Holo-entropy based alarm scoring approach

Patent metadata

Field	Value
Publication number	US-11258655-B2
Application number	US-201816212170-A
Country	US
Kind code	B2
Filing date	Dec 6, 2018
Priority date	Dec 6, 2018
Publication date	Feb 22, 2022
Grant date	Feb 22, 2022

Abstract

A method for managing alarms in a virtual machine environment includes receiving alarm data related to a process and storing the alarm data in a database, where the alarm data comprises one or more features. The method further includes retrieving intended state information for the process and comparing the one more features of the alarm data to the intended state information to determine whether the alarm is an outlier. The method also includes computing a normal score for the alarm if the alarm is not an outlier, and computing an abnormal score for the alarm if the alarm is an outlier. The method also includes sending a notification for the alarm and the computed score.

First claim

We claim:

1. A method for managing an alarm in a virtual machine environment, the method comprising:
receiving alarm data related to a process running on a virtual machine;
storing the alarm data in a database, wherein the alarm data comprises a plurality of features of the process, wherein each of the plurality of features is associated with an action of a plurality of actions performed by the process;
retrieving intended state information for the process;
calculating an outlier factor with a first equation based on: (i) an entropy value of the plurality of features of the process, and (ii) the intended state information to determine whether the alarm is an outlier, wherein an outlier comprises an outlier factor that falls outside of a first threshold, wherein the alarm is an outlier when at least one feature of the plurality of features of the process, if removed from the alarm data, would reduce, by at least a threshold, an entropy of a data set comprising the alarm data and the intended state information;
calculating a first score of the alarm with a second equation when the alarm is determined not to be an outlier, the first score calculated based on a minimum outlier factor determined by the first equation, wherein the first score comprises a normal score for the alarm, and calculating a second score of the alarm with a third equation when the alarm is determined to be an outlier, the second score calculated based on a maximum outlier factor determined by the first equation, wherein the second score comprises an abnormal score for the alarm, wherein the normal score falls within a first score range and the abnormal score falls within a second score range; and
sending a notification for the alarm and the calculated first score or second score, wherein the abnormal score results in a more critical notification than the normal score.

2. The method of claim 1 , wherein a feature of the plurality of features comprises a connection on a port associated with the process.

3. The method of claim 1 , wherein intended state information for the process comprises a baseline of behavior for the process.

4. The method of claim 1 , wherein intended state information is based on observed behavior of the process and stored in an intended states database.

5. The method of claim 1 , further comprising:
taking a remedial action to address the alarm based at least in part on the calculated first score.

6. The method of claim 1 , wherein the alarm indicates a deviation by the process from an intended state of the process, and wherein the outlier factor is indicative of whether the alarm is valid.

7. The method of claim 1 , wherein one or more of the plurality of features comprise a connection on a port associated with the process, and wherein the alarm data comprises:
one or more of an identifier (ID) of the alarm or an identity of the process;
one or more of a remote address of the connection, remote port number of the connection, a local address of the connection, or a local port number of the connection; or
one or more of a date or a time of the alarm.

8. A non-transitory computer-readable medium storing instructions that, when executed by a computer system, cause the computer system to perform operations for managing an alarm in a virtual machine environment, the operations comprising:
receiving alarm data related to a process running on a virtual machine;
storing the alarm data in a database, wherein the alarm data comprises a plurality of features of the process, wherein each of the plurality of features is associated with an action of a plurality of actions performed by the process;
retrieving intended state information for the process;
calculating an outlier factor with a first equation based on: (i) an entropy value of the plurality of features of the process, and (ii) the intended state information to determine whether the alarm is an outlier, wherein an outlier comprises an outlier factor that falls outside of a first threshold, wherein the alarm is an outlier when at least one feature of the plurality of features of the process, if removed from the alarm data, would reduce, by at least a threshold, an entropy of a data set comprising the alarm data and the intended state information;
calculating a first score of the alarm with a second equation when the alarm is determined not to be an outlier, the first score calculated based on a minimum outlier factor determined by the first equation, wherein the first score comprises a normal score for the alarm, and calculating a second score of the alarm with a third equation when the alarm is determined to be an outlier, the second score calculated based on a maximum outlier factor determined by the first equation, wherein the second score comprises an abnormal score for the alarm, wherein the normal score falls within a first score range and the abnormal score falls within a second score range; and
sending a notification for the alarm and the calculated first score or second score, wherein the abnormal score results in a more critical notification than the normal score.

9. The non-transitory computer-readable medium of claim 8 , wherein the operations further comprise:
taking a remedial action to address the alarm based at least in part on the calculated first score.

10. A computer system comprising:
a processor; and
a memory, wherein the memory includes instructions executable by the processor to perform operations for managing an alarm in a virtual machine environment, the operations comprising:
receiving alarm data related to a process running on a virtual machine;
storing the alarm data in a database, wherein the alarm data comprises a plurality of features of the process, wherein each of the plurality of features is associated with an action of a plurality of actions performed by the process;
retrieving intended state information for the process;
calculating an outlier factor with a first equation based on: (i) an entropy value of the plurality of features of the process, and (ii) the intended state information to determine whether the alarm is an outlier, wherein an outlier comprises an outlier factor that falls outside of a first threshold, wherein the alarm is an outlier when at least one feature of the plurality of features of the process, if removed from the alarm data, would reduce, by at least a threshold, an entropy of a data set comprising the alarm data and the intended state information;
calculating a first score of the alarm with a second equation when the alarm is determined not to be an outlier, the first score calculated based on a minimum outlier factor determined by the first equation, wherein the first score comprises a normal score for the alarm, and calculating a second score of the alarm with a third equation when the alarm is determined to be an outlier, the second score calculated based on a maximum outlier factor determined by the first equation, wherein the second score comprises an abnormal score for the alarm, wherein the normal score falls within a first score range and the abnormal score falls within a second score range; and
sending a notification for the alarm and the calculated first score or second score, wherein the abnormal score results in a more critical notification than the normal score.

11. The computer system of claim 10 , wherein the operations further comprise:
taking a remedial action to address the alarm based at least in part on the calculated first score.

Assignees

• Vmware Inc

Inventors

• Mo Zhen
• Wang Dexiang
• Zan Bin
• Ganti Vijay
• Chopra Amit
• Sun Ruimin

Classifications

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L41/0609 Primary

  based on severity or priority · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title