US6697791B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for systematic construction of correlation rules for event management
Assignee: International Business Machines Corp
•
Filing: 2001-05-04
•
Granted: 2004-02-24
•
Expires: 2021-05-04
Abstract
Abstract A technique is provided for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices. The technique comprises the following steps. First, in association with an event cache, event data representing past or historical events associated with the network of computing devices being managed by the event management system is obtained. Next, a first pattern is found or detected in the obtained event data associated with the event cache. The pattern is then classified. Then, at least one correlation rule is constructed based on the classified pattern. Lastly, in association with the event cache, the one or more events included in the pattern are replaced with a composite or cumulative event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Inventors
- 👤 Joseph L. Hellerstein
- 👤 Sheng Ma
- 👤 Luanne M. Burns
- 👤 Chang-shing Perng
- 👤 David A. Rabenhorst
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 11:21
CPC Classifications
G; G06; G06N; G06N5/00; G06N5/02; G06N5/022; G06N5/025
Claims Analysis
Total Claims: 24
Claim 1
Independent Claim
147 words
A computer-based method of systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the method comprising the steps of: obtaining, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system; finding at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data; classifying the at least one pattern found; constructing at least one correlation rule based on the classified pattern; and replacing, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Claim 2
Dependent Claim
147 words
A computer-based method of systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the method comprising the steps of: obtaining, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system; finding at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data; classifying the at least one pattern found; constructing at least one correlation rule based on the classified pattern; and replacing, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Claim 3
Dependent Claim
29 words
The method of claim 1 , further comprising the step of storing the at least one correlation rule in a rule database for access by the event management system.
Claim 4
Dependent Claim
28 words
The method of claim 1 , wherein the finding, classifying, constructing and replacing steps are repeated until all the event data associated with the event cache is considered.
Claim 5
Dependent Claim
24 words
The method of claim 1 , wherein the classifying step further comprises classifying the at least one pattern as one of normal and abnormal.
Claim 6
Dependent Claim
68 words
The method of claim 1 , wherein the at least one correlation rule constructing step further comprises the steps of: automatically learning at least one predicate of the at least one correlation rule from the at least one pattern found; and adding at least one corresponding action to the at least one automatically learned predicate, based on the classifying step, to form the at least one correlation rule.
Claim 7
Dependent Claim
38 words
The method of claim 5 , wherein the automatic learning step further comprises using at least one of a positive example and a negative example of the one or more events included in the at least one pattern.
Claim 8
Dependent Claim
46 words
The method of claim 1 , wherein the step of finding at least one pattern further comprises a user marking the at least one event pattern in accordance with a data visualization of at least a portion of the event data associated with the event cache.
Claim 9
Dependent Claim
22 words
The method of claim 1 , wherein the step of finding at least one pattern further comprises employing a data mining algorithm.
Claim 10
Dependent Claim
153 words
Apparatus for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the apparatus comprising: at least one processor operative to: (i) obtain, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system; (ii) find at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data; (iii) classify the at least one pattern found; (iv) construct at least one correlation rule based on the classified pattern; and (v) replace, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Claim 11
Dependent Claim
153 words
Apparatus for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the apparatus comprising: at least one processor operative to: (i) obtain, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system; (ii) find at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data; (iii) classify the at least one pattern found; (iv) construct at least one correlation rule based on the classified pattern; and (v) replace, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Claim 12
Dependent Claim
34 words
The apparatus of claim 9 , wherein the at least one processor is further operative to store the at least one correlation rule in a rule database for access by the event management system.
Claim 13
Dependent Claim
28 words
The apparatus of claim 9 , wherein the finding, classifying, constructing and replacing operations are repeated until all the event data associated with the event cache is considered.
Claim 14
Dependent Claim
24 words
The apparatus of claim 9 , wherein the classifying operation further comprises classifying the at least one pattern as one of normal and abnormal.
Claim 15
Dependent Claim
67 words
The apparatus of claim 9 , wherein the at least one correlation rule constructing operation further comprises: (i) automatically learning at least one predicate of the at least one correlation rule from the at least one pattern found; and (ii) adding at least one corresponding action to the at least one automatically learned predicate, based on the classifying step, to form the at least one correlation rule.
Claim 16
Dependent Claim
38 words
The apparatus of claim 13 , wherein the automatic learning operation further comprises using at least one of a positive example and a negative example of the one or more events included in the at least one pattern.
Claim 17
Dependent Claim
46 words
The apparatus of claim 9 , wherein the operation of finding at least one pattern further comprises a user marking the at least one event pattern in accordance with a data visualization of at least a portion of the event data associated with the event cache.
Claim 18
Dependent Claim
22 words
The apparatus of claim 9 , wherein the operation of finding at least one pattern further comprises employing a data mining algorithm.
Claim 19
Dependent Claim
161 words
An article of manufacture for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the article comprising a machine readable medium containing one or more programs which when executed implement the steps of: obtaining, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system; finding at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data; classifying the at least one pattern found; constructing at least one correlation rule based on the classified pattern; and replacing, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Claim 20
Dependent Claim
161 words
An article of manufacture for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the article comprising a machine readable medium containing one or more programs which when executed implement the steps of: obtaining, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system; finding at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data; classifying the at least one pattern found; constructing at least one correlation rule based on the classified pattern; and replacing, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Claim 21
Dependent Claim
152 words
Apparatus for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the apparatus comprising: means for obtaining, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system; means for finding at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data; means for classifying the at least one pattern found; means for constructing at least one correlation rule based on the classified pattern; and means for replacing, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Claim 22
Dependent Claim
152 words
Apparatus for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the apparatus comprising: means for obtaining, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system; means for finding at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data; means for classifying the at least one pattern found; means for constructing at least one correlation rule based on the classified pattern; and means for replacing, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.
Claim 23
Dependent Claim
28 words
The apparatus of claim 18 , further comprising means for storing the at least one correlation rule in a rule database for access by the event management system.
Claim 24
Dependent Claim
30 words
The apparatus of claim 18 , wherein the finding, classifying, constructing and replacing means repeat their respective operations until all the event data associated with the event cache is considered.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-02-23 | 2007-08-25 | 2008-02-24 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-02-23 | 2011-08-25 | 2012-02-24 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-02-23 | 2015-08-25 | 2016-02-24 | $7700.00 | Window Closed / Lapsed |