Network event management

Patent metadata

Field	Value
Publication number	US-9239988-B2
Application number	US-201414478224-A
Country	US
Kind code	B2
Filing date	Sep 5, 2014
Priority date	Feb 24, 2011
Publication date	Jan 19, 2016
Grant date	Jan 19, 2016

Abstract

An apparatus for predicting a network event flood comprises an event rate detector for detecting rates of event emissions from one or more devices; an aggregator for producing an aggregate rate and an aggregate rate trend of the rates of event emissions from a plurality of the devices; a level generator for generating a plurality of levels comprising maximum acceptable event rate values of a plurality of the aggregate rate trends over plural time periods; a storage component for storing the plurality of levels; a comparator for comparing a current aggregate rate trend with at least a selected one of the levels; and a signaller for signalling a predicted event flood responsive to the comparator detecting that the current aggregate rate trend will exceed the at least a selected one of the levels at a first point in time.

First claim

What is claimed is:

1. A method for predicting a network event flood, the method comprising the steps of:
detecting, by an event rate detector, rates of event emissions from one or more devices, wherein each rate of emissions is stored per device with an associated time stamp;
producing, by an aggregator, an aggregate rate and an aggregate rate trend of said rates of event emissions from a plurality of said devices;
generating, by a level generator, a plurality of levels comprising maximum acceptable event rate values of a plurality of said aggregate rate trends over plural time periods;
storing, by a storage component, said plurality of levels;
comparing, by a comparator, a current aggregate rate trend for at least one of the one or more devices with one or more of said levels, wherein the comparing is iterative to each one of the one or more of said levels;
detecting whether said current aggregate rate trend will exceed one of the one or more of said levels at a first point in time; and
signalling, by a signaller, a predicted event flood responsive to said comparator
detecting that said current aggregate rate trend will exceed one of the one or more of said levels at a first point in time.

2. The method according to claim 1 wherein said step of producing an aggregate rate comprises using an average for calculating an average event rate.

3. The method according to claim 1 wherein said step of producing an aggregate rate comprises using a statistical calculator for calculating a statistically-normalized aggregate rate or rate trend.

4. The method according to claim 3 wherein said statistically-normalized aggregate rate or rate trend defines a normalized trend.

5. The method according to claim 4 wherein said normalized trend is calculated by a least-squares method.

6. The method according to claim 1 wherein said plural time periods are defined according to one or more of: times of day; days of week; days of month; or days of year.

7. The method according to claim 1 , further comprising the step of: responsive to said signaller, ordering by an ordering component a list of identifiers of said devices in descending order from a device having at said first point in time a maximum rate of event emissions to a device having at said first point in time a minimum rate of event emissions.

8. The method according to claim 7 , further comprising the step of selecting said device from said list having at said first point in time a maximum rate of event emissions and identifying said device as a candidate device for placing in a flood protection mode.

9. The method according to claim 8 , wherein said flood protection mode causes a receiver to accept a reduced rate of event emissions from said device.

10. The method according to claim 9 , wherein said receiver comprises a network monitor.

11. The method according to claim 10 , wherein said network monitor comprises a probe.

12. The method according to claim 8 , further comprising placing, by a flood protection control component, said candidate device in said flood protection mode as a flood protected device.

13. The method according to claim 12 , further comprising the step of:
selecting a flood protected device having at a second point in time a minimum rate of event emissions and identifying said device as a candidate device for removal from said flood protection mode.

14. The method according to claim 1 , wherein said comparing a current aggregate rate trend with one or more of said levels further comprises applying a set of rules to select one of the one or more of said levels.

15. The method according to claim 8 , further comprising alerting a user said device is the candidate device for placing in a flood protection mode.

16. The method according to claim 1 , further comprising, responsive to detecting said current aggregate rate trend will exceed one of the one or more of said levels at a first point in time:
determining the at least one device corresponding to said current aggregate rate trend; and
placing, automatically, an event feed for the at least one device into a flood protection mode.

Assignees

• IBM

Inventors

• Dinger John
• Franklin David R
• Stewart Kristian J
• Lake John M

Classifications

• H04L41/147

  for predicting network behaviour · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L41/069 Primary

  using logs of notifications; Post-processing of notifications · CPC title

• H04L41/06

  Management of faults, events, alarms or notifications · CPC title

• G06N5/04 Primary

  Inference or reasoning models · CPC title