Event management system based on machine logic

• US 8,655,823 B1
• Filed: 03/23/2011
• Issued: 02/18/2014
• Est. Priority Date: 03/23/2011
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Kumar, Manish
• Primary Examiner(s): Holmes, Michael B
• Application Number:
  US13/069,492
• Time in Patent Office: 1,063 Days
• Field of Search: 706/46
• US Class Current: 706/46
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Improved techniques of identifying actions to take in response to events involve assigning, to each set of event parameter values which characterizes an event, a set of weight values, each weight value indicative of a probability of the event belonging to a cluster of events which follow a set of rules. To continue the previous example, an event management system may determine the probability of the first event belonging to the first cluster is 51% and that for the first event belonging to the second cluster is 49%, while the probability of the second event belonging to the first cluster is 49% and that for the second event belonging to the second cluster is 51%. In such a case, the event management system can be configured to respond to such similarly configured events in similar ways.

Claims

1. A computer-based method of identifying an action to take in response to a new event, the method comprising:

receiving a new set of event parameter values which defines the new event;

from a prior event database which stores (i) prior sets of event parameters and (ii) prior sets of weight values respectively assigned to the prior sets of event parameter values, finding particular prior sets of event parameters which match the new set of event parameter values within predefined matching criteria;

assigning a new set of weight values to the new set of event parameter values based on the particular prior sets of event parameters found from the prior event database, and

selecting, as the action to take, one of multiple predefined possible actions based on the new set of weight values assigned to the new set of event parameter values which define the new event;

wherein the prior event database stores (i) a first prior set of event parameter values which defines a first prior event, (ii) a second prior set of event parameter values which defines a second prior event, and (iii) a third prior set of event parameter values which defines a third prior event;

wherein a first prior set of weight values is assigned to the first prior set of event parameter values, a second prior set of weight values is assigned to the second set of event parameter values and a third prior set of weight values is assigned to the third set of event parameter values; and

wherein finding the particular prior sets of event parameter values which match the new set of event parameter values within the predefined matching criteria includes identifying the first and second prior sets of event parameter values as the particular prior sets of event parameter values and excluding the third prior set of event parameter values from the particular prior sets of event parameter values.

2. A method as in claim 1, wherein each event parameter value of the new set of event parameter values corresponds to an event parameter value of the first set of event parameter values;

and

wherein identifying the first set of event parameter values as the particular prior sets of event parameter values includes;

finding an event parameter value of the first set of event parameter values for which an absolute difference between the event parameter value of the first set of event parameter values and a corresponding event parameter value of the new set of event parameter values is less than a specified threshold value.

3. A method as in claim 2, wherein each weight value of the new set of weight values corresponds to a predefined possible action of the multiple predefined possible actions;

wherein each weight value of the new set of weight values is indicative of a probability of the predefined possible action of the multiple predefined possible actions corresponding to the weight value being selected in response to the new event;

wherein selecting one of multiple predefined possible actions based on the new set of weight values includes;

finding a largest weight value of the new set of weight values; and

selecting the predefined possible action corresponding to the largest weight value.

4. A method as in claim 3, wherein assigning the set of new weight values includes:

generating a probability distribution from the particular prior sets of event parameter values and the prior sets of weight values respectively assigned to the particular prior sets of event parameter values; and

setting each weight value of the set of new weight values to a probability value governed by the probability distribution.

5. A method as in claim 4, wherein setting each weight value of the set of new weight values to a probability value governed by the probability distribution includes:

assigning an event-independent probability value of a set of event-independent probability values to each predefined possible action of the multiple predefined possible actions; and

applying an expectation-maximization procedure to the particular prior sets of event parameter values and the prior sets of weight values respectively assigned to the particular prior sets of event parameter values;

wherein the expectation-maximization procedure is constructed and arranged to maximize a value of a likelihood function which is indicative of a validity of assigning the updated new set of weight values to the new set of event parameter values, values of the likelihood function being based on the new set of weight values and the set of event-independent probability values.

6. A method as in claim 5, wherein applying the expectation-maximization procedure includes:

iterating over an expectation step and a maximization step;

wherein the expectation step includes;

generating a new set of weight values from an updated probability distribution; and

computing a value of the likelihood function;

wherein the maximization step includes;

updating the generated probability distribution from the generated new set of weights; and

incrementing an iteration counter value; and

wherein iterating over the expectation step and the maximization step continues until an absolute difference between the value of the likelihood function at a first iteration counter value and the value of the likelihood function at a second iteration counter value is smaller than a predefined threshold value.

7. A method as in claim 6, wherein the method further comprises:

prior to finding particular prior sets of event parameters which match the new set of event parameter values within predefined matching criteria, inputting the new set of event parameter values into an artificial neural network (ANN), output of the ANN including an error metric value defined by a closeness of the input into the ANN to output which the ANN generates in response to training data input; and

adding the error metric value to the new set of event parameter values.

8. A method as in claim 1, wherein receiving the set of new event parameters includes:

receiving, from a first hardware device, a signal containing a first access request; and

extracting the new set of event parameters from the first access request;

wherein the method further comprises;

receiving, from a second hardware device, a signal containing a second access request;

extracting another set of event parameters from the second access request;

wherein identifying the second set of event parameter values as the particular prior sets of event parameter values includes;

finding an event parameter value of the second set of event parameter values for which an absolute difference between the event parameter value of the second set of event parameter values and a corresponding event parameter value of the another set of event parameter values is less than a specified threshold value.

9. A method as in claim 8, wherein extracting the new set of event parameters includes:

normalizing each event parameter of the new set of event parameters to a number having a value between zero and one.

10. A system constructed and arranged to identify an action to take in response to a new event, the system comprising:

a network interface connected to a network;

a memory; and

a processor coupled to the memory, the processor constructed and arranged to;

receive a new set of event parameter values which defines the new event;

from a prior event database which stores (i) prior sets of event parameters and (ii) prior sets of weight values respectively assigned to the prior sets of event parameter values, find particular prior sets of event parameters which match the new set of event parameter values within predefined matching criteria;

assign a new set of weight values to the new set of event parameter values based on the particular prior sets of event parameters found from the prior event database, and

select, as the action to take, one of multiple predefined possible actions based on the new set of weight values assigned to the new set of event parameter values which define the new event;

wherein the prior event database stores (i) a first prior set of event parameter values which defines a first prior event, (ii) a second prior set of event parameter values which defines a second prior event, and (iii) a third prior set of event parameter values which defines a third prior event;

wherein a first prior set of weight values is assigned to the first prior set of event parameter values, a second prior set of weight values is assigned to the second set of event parameter values and a third prior set of weight values is assigned to the third set of event parameter values; and

wherein finding the particular prior sets of event parameter values which match the new set of event parameter values within the predefined matching criteria includes identifying the first and second prior sets of event parameter values as the particular prior sets of event parameter values and excluding the third prior set of event parameter values from the particular prior sets of event parameter values.

11. A system as in claim 10, wherein each event parameter value of the new set of event parameter values corresponds to an event parameter value of the first set of event parameter values;

and

wherein identifying the first set of event parameter values as the particular prior sets of event parameter values includes;

finding an event parameter value of the first set of event parameter values for which an absolute difference between the event parameter value of the first set of event parameter values and a corresponding event parameter value of the new set of event parameter values is less than a specified threshold value.

12. A system as in claim 11, wherein each weight value of the new set of weight values corresponds to a predefined possible action of the multiple predefined possible actions;

wherein each weight value of the new set of weight values is indicative of a probability of the predefined possible action of the multiple predefined possible actions corresponding to the weight value being selected in response to the new event;

wherein selecting one of multiple predefined possible actions based on the new set of weight values includes;

finding a largest weight value of the new set of weight values; and

selecting the predefined possible action corresponding to the largest weight value.

13. A system as in claim 12, wherein assigning the set of new weight values includes:

generating a probability distribution from the particular prior sets of event parameter values and the prior sets of weight values respectively assigned to the particular prior sets of event parameter values; and

setting each weight value of the set of new weight values to a probability value governed by the probability distribution.

14. A system as in claim 13, wherein setting each weight value of the set of new weight values to a probability value governed by the probability distribution includes:

assigning an event-independent probability value of a set of event-independent probability values to each predefined possible action of the multiple predefined possible actions; and

applying an expectation-maximization procedure to the particular prior sets of event parameter values and the prior sets of weight values respectively assigned to the particular prior sets of event parameter values;

wherein the expectation-maximization procedure is constructed and arranged to maximize a value of a likelihood function which is indicative of a validity of assigning the updated new set of weight values to the new set of event parameter values, values of the likelihood function being based on the new set of weight values and the set of event-independent probability values.

15. A system as in claim 14, wherein applying the expectation-maximization procedure includes:

iterating over an expectation step and a maximization step;

wherein the expectation step includes;

generating a new set of weight values from an updated probability distribution; and

computing a value of the likelihood function;

wherein the maximization step includes;

updating the generated probability distribution from the generated new set of weights; and

incrementing an iteration counter value; and

wherein iterating over the expectation step and the maximization step continues until an absolute difference between the value of the likelihood function at a first iteration counter value and the value of the likelihood function at a second iteration counter value is smaller than a predefined threshold value.

16. A system as in claim 15, wherein the processor is further constructed and arranged to:

prior to finding particular prior sets of event parameters which match the new set of event parameter values within predefined matching criteria, input the new set of event parameter values into an artificial neural network (ANN), output of the ANN including an error metric value defined by a closeness of the input into the ANN to output which the ANN generates in response to training data input; and

add the error metric value to the new set of event parameter values.

17. A computer program product having a non-transitory computer readable storage medium which stores code to identify an action to take in response to a new event, the code including instructions to:

receive a new set of event parameter values which defines the new event;

from a prior event database which stores (i) prior sets of event parameters and (ii) prior sets of weight values respectively assigned to the prior sets of event parameter values, find particular prior sets of event parameters which match the new set of event parameter values within predefined matching criteria;

assign a new set of weight values to the new set of event parameter values based on the particular prior sets of event parameters found from the prior event database, and

select, as the action to take, one of multiple predefined possible actions based on the new set of weight values assigned to the new set of event parameter values which define the new event;

wherein the prior event database stores (i) a first prior set of event parameter values which defines a first prior event, (ii) a second prior set of event parameter values which defines a second prior event, and (iii) a third prior set of event parameter values which defines a third prior event;

wherein a first prior set of weight values is assigned to the first prior set of event parameter values, a second prior set of weight values is assigned to the second set of event parameter values and a third prior set of weight values is assigned to the third set of event parameter values; and

wherein finding the particular prior sets of event parameter values which match the new set of event parameter values within the predefined matching criteria includes identifying the first and second prior sets of event parameter values as the particular prior sets of event parameter values and excluding the third prior set of event parameter values from the particular prior sets of event parameter values.