wherein the resource includes a situation viewer.

14. The apparatus of claim 10, wherein the resource includes a data fusion resource.

15. The apparatus of claim 10, wherein the resource includes a signal fusion resource.

16. The apparatus of claim 10, wherein the desired context-sensitive information determined by the situation manager process is related to at least one of:

incomplete information;

inconsistent information; and

inferred information.

17. The apparatus of claim 10, wherein the request for the desired context-sensitive information provided as output by the situation manager process includes withdrawal of the request for the desired context-sensitive information.

18. The apparatus of claim 10, wherein the request for the desired context-sensitive information provided as output by the situation manager includes control instructions.

19. The apparatus of claim 10, wherein the first processor and the second processor are implemented in a multi-processor computer.

20. A program product comprising a processor-readable medium on which program instructions are embodied, wherein the program instructions are operable, when executed by at least one programmable processor included in a device for situation-based management, to cause the device to:

create a situation based on a collection of received events;

when at least a portion of the created situation is incomplete or conflictive with another situation, determine desired context-sensitive information based on the incomplete or conflictive portion of the created situation, wherein the desired context-sensitive information is not included in the received collection of events; and

provide a request for the desired context-sensitive information to at least one of an event correlator process or a situation viewer.