Methods for decomposing events from managed infrastructures

Patent metadata

Field	Value
Publication number	US-11080116-B2
Application number	US-201816232110-A
Country	US
Kind code	B2
Filing date	Dec 26, 2018
Priority date	Apr 29, 2013
Publication date	Aug 3, 2021
Grant date	Aug 3, 2021

Abstract

A method is provided for communication with a managed infrastructure. Messages are received at an extraction engine from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. Events are produced that relate to the managed infrastructure. The events are converted into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware. One or more common characteristics of events are determined. Clusters of events are produced relating to the failure or errors in the managed infrastructure. A source address is used for each event and a graph topology of the managed infrastructure to assign a graph coordinate to the event. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. In response to production of the clusters one or more physical changes is made in a managed infrastructure hardware and security of the managed infrastructure is maintained.

First claim

What is claimed is:

1. A method for communication with a managed infrastructure, comprising:
receiving messages at an extraction engine from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information;
producing events that relate to the managed infrastructure and converting the events into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware;
determining one or more common characteristics of events and producing clusters of events relating to the failure or errors in the managed infrastructure; using a source address for each event and a graph topology of the managed infrastructure to assign a graph coordinate to the event; where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure; and
wherein in response to production of the clusters one or more physical changes in a managed infrastructure hardware is made, where the hardware supports the flow and processing of information, and in response to production of the clusters security of the managed infrastructure is maintained.

2. The method of claim 1 , wherein security includes at least one of managed infrastructure: breach, intrusion or propagation.

3. The method of claim 1 , wherein security includes managed infrastructure: access control, intrusion detection and threat propagation.

4. The method of claim 1 , wherein security includes authentication of a subject.

5. The method of claim 1 , wherein security includes authorization of a subject.

6. The method of claim 5 , wherein authorization specifies what a subject can do.

7. The method of claim 1 , wherein security includes audit.

8. The method of claim 1 , where security includes identification and authentication to ensure that only authorized subjects can access the managed infrastructure.

9. The method of claim 1 , wherein security includes access approval grants to the managed infrastructure by association of users with resources that they are allowed to access, based on an authorization policy.

10. The method of claim 1 , wherein the managed infrastructure is from a business organization.

11. The method of claim 1 , wherein the managed infrastructure includes, computers, network devices, appliances, mobile devices, text or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

12. The method of claim 1 , wherein the managed infrastructure generates data that include attributes selected from at least one of, time, source a description of the event, textural or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

13. The method of claim 1 , further comprising: a publication message bus.

14. The method of claim 1 , further comprising: a data bus web server coupled to one or more user interfaces.

15. The method of claim 1 , wherein a plurality of link access modules is in communication with a data bus.

16. The method of claim 1 , further comprising: a database.

17. The method of claim 1 , wherein the extraction engine reformats data from the events to create reformatted data.

18. The method of claim 17 , wherein the reformatted data is received at a system bus.

19. The method of claim 1 , wherein a dictionary is generated with the word and subtexts using Shannon Entropy, −1n(1/NGen) and normalizes the words and subtexts.

20. The method of claim 11 , wherein normalized words and subtexts are mapped from a common 0.0 to a non-common 1.0.

21. The method of claim 1 , further comprising: an entropy database that in operation normalizes entropy for events.

Assignees

• Moogsoft Inc

Inventors

• Tee Philip
• Harper Robert Duncan
• Silvey Charles Mike

Classifications

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L51/216

  Handling conversation history, e.g. grouping of messages in sessions or threads · CPC title

• H04L51/42

  Mailbox-related aspects, e.g. synchronisation of mailboxes · CPC title

• H04L51/224

  providing notification on incoming messages, e.g. pushed notifications of received messages · CPC title

• H04L51/214

  using selective forwarding · CPC title