Method for characterizing system state using message logs

• US 8,949,177 B2
• Filed: 08/17/2009
• Issued: 02/03/2015
• Est. Priority Date: 10/17/2007
• Status: Active Grant

• Current Assignee: Arlington Technologies, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Avaya Incorporated
• Inventors: Chen, Chuanwen, Singh, Navjot, Yajnik, Shalini
• Primary Examiner(s): MORRISON, JAY A
• Application Number:
  US12/542,466
• Publication Number:
  US 20100290601A1
• Time in Patent Office: 1,996 Days
• Field of Search: None
• US Class Current: 707/609
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04M 3/2218 Call detail recording

Abstract

A method that enables the run-time behavior of a system to be analyzed is disclosed. By analyzing the totality of the messages in the log or logs system behavior can be better understood. The illustrative embodiment of the present invention detects patterns in message logs, clusters similar messages, and determines system behavior based on the clustering of messages.

Claims

1. A method comprising compiling a first message log based, at least in part, on:

(i) a second message log that comprises a first message A and a second message B,

(ii) a dis-similarity distance Δ

between the morphology of the first message A and the morphology of the second message B; and

characterizing system state based on an incidence of anomalies indicated by the first message log,

wherein the first message and the second message regard tracking of actions of at least one of communication nodes and communication links of a telecommunication system,

wherein the first message and the second message are stored in a respective memory of the telecommunication system, and

wherein the dis-similarity distance is based, at least in part, on;

(i) a first dis-similarity distance Δ

₁ between a first sub-string of the first message S₁(A) and a first sub-string of the second message S₁(B),

(ii) a second dis-similarity distance Δ

₂ between a second sub-string of the first message S₂(A) and a second sub-string of the second message S₂(B),

(iii) a first weighting W₁ of the first dis-similarity distance Δ

₂, and

(iv) a second weighting W₂ of the dis-similarity distance Δ

₂,

wherein Δ

=f(Δ

₁, W₁, Δ

₂, W₂).

2. The method of claim 1 wherein the dis-similarity distance is based on a first sub-string of the first message S(A) and a first sub-string of the second message S(B).

3. The method of claim 1 wherein the dis-similarity distance is increased when the first message and the second message have opposite meanings.

4. The method of claim 1 wherein the dis-similarity distance between the first message and the second message is based on the length of the first message and the length of the second message.

5. The method of claim 1 further comprising characterizing system state based on the occurrence of messages in the first message log with dis-similarity distance A below a threshold.

6. A method comprising compiling a first message log based on a clustering of messages in a second message log;

and

characterizing system state based on the occurrence of a first cluster in the first message log,

wherein the clustering of messages is based, at least in part, on the dis-similarity distance of a plurality of messages, the plurality of messages comprising a first message A and a second message B,

wherein the messages regard tracking of actions of at least one of communication nodes and communication links of a telecommunication system,

wherein the messages are stored in a respective memory of the telecommunication system, and

wherein the dis-similarity distance is based, at least in part, on;

(i) a first dis-similarity distance Δ

₁ between a first sub-string of the first message S₁(A) and a first sub-string of the second message S₁(B),

(ii) a second dis-similarity distance Δ

₂ between a second sub-string of the first message S₂(A) and a second sub-string of the second message S₂(B),

(iii) a first weighting W₁ of the first dis-similarity distance Δ

₂, and

(iv) a second weighting W₂ of the dis-similarity distance Δ

₂,

wherein Δ

=f(Δ

₁, W₁, Δ

₂, W₂).

7. The method of claim 6 wherein the clustering is based on a dis-similarity distance between a first message and a second message in the second message log.

8. The method of claim 7 wherein the dis-similarity distance is based on components in the first message and the second message.

9. The method of claim 7 wherein the weighting is based on the ordering of the components.

10. The method of claim 7 wherein the dis-similarity distance is increased when the first message and the second message have opposite meanings.

11. The method of claim 7 wherein the dis-similarity distance between the first message and the second message is based on the length of the first message and the length of the second message.

12. The method of claim 6 further comprising determining outliers in the clustering of messages.

13. The method of claim 12 further comprising cross-correlating outliers based on a second clustering of messages.

14. The method of claim 13 further comprising determining anomalies based on the cross-correlating.

15. The method of claim 14 further comprising characterizing system state based on the occurrence of anomalies.

16. A method comprising:

generating a first cluster of messages based on a dis-similarity distance between a first message A and a second message B in a first message log, and

characterizing system state based on the incidence of the first cluster of messages at a first time interval and the incidence of the cluster of messages at a second time interval,

wherein the first message and the second message regard tracking of actions of at least one of communication nodes and communication links of a telecommunication system,

wherein the first message and the second message are stored in a respective memory of the telecommunication system, and

wherein the dis-similarity distance is based, at least in part, on;

(i) a first dis-similarity distance Δ

₁ between a first sub-string of the first message S₁(A) and a first sub-string of the second message S₁(B),

(ii) a second dis-similarity distance Δ

₂ between a second sub-string of the first message S₂(A) and a second sub-string of the second message S₂(B),

(iii) a first weighting W₁ of the first dis-similarity distance Δ

₂, and

(iv) a second weighting W2 of the dis-similarity distance Δ

₂,

wherein Δ

=f(Δ

₁, W₁, Δ

₂, W₂).

17. The method of claim 16 further comprising compiling a second message log based on the clustering of messages and the first message log.

18. The method of claim 16 wherein the dis-similarity distance is based on components in the first message and the second message.

19. The method of claim 18 wherein the dis-similarity distance is weighted based on the ordering of the components.

20. The method of claim 16 wherein the dis-similarity distance is increased when the first message and the second message have opposite meanings.

21. The method of claim 16 further comprising wherein characterizing system state is further based on a time series of the first cluster of messages and a time series of a second cluster of messages.

22. The method of claim 21 wherein characterizing system state is further based on a cross-correlation of outliers of the time series of the first cluster of messages and the time series of the second cluster of messages.

23. The method of claim 22 wherein the characterizing system state is further based on anomalies determined by the cross-correlation.