Dynamically computing fate sharing in computer networks using learning machines

Patent metadata

Field	Value
Publication number	US-9432248-B2
Application number	US-201414163488-A
Country	US
Kind code	B2
Filing date	Jan 24, 2014
Priority date	Dec 31, 2013
Publication date	Aug 30, 2016
Grant date	Aug 30, 2016

Abstract

In one embodiment, a device (e.g., learning machine) determines a plurality of fate-sharing group (FSG) nodes in a computer network that are prone to simultaneously send an alarm upon detecting an event. As such, the device may elect one or more FSG owner nodes as a subset of the FSG nodes, and instructs the FSG group such that only FSG owner nodes send an alarm upon event detection.

First claim

What is claimed is:

1. A method, comprising:
determining, by a network device executing a learning machine process, a plurality of fate-sharing group (FSG) nodes in a computer network that are prone to simultaneously send an alarm upon detecting an event, wherein the learning machine process intercepts and stores alarms overtime to identify which particular FSG a particular node in the computer network belongs;
electing, by the network device, one or more FSG owner nodes as a subset of the FSG nodes; and
instructing, by the network device, the FSG group such that only FSG owner nodes send an alarm upon event detection.

2. The method as in claim 1 , further comprising:
receiving an alarm;
determining a corresponding FSG; and
reporting the alarm for the FSG.

3. The method as in claim 1 , wherein determining the plurality of FSG nodes comprises:
monitoring the alarms in the computer network;
detecting clusters of alarms in time from a set of nodes; and
associating the set of nodes as members of a corresponding FSG.

4. The method as in claim 3 , further comprising:
updating the clusters based on new alarms.

5. The method as in claim 4 , wherein the updating is performed under an assumption that the alarms are not received from all nodes that send an alarm for each event.

6. The method as in claim 3 , wherein detecting and associating comprise:
using a co-occurrence graph, wherein vertices of the graph are nodes of the network, and edges of the graph denote a clustered relationship between nodes; and
detecting communities of nodes within the graph as the set of nodes of a corresponding FSG.

7. The method as in claim 1 , further comprising:
generating test alarm events.

8. The method as in claim 1 , wherein an event is selected from a group consisting of: a link failure, a node failure, a denial of service (DoS) attack, a power outage, an application-driven event; and an unidentifiable event.

9. The method as in claim 1 , wherein electing is based on a path reliability of sent alarms.

10. The method as in claim 1 , wherein electing is based on overlap of sent alarms based on a network topology.

11. The method as in claim 1 , further comprising:
instructing FSG owner nodes to use an explicit path for alarms sent by the FSG owner nodes.

12. The method as in claim 1 , further comprising:
adjusting a number of FSG owner nodes based on a number of alarms received from the elected FSG owner nodes.

13. An apparatus, comprising:
one or more network interfaces that communicate with a computer network;
a processor coupled to the one or more network interfaces and configured to execute a process, wherein at least one of the processes is a learning machine process; and
a memory configured to store the learning machine process executable by the processor, the learning machine process when executed operable to:
determine a plurality of fate-sharing group (FSG) nodes in the computer network that are prone to simultaneously send an alarm upon detecting an event, wherein the learning machine process intercepts and stores alarms overtime to identify which particular FSG a particular node in the computer network belongs;
elect one or more FSG owner nodes as a subset of the FSG nodes; and
instruct the FSG group such that only FSG owner nodes send an alarm upon event detection.

14. The apparatus as in claim 13 , wherein the process when executed is further operable to:
receive an alarm;
determine a corresponding FSG; and
report the alarm for the FSG.

15. The apparatus as in claim 13 , wherein the process when executed to determine the plurality of FSG nodes is further operable to:
monitor the alarms in the computer network;
detect clusters of alarms in time from a set of nodes; and
associate the set of nodes as members of a corresponding FSG.

16. The apparatus as in claim 13 , wherein the process when executed is further operable to:
update the clusters based on new alarms.

17. The apparatus as in claim 16 , wherein the updating is performed under an assumption that the alarms are not received from all nodes that send an alarm for each event.

18. The apparatus as in claim 13 , wherein the process when executed to detect and associate is further operable to:
use a co-occurrence graph, wherein vertices of the graph are nodes of the network, and edges of the graph denote a clustered relationship between nodes; and
detect communities of nodes within the graph as the set of nodes of a corresponding FSG.

19. The apparatus as in claim 13 , wherein the process when executed is further operable to:
generate test alarm events.

20. The apparatus as in claim 13 , wherein an event is selected from a group consisting of: a link failure, a node failure, a denial of service (DoS) attack, a power outage, an application-driven event; and an unidentifiable event.

21. The apparatus as in claim 13 , wherein electing is based on one or both of a path reliability of sent alarms and overlap of sent alarms based on a network topology.

22. The apparatus as in claim 13 , wherein the process when executed is further operable to:
instruct FSG owner nodes to use an explicit path for alarms sent from the FSG owner nodes.

23. The apparatus as in claim 13 , wherein the process when executed is further operable to:
adjust a number of FSG owner nodes based on a number of alarms received from the elected FSG owner nodes.

24. A tangible, non-transitory, computer-readable media having software encoded thereon, the software a learning machine process, when executed by a processor, operable to:
determine a plurality of fate-sharing group (FSG) nodes in a computer network that are prone to simultaneously send an alarm upon detecting an event, wherein the learning machine process intercepts and stores alarms overtime to identify which particular FSG a particular node in the computer network belongs;
elect one or more FSG owner nodes as a subset of the FSG nodes; and
instruct the FSG group such that only FSG owner nodes send an alarm upon event detection.

25. The computer-readable media as in claim 24 , wherein the software when executed is further operable to:
receive an alarm;
determine a corresponding FSG; and
report the alarm for the FSG.

Assignees

• Cisco Tech Inc

Inventors

• Vasseur Jean-Philippe
• Mermoud Grégory
• Dasgupta Sukrit
• Hui Jonathan W

Classifications

• Y02B60/33

  Cross-Sectional Technologies · mapped topic

• H04L41/0604

  using filtering, e.g. reduction of information by using priority, element types, position or time · CPC title

• H04L41/0618 Primary

  based on the physical or logical position · CPC title

• H04L41/0613

  based on the type or category of the network elements · CPC title

• H04L41/06

  Management of faults, events, alarms or notifications · CPC title