Network Alarm Correlation via Kernel Density Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network management systems face challenges in handling the flood of alarms in communication networks, as they require manual expert rules that are not flexible or adaptive, and struggle with distinguishing between alarms caused by the same fault, leading to inefficient troubleshooting and increased time and labor for operators.
Innovation Solution
A method using time series correlation coefficients for finding latent relations among alarms through Kernal Density Estimation, which allows for self-learning and adaptive alarm management without the need for static rules, effectively handling noisy alarms and enabling simultaneous investigation of related alarms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual alarm filtering and association analysis are used, then alarm data can be processed, but the system requires static expert rules that are not flexible or adaptive to network changes
Solution Approach 1:
The system performs self-learning by automatically analyzing alarm data to discover associations between alarms and network configurations without requiring manual expert rules. The network element itself generates the knowledge base by correlating alarm data with configuration data, enabling the system to adapt to network changes autonomously.
Solution Approach 2:
The system uses feedback from alarm data and configuration data to continuously update and refine alarm association models. By analyzing the relationship between alarms and network configurations over time, the system learns and adapts to network changes, improving its ability to identify root causes dynamically.
2Productivity
If alarm filtering is applied to reduce alarm volume, then the number of alarms presented to operators is reduced, but different types of alarms caused by the same fault still need to be investigated separately
Solution Approach 1:
The system merges multiple alarms of different types into unified alarm groups based on learned associations with the same network configuration elements. By identifying that different alarms originate from the same root cause through configuration data correlation, the system combines them into single investigable units, improving troubleshooting efficiency while preserving complete alarm relationship information.
Solution Approach 2:
The system adds a new dimension of analysis by correlating alarms with network configuration data, moving beyond traditional alarm-filtering approaches. This configuration-based dimension enables the system to group alarms by their underlying cause rather than by alarm type, allowing operators to investigate all related alarms together while maintaining full visibility of alarm relationships.
3Measurement precision
If association rule mining is used to discover alarm relationships, then alarm associations can be learned automatically, but the approach struggles with noisy alarms that occur constantly or frequently
Solution Approach 1:
The system changes the analytical parameters by incorporating configuration data alongside alarm data for correlation analysis. Instead of relying solely on alarm co-occurrence statistics, the system uses configuration data as an additional parameter to verify and validate alarm associations, thereby distinguishing true relationships from noise caused by frequently occurring unrelated alarms.
Data Source
AI summary
The invention relates to a network node and a method for handling alarms in a communications network. The method comprises, for a set S of alarms collected in the communications network during a time period T: —obtaining a first and a second type of alarms and their time of arrival from the set; and applying Kernal Density Estimation on the respective first and second type of alarms, by applying a distribution function to each occurrence of the first and second type of alarms; thus obtaining a respective distribution function for the first and second type of alarms over the time period T. The method further comprises determining a maximum correlation between the distribution function for the first type of alarms and the distribution function for the second type of alarms, and determining the time shift between the distribution functions associated with the maximum correlation; and obtaining an indication of a mutual relation between the first and second type of alarms based on the maximum correlation and the time shift. The method further comprises comparing the obtained indication with at least a first threshold, and managing the alarm types based on the comparison.