KR20030027537A - System and method of extracting event pattern and of determining whether to apply the extracted pattern in network - Google Patents

Abstract

PURPOSE: A system for extracting event patterns of a network, a method thereof, an application determining system of extracted patterns and a method therefor are provided to retrieve connection patterns of events by using long-term events and network topology information, and to suggest whether the connection patterns are repeated, thereby enabling operators to easily and exactly recognize system failures. CONSTITUTION: A network manager(2) manages a network state. An event database(6) stores an event where an alarm is generated as a table among equipments of a network(4). A network topology manager(8) has network topology information. An event pattern extractor(10) extracts event-generated patterns by information of the event database(6) and the topology information. A reference event is generated. Events generated at certain time intervals are retrieved. If the same events as the reference event exist, a counted number of the reference event is increased as many as the same events. The same events are retrieved at the same time intervals. A counted number of the retrieved events is increased as many as the same events. The retrieved events are extracted in event patterns.

Description

System and method of extracting event pattern and of determining whether to apply the extracted pattern in network}

The present invention relates to an event pattern extraction system and method of a network, and an application determination system and method for applying an extracted pattern. The present invention relates to analyzing correlations between events (alarms) generated in a communication network such as a transmission network, a switching network, and a data network. It's about a mechanism that makes it easier for operators to create rules that define event correlation in a system that informs operators of analytics information.

In the related art, when network management operators experience a failure in a managed system, the network management operators analyze the generated events based on experience and generate rules for them.

That is, when an alarm occurs in the network, the alarm is stored for a predetermined time, the pattern is extracted based on the stored alarm, the correlation is analyzed, and the law is generated by the operator's experience and manual methods.

However, such a method reduces the accuracy and speed, and also requires the operator's long experience and accurate network topology information to generate the correct law.

In system development, however, developers can facilitate the generation of accurate rules through long-term collection of operator opinions and analysis of network topology information.However, after the system is in operation, operators can create or delete their own rules according to the situation. Or use it with modifications.

In particular, when new types of events occur due to the introduction of new equipment, it is necessary to apply new laws. However, it takes a lot of time for operators to generate the rules by empirically recognizing them.

Even when developing an event correlation system, it takes too much time and effort to implement the application rules by analyzing the opinions of the operators and network topology information. Therefore, a mechanism is needed to make it easier to generate and verify the rules. Do.

An object of the present invention is to implement a mechanism for providing information to an operator so that the generation of the necessary rules in a system for correlation of events (alarms) generated in various networks based on the law can be quickly and accurately. It is to increase the utility of the event correlation system.

1 is a functional diagram of the event pattern extraction method according to the present invention.

2 is a diagram for explaining a schematic principle of a pattern extraction method.

3 is a diagram illustrating a method of pattern extraction by applying TW.

4 is a view for explaining a method for determining whether to apply the extracted pattern.

5 is a diagram of a method of using a pattern database as another method for determining whether to apply an extracted pattern.

The present invention provides a network management unit for managing a network state; An event database in which events generated in devices on the network are stored in a table; A network topology manager having network topology information; And extracting an event pattern from an event pattern extraction system of a network including an event pattern extractor for extracting a pattern in which an event occurs as information of the event database and topology information of the network topology manager.

A network topology management unit for storing network topology information, establishing and maintaining network connectivity information, and providing network topology information for correlation analysis; An event database that stores event information occurring in a network; A correlation knowledge information database in which event correlation knowledge information (law) is stored; A network management unit having a function of interworking with another network management system, extracting event information, maintaining a connection with another network management system, and an interface of a database; A domain event correlation unit for analyzing event correlation for each network, removing duplicate events, and compressing events of the same type; A cross-domain event correlation unit for analyzing event correlation between other networks and analyzing manganese relationships of important events; A network monitoring unit displaying event information on a screen and delivering the event information to an operator and serving as a web interface; And determining whether to apply the extracted pattern in the system, wherein the system determines the application of the extracted pattern of the network including an event notification unit for transmitting event information received from the domain event correlation unit and the cross-domain event correlation unit to the network monitoring unit. .

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

For the embodiment according to the present invention, as shown in Figure 1, the network management unit 2 is configured to manage the state of the network 4, the network 4 is connected to enable a plurality of devices to communicate.

The network management unit 2 has an event database 6 and a network topology management unit 8, and the event database 6 stores an event in which alarms occur in the devices on the network 4 as a table. The network topology manager 8 has network topology information.

The event pattern extractor 10 is configured to extract a pattern in which an event occurs as information of the event database 6 and topology information of the network topology manager 8.

An event pattern can be extracted by searching for a similar pattern even if a particular alarm, alarm group, or repeating pattern that is always repeated identically does not exactly match.

When finding these patterns, a parameter value called TimeWindow (hereinafter referred to as 'TW') is used to determine a time for matching the pattern, which can be changed by the user.

A method of extracting a pattern using alarms stored in the event database 6 and network topology information stored in the network topology manager 8 will be described with reference to FIG. 2.

Referring to the table example of the event database 6, the pattern of alarms having IDs of 1, 3, 6, and 7 and alarms of 21, 23, 24, and 26 exactly matches.

That is, ID 1 alarm, ID 21 alarm, ID 3 alarm, ID 23 alarm, ID 6 alarm and ID 24 alarm, ID 7 alarm and ID 26 alarm are the same alarm.

When alarm 1A occurs in device 1, alarm 2C will always be triggered in device 2 within a certain time (TW) .If alarm 2C occurs in device 2, alarm 4C will be generated in device 4 within device TW. When Alarm 4C occurs, it can be seen that Alarm 6C has occurred in Equipment 6 within the TW.

The extraction of FIG. 2 exemplifies a case where the TW is 1 minute, and a time difference between adjacent alarms in alarms of the extracted pattern is within 1 minute. If the time difference between adjacent alarms exceeds 1 minute, it is not recognized as a pattern.

Two methods of applying the TW will be described with reference to FIG. 3.

First, as shown in FIG. 3A, by using a separate TW, TW is set to 1 minute and a pattern is extracted. The search is started using the alarm 1A (ID 1) generated in the equipment 1 as a reference alarm.

When the alarm 1A (ID 1; 20) occurs in the device 1, the network topology information is used to find the device connected to the device 1 (device 2; see FIG. 2), and the alarm generated from the connected device (its own alarm). Find alarm in TW).

Here, the 1B alarm (ID 2) 22 generated in the device 1 and the 2C alarm (ID 3) 24 generated in the device 2 are searched.

Then, when the same alarm ID 21 as the reference alarm 20 is searched using the stored alarm data, the count value of the reference alarm 20 is increased, and then based on the searched alarm ID 21, It is searched whether an alarm such as a 1B alarm (ID 2; 22) generated in the device 1 and a 2C alarm (ID 3; 24) generated in the device 2 occurred in the TW.

In this case, since the 2C alarm (ID 23) of the device 2 is searched, the count value of the 2C alarm (ID 3; 24) of the device 2 is increased.

Since the count value of the 1A alarm (ID 1; 20) of the device 1 and the count value of the 2C alarm (ID 3; 24) of the device 2 are equal to 2, when the 1A alarm of the device 1 occurs, the 2C of the device 2 always remains in the TW. You can see that an alarm has occurred.

Here again, the 2C alarm (ID 3) of the equipment 2 is viewed as the reference alarm 30, and the pattern is inspected in the same manner as described above.

When the alarm 2C (ID 3; 30) occurs in the device 2, the network topology information is used to find the device (device 1, device 3, device 4) connected to the device 2, and the alarm (own Find alarm in TW)

Here, the 3C alarm (ID 5; 32) generated by the device 3 and the 4C alarm (ID 6; 34) generated by the device 4 are searched.

Then, when the same alarm ID 23 as the reference alarm 30 is searched using the stored alarm data, the count value of the reference alarm 30 is increased, and then based on the searched alarm ID 23, It is searched whether an alarm such as a 3C alarm (ID 5; 32) occurring in the device 3 and 4C alarm (ID 6; 34) occurring in the device 4 occurred in the TW.

In this case, since the 4C alarm (ID 24) of the device 4 is searched, the count value of the 4C alarm (ID 6; 34) of the device 4 is increased.

Here too, the count value of the 2C alarm (ID 3; 30) of the device 2 is the same as the count value of the 4C alarm (ID 6; 34) of the device 4, so that when the 2C alarm of the device 2 occurs, Notice that a 4C alarm has occurred.

In addition, the 4C alarm (ID 6) of the equipment 4 here again as a reference alarm 40, and checks the pattern in the same manner as described above.

When the alarm 4C (ID 6; 40) occurs in the device 4, the network topology information is used to find the device (device 2, device 5, device 6) connected to the device 4, and the alarm (own Find alarm in TW)

Here, the 6C alarm (ID 7) 42 generated by equipment 6 is retrieved.

Then, when the same alarm ID 24 as the reference alarm 40 is searched using the stored alarm data, the count value of the reference alarm 40 is increased, and then based on the searched alarm ID 24, Search for whether an alarm, such as a 6C alarm (ID 7; 42), that has occurred in the device 6 detected in the TW has occurred.

In this case, since the 6C alarm (ID 26) of the device 6 is retrieved, the count value of the 6C alarm (ID 7; 42) of the device 6 is increased.

Here again, the count value of 4C alarm (ID 6; 40) of device 4 and the count value of 6C alarm (ID 7; 42) of device 6 are equal to 2, so when the 4C alarm of device 4 occurs, Notice that a 6C alarm has occurred.

The alarm patterns extracted through the above steps are 1A alarm of equipment 1, 2C alarm of equipment 2, 4C alarm of equipment 4, and 6C alarm of equipment 6.

Second, as shown in FIG. 3B, a method of extracting a pattern by fixing the start time of the TW to the occurrence time of the 1A alarm ID 1 of the equipment 1 may be used. In this case, the TW is set to 3 minutes. The pattern is all present within a given time.

That is, 1A alarm of equipment 1, 2C alarm of equipment 2, 4C alarm of equipment 4, and 6C alarm of equipment 6 are all present in the TW.

When the search is started based on the reference alarm, first, the alarm generated by the device generating the reference alarm and the devices connected to the device generating the reference alarm is searched in the TW and the pattern is extracted in the same manner as in FIG. 3A. Only the size of the TW is different, and the result of the extracted pattern is the same.

The pattern extracted as described above generates a rule if there is no law applied by determining whether to apply the rule of the pattern and there is a need to generate a law.

4 is a functional diagram for explaining a method of determining whether to apply such an extracted pattern.

The present invention to determine whether to apply the extracted pattern,

A network management unit 300 having a function of interworking with another network management system, extracting event information, maintaining a connection with another network management system, and an interface of a database;

A network topology management unit 100 for storing network topology information, establishing and maintaining network connectivity information, and providing network topology information necessary for correlation analysis; An event database 110 in which event information occurring in a network is stored; A correlation knowledge database 120 in which event correlation knowledge information (law) is stored;

Domain Event Correlation Service (310) for analyzing event correlation for each network, eliminating duplicate events, and compressing events of the same type; Cross-Domain Event Correlation Service (320) for analyzing event correlation between other networks and analyzing manganese relationships of important events;

A network monitoring unit 330 for displaying event information on a screen and delivering the event information to an operator and serving as a web interface; And an event notification unit 340 for transmitting the event information received from the domain event correlation unit 310 and the cross-domain event correlation unit 320 to the network monitoring unit 330.

Here, the network may be both a switching network, a transmission network, and a data network, and a domain refers to each network.

Thus, when an event occurs in any one type of network, the network management unit 300 extracts the event information, and the domain event correlation unit 310 extracts information from the event database 110 and the correlation knowledge information database 120. And, by analyzing the event correlation based on the network topology information through the network topology management unit 100 and transmits to the event notification unit 340, the event notification unit 340 transmits the event information to the network monitoring unit ( 330) to allow the operator to create a new law with the information.

Or, if an event occurs not only in one type of network but also occurs in several types of networks at the same time, then cross-domain event correlation is performed to analyze the event correlation between other networks and the relationships between important events. In operation 320, the event correlation is analyzed and the operator is informed.

As a result of analyzing the event correlation as described above, if the pattern is new, the pattern is output as it is, and if there is already a law applied to the pattern, the correlation is analyzed.

The process of analyzing the event correlation in the domain event correlation unit 310 and the cross-domain event correlation unit 320 and determining whether to apply a pattern will be described in more detail.

5 is a diagram for describing a method for determining whether to apply an extracted pattern.

When the pattern is extracted, the correlation between the extracted alarm patterns is analyzed by using existing rules stored in the correlation knowledge information database and network topology information in the network topology database. (S2).

Then, the operator is to determine whether to generate a law for the extracted pattern based on the analyzed result (S4) (S6).

6 is a diagram illustrating a method of using a pattern database as another method for determining whether to apply an extracted pattern.

The extracted patterns are stored in the pattern database.

When the repeating pattern of the alarm is extracted, a pattern database that is already stored is searched to determine whether the same pattern exists (S12). If the same pattern exists, the extracted pattern is discarded (S14).

If the same pattern does not exist, the operator examines the extracted pattern to determine whether it is useful (S16). If it is determined that it is not useful, the operator displays unnecessaryness in the pattern (S18) and stores the pattern in the pattern database (S20).

In the above, when the operator judges the utility of the extracted pattern, the operator may determine whether to generate a law for the extracted pattern. If the utility determines that the operator has a utility, the operator generates a new law.

That is, it is determined whether the extracted pattern is applied in the two methods of FIGS. 5 and 6 as described above, and if there is no law to be applied and there is a need to generate a law, a law is generated.

When developing an event correlation analysis system using the present invention, development time can be shortened, and even when operating the event correlation analysis system, an operator can easily generate accurate and necessary rules for event analysis, thereby analyzing the event. Since the accuracy and utility of the system is increased, the operator can quickly and accurately recognize the failure of the managed system, thereby having an effect to deal with it quickly.

In addition, through this it is possible to shorten the troubleshooting time, prevent the duplicate failure of the actual failure system, etc., thereby improving the overall network quality.

Claims (7)

A network manager for managing network status; An event database in which events generated by an alarm in the devices on the network are stored in a table; A network topology manager having network topology information; And And an event pattern extracting unit for extracting a pattern in which an event occurs as information of the event database and topology information of the network topology managing unit. Event pattern extraction including a network manager for managing network status, an event database for storing events generated on the network as a table, a network topology manager with network topology information, and an event pattern extractor for extracting patterns in which events are generated In the event pattern extraction method of the system, A first step of selecting a reference event among a plurality of events sequentially generated and stored; Searching for an event occurring within a predetermined time interval in a plurality of devices connected to the device having the reference event and the device having the reference event, based on the reference event; A third step of searching for the same event as the reference event among the plurality of sequentially generated and stored events, and if the same event as the reference event exists, increasing the count of the reference event by the same event number; A fourth step of searching for the same event as the event searched in the second step within the same time interval as the predetermined time interval based on the same event as the reference event of the third step; In the fourth step, if there is an event identical to the event searched in the second step, increasing the count number of the event searched in the second step by the same event number; And And a sixth step of extracting the reference event and the event retrieved in the second step into an event pattern when the count number of the event retrieved in the second step and the reference event are the same. The method of claim 2, And repeating the second to sixth steps based on the event extracted as the event pattern in the sixth step among the events searched in the second step. A network topology management unit for storing network topology information, establishing and maintaining network connectivity information, and providing network topology information for correlation analysis; An event database that stores event information occurring in a network; A correlation knowledge information database in which event correlation knowledge information (law) is stored; A network management unit having a function of interworking with another network management system, extracting event information, maintaining a connection with another network management system, and an interface of a database; A domain event correlation unit for analyzing event correlation for each network, removing duplicate events, and compressing events of the same type; A cross-domain event correlation unit for analyzing event correlation between other networks and analyzing manganese relationships of important events; A network monitoring unit displaying event information on a screen and delivering the event information to an operator and serving as a web interface; And And an event notification unit for transmitting the event information received from the domain event correlation unit and the cross-domain event correlation unit to the network monitoring unit. The method of claim 4, wherein And said network is a switching network, a transmission network, and a data network, and domains are respective networks. Network topology manager that stores network topology information, event database that stores event information generated in the network, correlation knowledge information database that stores event correlation knowledge information, network manager that manages network, and events for each network Domain event correlation unit for analyzing correlation, cross-domain event correlation unit for analyzing event correlation between other networks, network monitoring unit for displaying event information on the screen, and domain event correlation unit and cross-domain In the determination method of applying the extracted pattern of the extracted pattern of the system having an event notification unit for transmitting the event information received from the event correlation unit to the network monitoring unit, Analyzing correlations of the extracted alarm patterns by using existing laws stored in the correlation knowledge information database and network topology information in the network topology management unit; Analyzing an existing rule by applying an existing rule to the pattern of the alarm; And Based on the analyzed result, the operator determines whether to generate a law for the extracted pattern, characterized in that it comprises the step of determining the application of the extracted pattern of the network Network topology manager that stores network topology information, event database that stores event information generated in the network, correlation knowledge information database that stores event correlation knowledge information, network manager that manages network, and events for each network Domain event correlation unit for analyzing correlation, cross-domain event correlation unit for analyzing event correlation between other networks, network monitoring unit for displaying event information on the screen, and domain event correlation unit and cross-domain In the determination method of applying the extracted pattern of the extracted pattern of the system having an event notification unit for transmitting the event information received from the event correlation unit to the network monitoring unit, If the repeated pattern of the alarm is extracted, searching for a pattern database already stored and determining whether the same pattern exists; Discarding the extracted pattern if the same pattern exists as a result of the determination; If the same pattern does not exist, the operator inspects the extracted pattern to determine whether it is useful; And And if the result of the determination of the utility determines that there is no utility, displaying the unnecessaryness on the pattern and storing the pattern.