Method, computer program element and a system for processing alarms triggered by a monitoring system

• US 8,615,803 B2
• Filed: 06/19/2008
• Issued: 12/24/2013
• Est. Priority Date: 11/29/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dacier, Marc, Julisch, Klaus
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): CHAO, MICHAEL W
• Application Number:
  US12/142,497
• Publication Number:
  US 20080291018A1
• Time in Patent Office: 2,014 Days
• Field of Search: 726/23
• US Class Current: 726/23
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and system is designed for processing alarms, that have been triggered by a monitoring system such as an intrusion detection system, a firewall, or a network management system, comprising the steps of entering the triggered alarms into an alarm log, evaluating similarity between alarms, grouping similar alarms into alarm clusters, summarizing alarm clusters by means of generalized alarms, counting the covered alarms for each generalized alarm and forwarding generalized alarms for further processing if the number of alarms covered satisfies a predetermined criterion. In the event of high rates of alarm messages, possibly containing many false alarms, a system administrator will therefore not be confronted with a flood of messages with little significance. Instead, only generalized alarms, more meaningful and smaller in number, are presented. The method can further comprise copying the alarm log to a cluster log and for each generalized alarm in the cluster log counting the number of covered alarms that are identical to the generalized alarm or more specific than the generalized alarm, and, if the number of covered alarms exceeds a predetermined minimum number, then terminating the loop. A heuristic is used to select an attribute of the alarms of the cluster log and for each alarm thereof the selected attribute is replaced by a more general attribute. A taxonomy on the attributes can be used to define the similarity between the alarms. The forwarded generalized alarm can furthermore be investigated in order to identify a root cause.

Claims

1. A non-transitory program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method for processing alarms, that have been triggered by a monitoring system, comprising the steps of:

a) entering alarms triggered by a monitoring system into an alarm log;

b) evaluating similarity between the alarms;

c) grouping similar alarms into alarm clusters;

d) creating generalized alarms that cover the clustered alarms, the step of creating generalized alarms comprising at least copying the alarm log to a cluster log and for each alarm in the cluster log, repeating the following steps;

e1) counting the number of covered alarms to include alarms that are equal to or more specific than the generalized alarm;

e2) if the number of covered alarms exceeds a predetermined minimum number, then terminate repeating and forward said generalized alarm for further processing;

e3) selecting, based on a heuristic, an attribute of the alarms in the cluster log, wherein the heuristic comprises at least running a Teiresias method;

e4) for each alarm of a cluster log replacing the selected attribute by a more general attribute; and

e5) returning to step e1).

2. The program storage device of claim 1, wherein said more generalized attribute is an attribute of a parent alarm in a tree hierarchy of alarms.

3. The program storage device according to claim 1, wherein similar alarms are grouped according to an algorithmic procedure.

4. The program storage device of claim 3, wherein the algorithmic procedure includes at least an approximation method.

5. The program storage device according to claim 1, wherein said step of evaluating similarity comprises a step of defining the similarity between the alarms based on a taxonomy on attributes.

6. The program storage device according to claim 5, wherein said step of evaluating similarity comprises a step of selecting the taxonomy as one of directed acyclic graphs and trees.

7. The program storage device according to claim 5, wherein said step of evaluating similarity comprises a step of replacing the attribute by the next more general attribute as listed in the corresponding taxonomy.

8. The program storage device according to claim 1, further including a step of replacing the content of the attribute that is a string attribute by a set of corresponding features before the clustering.

9. The program storage device according to claim 8, wherein substrings of a predetermined minimum length and frequency are used as a feature set.

10. The program storage device according to claim 8, wherein the step of replacing the content of the attribute that is a string-attribute comprises generalizing the string attribute by replacing its set of features by a sub-set thereof.

11. The program storage device according to claim 1, comprising the step of identifying a root cause of the forward generalized alarm.

12. The program storage device according to claim 1, comprising the step of decreasing a future alarm load, by at least:

a) filtering the alarms that with a given probability have a benign root cause.

13. The program storage device of claim 1, wherein the step of replacing the selected attribute by a more general attribute further includes:

selecting a taxonomy group from a plurality of taxonomy groups that represents the selected attribute.

14. The program storage device of claim 1, wherein the step of replacing further includes:

selecting an attribute from a plurality of alarm attributes; and

replacing the selected attributed for all alarms in the cluster log by the selected attribute'"'"'s taxonomy.

15. The program storage device of claim 1, wherein the selecting, based on a heuristic, an attribute of the alarms in the cluster log comprises:

selecting an attribute that is associated with a most number of alarms in the covered alarms, and said most number is less than the predetermined minimum number.