Network Event Correlation via Dependency Data Structures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current event correlation techniques in communication networks face scalability issues due to combinatorial explosions of event combinations, requiring inefficient brute-force traversals and complex rule-based systems, which hinder effective root cause analysis.
Innovation Solution
A uniquely configured data structure that captures logical and physical dependency relationships between network entities, allowing for auto-correlation of events by mapping inferences directly into the data structure, reducing the need for extensive network topology model traversals and enhancing scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If brute-force traversal of topology graph is used for event correlation, then complete event correlation is achieved, but system complexity and processing time increase exponentially
Solution Approach 1:
The patent segments the network topology into hierarchical levels (core layer, distribution layer, access layer) and groups entities by type and function. This segmentation transforms the monolithic topology graph into manageable segments, allowing correlation algorithms to operate on smaller subsets rather than the entire network, thereby reducing computational complexity while maintaining correlation completeness.
Solution Approach 2:
The patent performs preliminary actions by pre-computing and storing topology relationships, entity attributes, and correlation rules in optimized data structures before event correlation is needed. Topology graphs are pre-processed to establish adjacency lists, path relationships, and dependency mappings, so that when events occur, the system can quickly retrieve pre-computed relationships rather than traversing the entire topology in real-time.
2Measurement precision
If rule-based systems with extensive traversal are used, then accurate root cause identification is achieved, but processing speed decreases
Solution Approach 1:
The patent applies local quality by assigning specific attributes and properties to different parts of the topology graph based on their functional roles. Core routers have different attributes than access switches, and different entity types have specialized correlation rules. This allows the system to apply targeted, optimized correlation logic to each local region rather than using a single generic traversal algorithm throughout the entire network, improving both accuracy and speed.
Solution Approach 2:
The patent changes parameters by dynamically adjusting correlation thresholds, search depths, and traversal priorities based on event types, network conditions, and configured importance weights. The system can modify search parameters in real-time to balance between thoroughness and speed, such as limiting traversal depth for non-critical events while performing exhaustive searches for critical failures, thereby optimizing the balance between accuracy and processing speed.
3Reliability
If comprehensive topology modeling is implemented, then all event relationships are captured, but data structure complexity and memory requirements increase
Solution Approach 1:
The patent extracts and stores only the essential topology relationships and entity attributes needed for correlation in optimized data structures. Rather than maintaining complete copies of all network configurations and relationships, the system extracts critical elements such as adjacency relationships, parent-child hierarchies, and key entity properties, storing them in compact formats that reduce memory requirements while preserving correlation capability.
Solution Approach 2:
The patent uses copying by creating simplified representations or proxies of complex topology relationships. Instead of storing entire entity configurations and all possible relationship paths, the system creates condensed copy structures that capture the essential correlation information needed for event analysis, allowing efficient storage and retrieval without duplicating the full complexity of the original network model.
Data Source
AI summary
A uniquely configured data structure is used to store event information for each network entity, where logical and physical dependency relationships among entities are captured in the data structure. For each entity, the data structure is configured to store (a) a “genuine event set”, which includes a list of events that originated in association with the entity; and (b) a “derived event set”, which includes a list of records in which each record is associated with an event that originated in association with an entity that has a dependency relationship (e.g., layering or topological) with the entity. The derived event set may simply comprise references to the genuine event sets for entities that have a dependency relationship with the entity.