Alarm Suppression Database for Network Security Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The overwhelming number of duplicate alarms in a communications network can overwhelm cyber security teams and network operators, making it difficult to discern important alarm messages during security events.
Innovation Solution
A method and apparatus that uses a database or memory state table to suppress duplicate alarms by determining if an event exists, recording new events, and suppressing duplicate messages based on predefined attributes such as IP addresses, ports, and protocols, utilizing a state-based hash table to filter out redundant alarms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all alarm messages are processed and displayed, then complete security monitoring is achieved, but the system becomes overwhelmed by duplicate alarms making it difficult to discern important messages
Solution Approach 1:
The patent extracts duplicate alarm messages from the overall alarm stream by comparing each incoming alarm against a database of previously seen alarms. Duplicate alarms are identified and removed, leaving only unique alarms to be processed and displayed. This extraction principle directly resolves the contradiction by eliminating redundant information that causes operator overload while preserving all unique security events for complete monitoring.
Solution Approach 2:
The patent applies discarding by suppressing duplicate alarm messages that have already been processed. The system recovers useful information by maintaining a database of seen alarms and using this knowledge to filter future duplicates. This approach discards redundant data while recovering and preserving unique security events, thereby reducing operator workload without compromising monitoring completeness.
2Ease of operation
If duplicate alarms are suppressed, then operator workload is reduced, but the ability to detect recurring security events may be compromised
Solution Approach 1:
The patent implements feedback by continuously updating a database of seen alarms with each processed alarm message. This feedback mechanism allows the system to learn from previous alarms and make informed decisions about suppressing duplicates. The feedback loop ensures that only true duplicates are suppressed while maintaining the ability to detect and report recurring security events, as the system can distinguish between identical duplicates and genuinely new events.
Solution Approach 2:
The patent applies preliminary action by pre-processing alarm messages through comparison against the database of seen alarms before they reach the operator. This preliminary filtering action identifies and suppresses duplicates in advance, reducing operator workload. Simultaneously, the system maintains reliability by preserving unique events and updating the database, ensuring that recurring security events remain detectable through the feedback mechanism.
3Ease of operation
If a simple alarm display is used, then the system remains easy to operate, but it cannot effectively handle high volumes of alarm messages during security outbreaks
Solution Approach 1:
The patent introduces an intermediary component - the database of seen alarms - that mediates between the incoming alarm stream and the display system. This intermediary filters and processes alarm messages, allowing the simple display interface to remain easy to operate while the intermediary handles the complex task of managing high alarm volumes through duplicate suppression. The intermediary preserves unique events while eliminating duplicates, maintaining both simplicity and processing capacity.
Data Source
AI summary
A method and apparatus for suppressing a duplicated alarm in a communications network are described. In one embodiment, at least one alarm message associated with at least one event is received. A determination of whether the at least one event exists in a database is subsequently made. The at least one event is recorded in the database if the at least one event does not exist in the database. Conversely, the at least one alarm message is suppressed if the at least one event exists in the database.