Network Alert Pattern Mining via Sliding Transaction Window
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network management systems face challenges in rapidly identifying the root cause of network alerts due to the interrelated nature of network devices, where changes in one device can affect others, making it difficult to determine the root cause of related alerts in a timely manner.
Innovation Solution
The implementation of a real-time frequent mining technique using a sliding transaction window and adaptive vertical format mining to associate network alerts with transactions, apply a pruning test to identify co-occurrences, and cluster alerts to determine the largest grouping associated with the same transaction, thereby providing a notification of the identified pattern.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional network alert analysis methods are used to examine each alert individually, then comprehensive analysis coverage is achieved, but the time required to identify root cause increases significantly
Solution Approach 1:
The patent segments the network alert analysis process into distinct phases: pattern identification phase (grouping related alerts by root cause) and detailed analysis phase (examining specific alerts). This segmentation allows the system to quickly identify potential root causes through pattern recognition without requiring immediate comprehensive analysis of all alerts, thus reducing time loss while maintaining analysis coverage.
Solution Approach 2:
The system performs preliminary action by pre-identifying alert patterns and relationships before actual root cause analysis is needed. The patent establishes alert patterns in advance based on historical data and device relationships, so when alerts occur, the system can immediately match them against known patterns rather than starting analysis from scratch, significantly reducing identification time.
2Loss of information
If comprehensive analysis of all network alerts is performed, then complete understanding of network status is achieved, but resource consumption increases
Solution Approach 1:
The patent extracts and focuses only on the most relevant alerts for root cause analysis by identifying patterns and relationships among alerts. Instead of processing all alerts equally, the system extracts the subset of alerts that are most likely related to the root cause based on pattern matching and device relationship analysis, reducing processing resources while maintaining complete understanding of the critical network status.
Solution Approach 2:
The system applies local quality by differentiating the analysis depth applied to different alerts. Alerts that match identified patterns receive focused analysis while maintaining overall network status understanding, whereas unrelated alerts receive minimal processing. This selective approach ensures complete understanding of network status where needed while conserving processing resources.
3Measurement precision
If manual analysis of network alerts is performed, then detailed inspection is possible, but processing speed decreases
Solution Approach 1:
The patent introduces an intermediary automated pattern recognition system between manual analysis and raw alerts. This intermediary automatically identifies alert patterns, groups related alerts, and prioritizes them for detailed inspection, enabling both high processing speed through automation and detailed inspection capability when needed, thus resolving the contradiction between manual inspection detail and processing speed.
Data Source
AI summary
In one embodiment, a device receives a plurality of network alerts over a time frame. A sliding transaction window is used across the time frame to associate each network alert occurring within the transaction window with one or more transactions. A pruning test is applied to subsets of the plurality of network alerts, with the network alerts in a given subset being associated with the same transaction. The pruning test is based in part on the number of co-occurrences of network alerts in a given subset for different transaction windows. The subsets of network alerts are assigned to network alert clusters based on the applied pruning test. The network alerts are then joined within a network alert cluster to identify the largest grouping of network alerts that pass the pruning test. A notification that the identified grouping of network alerts is associated with the same transaction is also provided.