Real-time Event Correlation via Delta Causality Matrix
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional event correlation and root cause analysis methods in information networks are not suited for real-time processing, as they typically perform operations periodically and execute single-threaded code, leading to high computational complexity and latency, making it difficult to efficiently detect and manage problems in complex network systems.
Innovation Solution
The method involves generating a delta causality matrix based on topology changes to modify existing contexts, allowing for real-time event correlation by utilizing a distributed event correlation engine framework that executes multiple segments of code in parallel, reducing the need to rebuild full causality matrices and contexts from scratch.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If conventional event correlation methods are used, then problem detection capability is maintained, but processing latency and computational complexity increase significantly
Solution Approach 1:
The patent segments the event correlation process into distinct modules: event reception module, event correlation module, and problem determination module. The causality matrix is divided into multiple segments that can be processed in parallel, with each segment handling specific portions of the event data. This segmentation enables distributed processing across multiple processors, significantly reducing computational complexity and processing latency while maintaining comprehensive problem detection capability.
2Measurement precision
If full causality matrices are rebuilt periodically, then event correlation accuracy is maintained, but processing speed decreases
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing causality matrix segments before events occur. The system maintains pre-established causality relationships between network elements, problems, and symptoms in segmented form. When events are received, the system quickly retrieves and combines relevant pre-computed segments rather than rebuilding the entire causality matrix, thereby maintaining high correlation accuracy while dramatically improving processing speed.
Solution Approach 2:
The system dynamically adapts the causality matrix processing based on incoming events. Rather than statically rebuilding the entire matrix periodically, the system dynamically selects and combines only the relevant causality segments needed for the current event correlation task. This dynamic approach maintains accuracy by including all necessary relationships while improving speed by excluding unnecessary computations.
3Reliability
If single-threaded code is executed, then implementation simplicity is maintained, but real-time processing capability is lost
Solution Approach 1:
The patent segments the event correlation functionality into independent modules that can execute concurrently on multiple processors. The event reception module, event correlation module, and problem determination module operate as separate functional segments. The causality matrix is similarly segmented into multiple processable units. This segmentation enables multi-threaded and distributed execution while maintaining clear module boundaries and interfaces, making the increased architectural complexity manageable and the real-time processing capability achievable.
Data Source
AI summary
Systems and methods are provided for managing information networks. A delta causality matrix is generated based on newly discovered topology changes in an information network. The delta causality matrix specifies changes in problem-symptom relationships of a causality matrix associated with constituent objects in a previous topology of the information network. The delta causality matrix is utilized to modify at least one context which comprises a first set of related symptoms and problems associated with the constituent objects in the previous topology of the information network. The modified context includes a second set of related symptoms and problems associated with constituent objects of the modified topology of the information network. An event correlation operation is performed utilizing the modified context and active symptoms detected in the information network, to determine at least one problem which has a symptom signature that corresponds to the set of current symptoms.