A method and system application of dynamic bayesian networks and probabilistic models for network event correlation
Publication Date: 2010-Aug-20
The IP.com Prior Art Database
Disclosed is a system and method for application of dynamic bayesian networks and probabilistic models for network event correlation. Markov models are used herein to accurately build probabilistic transitions based on the supplied data. Markov models could be trained to recognize 'event scenarios' (e.g. Loss of Signal) and hence identify the 'root-cause' and symptomatic events
A method and system application of dynamic bayesian networks and probabilistic
models for network event correlation
This disclosure is designed to primarily solve the problem of event correlation in networks. In any network a failure can lead to a small number of 'root-cause' events, where events are most indicative of the problem, and a large number of 'symptomatic' events, where these events are by-products of the 'root-cause' events. Conventional solutions involve either the application of
(a) a probability matrix (codebook),
(b) a topology model, or
(c) a customized rules-based approach.
to solve such event correlation problems. Probability matrix approaches have the disadvantage of not being able to scale up efficiently and do not take into account temporal indicators, topology models are dependent upon an accurate topology discovery, and rules based approaches are dependent upon manual development of the rules. This solution proposes to solve the problem by applying probabilistic, for example Markov methods, that are independently trainable as well as capable of taking temporal (time-based) variables into account when performing correlation. It should be obvious that various other probabilistic methods may be used to solve these kinds of problems. Hidden Markov Models are statistical models commonly used in pattern recognition applications, for example Speech Recognition. Models are typically 'trained', i.e. fed numerous examples and use cases via an algorithm known as the 'forward backward algorithm'. This enables the Markov models to accurately build probabilistic transitions based on the supplied data. After training, the pattern to be recognized is fed into each model, with each model responding with an overall 'indicator' (probability match). The model with the greatest probability is marked as the most like pattern/model for the supplied information.
These models, whilst being applied in many areas of pattern recognition, have not yet been applied to the area of event correlation. Markov models could be trained to recognize 'ev...