Method, computer program element and a system for processing alarms triggered by a monitoring system
First Claim
1. A non-transitory program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method for processing alarms, that have been triggered by a monitoring system, comprising the steps of:
- a) entering alarms triggered by a monitoring system into an alarm log;
b) evaluating similarity between the alarms;
c) grouping similar alarms into alarm clusters;
d) creating generalized alarms that cover the clustered alarms, the step of creating generalized alarms comprising at least copying the alarm log to a cluster log and for each alarm in the cluster log, repeating the following steps;
e1) counting the number of covered alarms to include alarms that are equal to or more specific than the generalized alarm;
e2) if the number of covered alarms exceeds a predetermined minimum number, then terminate repeating and forward said generalized alarm for further processing;
e3) selecting, based on a heuristic, an attribute of the alarms in the cluster log, wherein the heuristic comprises at least running a Teiresias method;
e4) for each alarm of a cluster log replacing the selected attribute by a more general attribute; and
e5) returning to step e1).
0 Assignments
0 Petitions
Accused Products
Abstract
A method and system is designed for processing alarms, that have been triggered by a monitoring system such as an intrusion detection system, a firewall, or a network management system, comprising the steps of entering the triggered alarms into an alarm log, evaluating similarity between alarms, grouping similar alarms into alarm clusters, summarizing alarm clusters by means of generalized alarms, counting the covered alarms for each generalized alarm and forwarding generalized alarms for further processing if the number of alarms covered satisfies a predetermined criterion. In the event of high rates of alarm messages, possibly containing many false alarms, a system administrator will therefore not be confronted with a flood of messages with little significance. Instead, only generalized alarms, more meaningful and smaller in number, are presented. The method can further comprise copying the alarm log to a cluster log and for each generalized alarm in the cluster log counting the number of covered alarms that are identical to the generalized alarm or more specific than the generalized alarm, and, if the number of covered alarms exceeds a predetermined minimum number, then terminating the loop. A heuristic is used to select an attribute of the alarms of the cluster log and for each alarm thereof the selected attribute is replaced by a more general attribute. A taxonomy on the attributes can be used to define the similarity between the alarms. The forwarded generalized alarm can furthermore be investigated in order to identify a root cause.
-
Citations
15 Claims
-
1. A non-transitory program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method for processing alarms, that have been triggered by a monitoring system, comprising the steps of:
-
a) entering alarms triggered by a monitoring system into an alarm log; b) evaluating similarity between the alarms; c) grouping similar alarms into alarm clusters; d) creating generalized alarms that cover the clustered alarms, the step of creating generalized alarms comprising at least copying the alarm log to a cluster log and for each alarm in the cluster log, repeating the following steps; e1) counting the number of covered alarms to include alarms that are equal to or more specific than the generalized alarm; e2) if the number of covered alarms exceeds a predetermined minimum number, then terminate repeating and forward said generalized alarm for further processing; e3) selecting, based on a heuristic, an attribute of the alarms in the cluster log, wherein the heuristic comprises at least running a Teiresias method; e4) for each alarm of a cluster log replacing the selected attribute by a more general attribute; and e5) returning to step e1). - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15)
-
Specification