US6941557B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for providing a global real-time advanced correlation environment architecture
Assignee: Verizon Laboratories Inc
•
Filing: 2000-05-23
•
Granted: 2005-09-06
•
Expires: 2020-05-23
Abstract
Abstract A method and system are disclosed for efficiently correlating network events within a data processing system and then transmitting messages to various network entities in response to an occurrence of a particular network event. According to the present invention, a network mediation service receives raw message streams from one or more external networks and passes the streams in real-time to the event notification service. The event notification service then passes the message to the message parsing service for processing. After the message has been parsed by the message parsing service, it is passed back to the event notification service which passes the message along an event channel to the network management service. The message is also passed to the event correlation service for event correlation. A knowledge-based database of message classes that define how to interpret the message text are used by the event correlation service to match correlation rule conditions to the observed events. After event correlation service processes the parsed event, it is passed to the network management service for resolution.
Inventors
- 👤 Gabriel Jakobson
- 👤 Leonhard Brenner
- 👤 Carol Lafond
- 👤 Mark Weissman
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 02:50
CPC Classifications
G; G06; G06F; G06F9/00; G06F9/06; G06F9/46; G06F9/54; G06F9/542
Claims Analysis
Total Claims: 16
Claim 1
Independent Claim
187 words
A data processing apparatus for correlating network events among a number of client services comprising: at least one computer comprising: a memory having program instructions; and a processor configured to use said program instructions to provide: a network management service; an event notification service; a network mediation service adapted to: receive a raw event from an external computer network; and transmit said raw event to said event notification service; a message parsing service adapted to: receive a raw event from said event notification service; parse said raw event; and transmit said parsed event to said event notification service; and an event correlation service coupled to a knowledge database comprising correlation knowledge, said event correlation service adapted to: receive said parsed event from said event notification service; utilize data stored in said knowledge database to derive an event from said parsed event; and transmit said derived event to one of a plurality of operator workstations via said event notification service, regardless of a significance of said derived event; wherein said network mediation, message parsing, event notification and network management services are coupled together via a plurality of interfaces.
Claim 2
Dependent Claim
187 words
A data processing apparatus for correlating network events among a number of client services comprising: at least one computer comprising: a memory having program instructions; and a processor configured to use said program instructions to provide: a network management service; an event notification service; a network mediation service adapted to: receive a raw event from an external computer network; and transmit said raw event to said event notification service; a message parsing service adapted to: receive a raw event from said event notification service; parse said raw event; and transmit said parsed event to said event notification service; and an event correlation service coupled to a knowledge database comprising correlation knowledge, said event correlation service adapted to: receive said parsed event from said event notification service; utilize data stored in said knowledge database to derive an event from said parsed event; and transmit said derived event to one of a plurality of operator workstations via said event notification service, regardless of a significance of said derived event; wherein said network mediation, message parsing, event notification and network management services are coupled together via a plurality of interfaces.
Claim 3
Dependent Claim
24 words
The data processing apparatus of claim 1 , wherein said network mediation service is adapted to interface with at least one external computer network.
Claim 4
Dependent Claim
41 words
The data processing apparatus of claim 2 , wherein said network mediation service is further adapted to: receive a raw event at said network mediation service from said external computer network; and transmit said raw event to said message parsing service.
Claim 5
Dependent Claim
30 words
The data processing apparatus of claim 1 , wherein said message parsing service is adapted to receive a raw event from said network mediation service and produce a parsed event.
Claim 6
Dependent Claim
30 words
The data processing apparatus of claim 4 , wherein said message parsing service is adapted to route said parsed event to said network management service via said event notification service.
Claim 7
Dependent Claim
30 words
The data processing apparatus of claim 5 , wherein said message parsing service is adapted to route said parsed event to said event correlation service via said event notification service.
Claim 8
Dependent Claim
23 words
The data processing apparatus of claim 1 , wherein said network management service is adapted to interface with a plurality of operator workstations.
Claim 9
Dependent Claim
41 words
The data processing apparatus of claim 1 , wherein said network management service is further adapted to: receive data requests from said plurality of operator workstations; and transmit said data requests to said event correlation service via said event notification service.
Claim 10
Dependent Claim
30 words
The data processing apparatus of claim 4 , wherein said event notification service is further comprised of: a raw event channel; a parsed event channel; and a derived event channel.
Claim 11
Dependent Claim
21 words
The data processing apparatus of claim 9 , wherein said event notification service is further comprised of at least one filter.
Claim 12
Dependent Claim
26 words
The data processing apparatus of claim 10 , wherein said at least one filter is coupled to at least one of said plurality of event channels.
Claim 13
Dependent Claim
35 words
The data processing apparatus of claim 9 , wherein said raw event channel is adapted to: receive a raw event from said network mediation service; and transmit said raw event to said message parsing service.
Claim 14
Dependent Claim
35 words
The data processing apparatus of claim 9 , wherein said parsed event channel is adapted to: receive a parsed message from said message parsing service; and transmit said parsed message to said network management service.
Claim 15
Dependent Claim
35 words
The data processing apparatus of claim 9 , wherein said parsed event channel is adapted to: receive a parsed event from said message parsing service; and transmit said parsed event to said event correlation service.
Claim 16
Dependent Claim
34 words
The data processing apparatus of claim 9 , wherein said derived event channel is adapted to: receive a derived event from said event correlation service; and transmit said derived event to network management service.
References Cited (Backward Citations)
US5193152A
Cited
US5063523A
Cited
US5388189A
Cited
US5276880A
Cited
US5257371A
Cited
US5339421A
Cited
US5805808A
Cited
US5495470A
Cited
US5715394A
Cited
US5488569A
Cited
US6477585B1
Cited
US5751914A
Cited
US5925108A
Cited
US5761502A
Cited
US5721825A
Cited
US6118936A
Cited
US5832228A
Cited
US5953404A
Cited
US6336139B1
Cited
US6446136B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2008-09-05 | 2009-03-07 | 2009-09-06 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2012-09-05 | 2013-03-07 | 2013-09-06 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2016-09-05 | 2017-03-07 | 2017-09-06 | $7700.00 | Window Closed / Lapsed |