Event Correlation Graphs for Filtering Irrelevant Signatures

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing event correlation methods generate a large number of irrelevant signatures due to a lack of domain-awareness and fail to adapt correlation parameters like time window and confidence, leading to challenges such as overwhelming data, low confidence, and rare event correlations, with difficulties in interpreting these signatures effectively.

Innovation Solution

A processor-implemented method and system that select a correlation scope and self-tuned time windows by constructing a graph of entities and interconnections, applying heuristic functions, and deriving event correlation signatures through clustering and interpreting them for specific use cases, using techniques like dot product of matrices and classification algorithms to enhance confidence and support.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If correlations are computed blindly on the entire event dump, then a large number of correlation signatures are generated, but most of these signatures are irrelevant and overwhelming

Engineering Contradiction:

Improvenumber of correlation signaturesVSAvoidrelevance of signatures

Core Design Contradiction:

Quantity of substanceVSLoss of information

Solution Approach 1:

The patent segments the event data by constructing a graph where entities are nodes and relationships are edges. This segmentation allows correlation analysis to be performed on meaningful subsets of events rather than the entire event dump, thereby generating relevant correlation signatures while reducing the quantity of irrelevant ones.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by making correlation parameters (such as time window, minimum support, and minimum confidence) adaptive to local characteristics of event groups. Different parameter settings are applied to different regions of the event graph based on the specific entities and relationships involved, improving the relevance of generated signatures.

Inventive Principle:

Principle #3Local quality

2Adaptability or versatility

If fixed correlation parameters are used for all events, then the process is simple, but the parameters do not adapt to different event types and entities

Engineering Contradiction:

Improveadaptability of correlation parametersVSAvoidcomplexity of parameter selection process

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements dynamic parameter adaptation by automatically adjusting correlation parameters based on the characteristics of the event graph. The system dynamically determines appropriate time windows, support thresholds, and confidence levels for different event types and entity relationships, eliminating the need for manual fixed parameter configuration.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system performs self-service by automatically selecting and tuning correlation parameters without requiring external intervention. The graph-based approach enables the system to self-determine the appropriate correlation scope and parameters based on the inherent structure and properties of the event data.

Inventive Principle:

Principle #25Self-service

3Reliability

If correlation time window and confidence thresholds are not adapted, then the computation is fast, but the results lack confidence and applicability

Engineering Contradiction:

Improveconfidence of correlation signaturesVSAvoidtime for parameter tuning

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by pre-computing and storing entity relationships and event characteristics in a graph structure before performing correlation analysis. This preliminary organization of data enables rapid determination of appropriate time windows and confidence thresholds during the actual correlation computation, avoiding time-consuming parameter tuning while maintaining high confidence results.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250245078A1Systems and methods for managing event correlations

Publication Date: 2025.07.31 TATA CONSULTANCY SERVICES LTD

AI summary

Existing methodologies apply correlations blindly on the entire event dump leading to many irrelevant correlation signatures and miss out many correlation signatures due to its weak confidence and ignores the events which are observed rarely. These approaches also generate large number of correlation signatures which becomes overwhelming to consume. Embodiments of the present disclosure provide systems and methods for managing event correlations. Events information of an enterprise along with associated timeseries is received and a right correlation scope and a plurality of self-tuned time windows are selected. The correlation scope and the plurality of self-tuned time windows are then used for deriving a plurality of event correlation signatures associated with a set of candidate events. The derived event correlation signatures are then interpreted to obtain a filtered set of event correlation signatures. Each correlation signature from the filtered set of event correlation signatures is mapped to a use case.