On-Demand Fault Reduction Framework for Network Alarm Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network Operation Centers face challenges in effectively monitoring and managing complex networks due to the flood of alarms generated by network devices, which can overwhelm operators and hinder timely identification of specific faults.
Innovation Solution
The On-Demand Fault Reduction Framework provides a graphical user interface for users to design correlation rules, allowing for aggregation, suppression, and root cause analysis of alarms, enabling the identification of faults and reducing unnecessary alarms through a correlation engine that processes and displays correlated alarms in a Fault Management dashboard.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If alarm aggregation and correlation are implemented, then the number of alarms is reduced, but the device complexity increases
Solution Approach 1:
The correlation engine is divided into multiple independent components: event correlation module, alarm aggregation module, suppression module, and root cause analysis module. Each module handles specific correlation tasks independently, reducing the complexity of the overall system while maintaining comprehensive alarm reduction capabilities.
Solution Approach 2:
The correlation engine is designed as a universal platform that can handle multiple types of correlation operations (aggregation, suppression, root cause analysis) through a single integrated system. This multi-functional design reduces the need for separate specialized systems for each correlation type.
2Measurement precision
If comprehensive alarm correlation is implemented, then fault identification accuracy is improved, but the processing time increases
Solution Approach 1:
The system pre-configures correlation rules, aggregation criteria, and suppression patterns before alarm floods occur. Event correlation templates and root cause analysis models are prepared in advance, enabling the correlation engine to quickly match incoming alarms against pre-defined patterns rather than analyzing everything from scratch.
Solution Approach 2:
An event correlation layer is introduced as an intermediary between raw alarm generation and fault identification. This layer aggregates similar events, filters out duplicates, and presents processed correlation results to the fault management system, reducing the time required for comprehensive analysis.
3Productivity
If real-time alarm correlation is implemented, then network monitoring effectiveness is improved, but the computational resources required increase
Solution Approach 1:
The correlation engine applies partial correlation processing to alarm streams by focusing on the most critical correlation operations first. Not all possible correlation rules are applied to every alarm - instead, the system prioritizes high-impact correlation tasks and applies less intensive processing to lower-priority alarms, reducing overall computational burden while maintaining monitoring effectiveness.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method for correlating alarms that are generated with relation to a computer network is disclosed. The alarms represent faults of the computer network and/or faults of components of the computer network. The computer-implemented method comprises: displaying, on a display device, a graphical user interface that allows a user to select a type of correlation between one or more alarms and a type of fault which causes the one or more alarms from among a plurality of types of correlation; receiving, via the graphical user interface, a user input indicating the type of correlation selected by the user; storing, in a database, at least one rule based on the selected correlation; receiving, by a server, a plurality of alarms generated with relation to the computer network; correlating, by a correlation engine, the plurality of alarms received by the server according to the at least one rule stored in the database to identify a fault which has caused the one or more alarms; and displaying, on the display device, the at least one identified fault.