Detecting network conditions based on correlation between trend lines

• US 9,967,169 B2
• Filed: 09/30/2009
• Issued: 05/08/2018
• Est. Priority Date: 09/30/2009
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: DeHaan, Michael Paul, Likins, Adrian Karstan, Vidal, Seth Kelby
• Primary Examiner(s): Joshi, Suraj
• Assistant Examiner(s): Mesa, Joel
• Application Number:
  US12/570,614
• Publication Number:
  US 20110078301A1
• Time in Patent Office: 3,142 Days
• Field of Search: 709224, 709223
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Embodiments relate systems and methods for detecting network conditions based on a correlation between trend lines. In embodiments, a network management server can monitor the status and operation of network machines, such as servers or targets, as well as network transmission hardware (e.g. routers). Streams of network operation data from those sources can be captured and stored. The management server or other logic can examine the network operation data to identify trend lines for network conditions, such as application faults, attempted intrusions, or other events or conditions. Trend line data can be treated to generate second or other higher-order derivatives, such as third-order derivatives or others. A time correlation between two or more trend lines and/or their higher order derivatives, for instance, the occurrence of a peak value in the same time window, can be used to identify an event, state or condition.

Claims

1. A method comprising:

identifying first time series data for a first condition of a first resource associated with a network that occurs during a chronological window;

identifying second time series data for a second condition of a second resource associated with the network that occurs during the chronological window, wherein the second condition is different from the first condition;

determining a first average value of a derivative of at least second order for the first time series data and a second average value of the derivative of at least second order for the second time series data;

correlating the first condition and the second condition in view of the first average value for the first time series data and the second average value for the second time series data exceeding a threshold;

identifying, by a processor and in view of a correlation between the first condition and the second condition, an acceleration in a trend associated with a state of the network;

identifying, in view of the first condition, the second condition, and the acceleration in the trend, an event affecting the state of the network;

generating, in view of the identified event affecting the state of the network, a configuration command; and

issuing the configuration command to the first resource and the second resource via the network.

2. The method of claim 1, wherein the first time series data comprises a time series of detected occurrences of the first condition.

3. The method of claim 1, wherein correlating the first condition and the second condition comprises analyzing the first time series data and the second time series data within an event window.

4. The method of claim 1, further comprising generating a notification of the identified event in view of the state.

5. The method of claim 1, wherein identifying the state comprises identifying an event termination.

6. The method of claim 1, wherein identifying the acceleration in the trend associated with the state comprises identifying the acceleration in at least substantially real-time.

7. The method of claim 1, wherein identifying the first time series data and identifying the second time series data comprises storing the first time series data and the second time series data to a log.

8. The method of claim 7, wherein identifying the acceleration in the trend associated with the state comprises retrieving the first time series data and the second time series data from the log and analyzing the first time series data and the second time series data in less than substantially real-time.

9. The method of claim 1, wherein the first time series data comprises at least one of machine configuration data, intrusion detection data, machine fault data, network fault data, user security data, network traffic data, or network port data.

10. The method of claim 1, wherein the first time series data comprises at least one of data captured from a set of target machines in the network related to a state of the set of target machines or data captured from network transmission hardware related to network traffic.

11. The method of claim 1, further comprising capturing a set of network operation data from the network, the network operation data comprising the first time series data and the second time series data.

12. The method of claim 1, wherein identifying the acceleration in the trend associated with the state of the network comprises identifying a set of potential events.

13. The method of claim 1, wherein correlating the first condition and the second condition comprises comparing a derivative of at least second order for the first time series data and for the second time series data.

14. A system comprising:

a memory; and

a processor operatively coupled to the memory, the processor to;

identify first time series data for a first condition of a first resource associated with a network that occurs during a chronological window;

identify second time series data for a second condition of a second resource associated with the network that occurs during the chronological window, wherein the second condition is different from the first condition;

determine a first average value of a derivative of at least second order for the first time series data and a second average value of the derivative of at least second order for the second time series data;

correlate the first condition and the second condition in view of the first average value for the first time series data and the second average value for the second time series data exceeding a threshold;

identify, in view of a correlation between the first condition and the second condition, an acceleration in a trend associated with a state of the network;

identify, in view of the first condition, the second condition, and the acceleration in the trend, an event affecting the state of the network;

generate, in view of the identified event affecting the state of the network, a configuration command; and

issue the configuration command to the first resource and the second resource via the network.

15. The system of claim 14, wherein the first time series data comprises a time series of detected occurrences of the first condition.

16. The system of claim 14, wherein to correlate the first condition and the second condition the processor is to analyze the first time series data and the second time series data within an event window.

17. The system of claim 14, wherein the processor is further to generate a notification of the identified event in view of the acceleration in the trend associated with the state.

18. The system of claim 14, wherein to identify the acceleration in the trend associated with the state the processor is to identify an event termination.

19. The system of claim 14, wherein to identify the acceleration in the trend associated with the state the processor is to analyze the first time series data and the second time series data in at least substantially real-time.

20. The system of claim 14, wherein to identify the acceleration in the trend associated with the state the processor is to retrieve the first time series data and the second time series data from a log stored in the memory and to analyze the first time series data and the second time series data in less than substantially real-time.

21. The system of claim 14, wherein the first time series data comprises at least one of machine configuration data, intrusion detection data, machine fault data, network fault data, user security data, network traffic data, or network port data.

22. The system of claim 14, wherein the first time series data comprises at least one of data captured from a set of target machines in the network related to a state of the set of target machines or data captured from network transmission hardware related to network traffic.

23. The system of claim 14, wherein the processor is further to capture a set of network operation data from the network, the network operation data comprising the first time series data and the second time series data.

24. The system of claim 14, wherein to identify the acceleration in the trend associated with the state of the network is to identify a set of potential events.

25. A non-transitory computer readable storage medium having instructions stored thereon that, when executed by a processor, cause the processor to:

identify first time series data for a first condition of a first resource associated with a network that occurs during a chronological window;

identify second time series data for a second condition of a second resource associated with the network that occurs during the chronological window, wherein the second condition is different from the first condition;

determine a first average value of a derivative of at least second order for the first time series data and a second average value of the derivative of at least second order for the second time series data;

correlate by the processor, the first condition and the second condition in view of the first average value for the first time series data and the second average value for the second time series data exceeding a threshold;

identify, in view of a correlation between the first condition and the second condition, an acceleration in a trend associated with a state of the network;

identify, in view of the first condition, the second condition, and the acceleration in the trend, an event affecting the state of the network;

generate, in view of the identified event affecting the state of the network, a configuration command; and

issue the configuration command to the first resource and the second resource via the network.

26. The non-transitory computer readable storage medium of claim 25, wherein the processor is further to capture a set of network operation data from the network, the network operation data comprising the first time series data and the second time series data.

27. The non-transitory computer readable storage medium of claim 25, wherein to identify the acceleration in the trend associated with the state of the network is to identify a set of potential events.