Causality Tree Construction for Multi-Alert Cloud Faults
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions are inadequate for identifying causality trees in complex multi-tenant cloud infrastructures, as they can only derive pairwise causality relationships, failing to effectively address the complexities of multiple alerts and cascading faults, which leads to ambiguity and delayed issue resolution.
Innovation Solution
A method that forms all possible combinations of alerts, detects co-occurrence and causality links using specific rules, and stores causality objects in a repository, enabling efficient identification of causality relationships between multiple alerts and constructing a causality tree to determine root causes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If pairwise causality relationships are derived from alerts analysis, then the processing complexity is low, but the ability to build causality trees for complex multiple alerts is insufficient
Solution Approach 1:
The method segments the complex problem of identifying causality relationships among multiple alerts into iterative steps. It starts with pairwise relationships (k=1) and progressively builds up to n-ary relationships by iterating through combinations of increasing complexity (k=2, 3, ..., n-1), allowing the system to handle complex alert scenarios while maintaining manageable processing at each step
Solution Approach 2:
The invention transitions from analyzing only pairwise alert relationships (2D) to identifying causality relationships among multiple alerts simultaneously (nD). By introducing the dimension of alert combination size k and iterating through different values, the system captures complex causal structures that cannot be represented by simple pairwise analysis alone
2Measurement precision
If all possible combinations of alerts are analyzed to identify causality relationships, then the accuracy of causality tree identification improves, but the processing cost increases
Solution Approach 1:
The method performs preliminary filtering of alert combinations before full causality analysis. By pre-identifying co-occurrent alert groups and filtering out combinations that cannot form valid causality relationships, the system reduces the search space and processing cost while maintaining the ability to identify accurate causality trees
Solution Approach 2:
The system analyzes combinations of k alerts where k ranges from 1 to n-1, which is partial analysis compared to examining all possible subsets. This partial approach focuses computational resources on the most relevant combinations that can form causality trees, avoiding unnecessary processing of redundant or impossible cases
3Loss of time
If the system processes high volume of alerts in real-time, then the reaction time to faults improves, but the complexity of identifying causality relationships increases
Solution Approach 1:
The system employs periodic iteration through increasing values of k (combination size) to identify causality relationships. This structured periodic approach processes alerts in manageable phases rather than attempting to analyze all combinations simultaneously, enabling real-time processing while systematically building the complete causality picture
Solution Approach 2:
The method dynamically adjusts the complexity of analysis by iterating through different values of k based on what has been found in previous iterations. As causality relationships are identified at each level, the system adapts its processing focus, making the complexity management flexible and responsive to the actual data patterns rather than statically predetermined
Data Source
Figure 1~2
Figure 3~7
AI summary
The invention relates to a method for identifying causality objects comprising a causality link between two or more alerts, the method comprising: - receiving (111) a set of alerts, iteratively - forming all possible combinations of a number k+1 of the alerts, -for each possible combination k+1 alerts, detecting a co-occurent combination as a function of one or more co-occurrence rule, -for a detected co-occurent combination of k+1 alerts, detecting if there is a causality link between a subset of k alerts of the combination of k+1 alerts and the last alert of the combination, as a function of one or more causality rule, and storing a causality object, - filtering the combinations of a number k of alert.