Topology-homogeneity for enriching event patterns in artificial intelligence operations

Patent metadata

Field	Value
Publication number	US-12081385-B2
Application number	US-202218046900-A
Country	US
Kind code	B2
Filing date	Oct 14, 2022
Priority date	Oct 14, 2022
Publication date	Sep 3, 2024
Grant date	Sep 3, 2024

Abstract

A method for determining a correlation of one or more events occurring in a plurality of nodes of a network includes accessing, by a computing device, address information associated with each of the plurality of nodes on the network. The computing device can further access one or more event IDs associated with one or more events occurring on the plurality of nodes. The computing device can further create an association the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information.

First claim

What is claimed is:

1. A method for determining a correlation of one or more events occurring in a plurality of nodes of a network, comprising:
accessing, by a computing device, address information associated with each of the plurality of nodes on the network;
accessing, by the computing device, one or more event IDs associated with one or more events occurring on the plurality of nodes;
creating an association, by the computing device, between the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information;
computing a topology homogeneity score on the one or more event IDs, based on a topological relationship between the plurality of nodes;
identifying rules of a node of the plurality of nodes to be transferrable to another node of the plurality of nodes based on the topology homogeneity score; and
reducing a number of false positives in an alert based on the rules.

2. The method of claim 1 , wherein the network is a telecommunications network.

3. The method of claim 2 , wherein the events are artificial intelligence operation events.

4. The method of claim 1 , further comprising training the computing device with training data to establish a correlation between the events and the plurality of nodes as well as the topological relationship between the nodes.

5. The method of claim 4 , further comprising calculating a probability distribution of the correlation between the events and the plurality of nodes between each of the topological relationships.

6. The method of claim 4 , further comprising determining an entropy of the probability distribution and flagging the correlations that have an entropy above a predetermined threshold as being spurious.

7. The method of claim 1 , further comprising capturing the topological relationship between the plurality of nodes.

8. The method of claim 7 , wherein the topological relationship includes one of border gateway protocol peers, open shortest path first neighbors, virtual private network tunnel, or shared virtual extensible local area network.

9. The method of claim 7 , further comprising calculating a log likelihood score of the correlation between the events and the plurality of nodes between each of the topological relationships.

10. The method of claim 9 , further comprising flagging the correlations that have the log likelihood score below a predetermined threshold as being spurious.

11. A method for determining a correlation of one or more events, in a telecommunication artificial intelligence operation, occurring in a plurality of network nodes of a network, comprising:
accessing, by a computing device, address information associated with each of the plurality of nodes on the network;
accessing, by the computing device, one or more event IDs associated with one or more events occurring on the plurality of nodes;
creating an association, by the computing device, between the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information;
capturing a topological relationship between the plurality of nodes;
calculating a log likelihood score of the correlation between the events and the plurality of nodes between each of the topological relationships;
identifying rules of a node of the plurality of nodes to be transferrable to another node of the plurality of nodes based on the association including the address information; and
reducing a number of false positives based on the rules.

12. The method of claim 11 , further comprising flagging the correlations that have the log likelihood score below a predetermined minimum as being spurious.

13. The method of claim 11 , further comprising training the computing device with training data to establish a correlation between the events and the plurality of nodes as well as a topological relationship between the nodes.

14. The method of claim 13 , further comprising calculating a probability distribution of the correlation between the events and the plurality of nodes between each of the topological relationships.

15. The method of claim 13 , further comprising determining an entropy of the probability distribution and flagging the correlations that have an entropy above a predetermined threshold as being spurious.

16. A non-transitory computer readable storage medium tangibly embodying a computer readable program code having computer readable instructions that, when executed, causes a computer device to carry out a method for determining a correlation of one or more events occurring in a plurality of network nodes of a network, the method comprising:
accessing, by a computing device, address information associated with each of the plurality of nodes on the network;
accessing, by the computing device, one or more event IDs associated with one or more events occurring on the plurality of nodes;
creating an association, by the computing device, the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information;
computing a topology homogeneity score on the event IDs, based on a topological relationship between the plurality of nodes;
identifying rules of a node of the plurality of nodes to be transferrable to another node of the plurality of nodes based on the topology homogeneity score; and
reducing a number of false positives based on the rules.

17. The non-transitory computer readable storage medium of claim 16 , the method further comprising:
capturing the topological relationship between the plurality of nodes; and
calculating a log likelihood score of the correlation between the events and the plurality of nodes between each of the topological relationships.

18. The non-transitory computer readable storage medium of claim 17 , the method further comprising flagging the correlations that have the log likelihood score below a predetermined minimum as being spurious.

19. The non-transitory computer readable storage medium of claim 18 , the method further comprising:
training the computing device with training data to establish a correlation between the events and the plurality of nodes as well as a topological relationship between the nodes; and
calculating a probability distribution of the correlation between the events and the plurality of nodes between each of the topological relationships.

20. The non-transitory computer readable storage medium of claim 19 , the method further comprising:
determining an entropy of the probability distribution and flagging the correlations that have an entropy above a predetermined threshold as being spurious.

Assignees

• IBM

Inventors

• Srivatsa Mudhakar
• Settle Jonathan Ian
• Sadagopan Satishkumar
• Thomas Mathews
• Mangla Utpal

Classifications

• H04L41/0627

  by acting on the notification or alarm source · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L41/0631 Primary

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title