METHOD FOR MANAGING A PLURALITY OF EVENTS

Abstract

The invention provides a method for managing a plurality of events, wherein each event comprises physical attributes and logical attributes by creating tuples with the events with the same logical attributes, providing a set of hierarchized relations between tuples, by means of a pipeline algorithm, wherein parent-child relations are provided between tuples, classifying the tuples in families, each family contains all the tuples related according to the parent-child relation provided by the pipeline algorithm, identify the parent tuple of each family, defined as the tuple which has at least one children and has no parent and present the parent tuples, together with the physical attributes of the events associated to each parent tuple.

Claims

1. A method for managing a plurality of events, wherein each event comprises physical attributes and logical attributes, the method comprising the steps of creating tuples, wherein each tuple comprises all the events with the same logical attributes; providing a set of hierarchized relations between tuples, by means of a pipeline algorithm, wherein parent-child relations are provided between tuples; classifying the tuples in families, each family contains all the tuples related according to the parent-child relation provided by the pipeline algorithm; identifying the parent tuple of each family, defined as the tuple which has at least one child and has no parent, and presenting the parent tuples, together with the physical attributes of the events associated to each parent tuple.

2. The method according to claim 1, wherein the step of providing the set of hierarchized relations is carried out by an unsupervised machine learning algorithm comprising the steps of creating a co-occurrence matrix, wherein each column corresponds with a tuple and each row corresponds with a time window, so each matrix entry represents the number of times that each tuple appears in each time window; successively applying a heuristic function to each matrix entry to obtain a co-occurrence probabilistic score for each pair of tuples creating a first attempt of parent-child relations; and using the probabilistic score of each pair of tuples to quantify the strength of the first attempt of parent-child relations.

3. The method according to claim 2, wherein the unsupervised machine learning algorithm further comprises the steps of firstly, dividing the data into two samples so that the steps of creating the co-ocurrence matrix, apply the heuristic function and create a first attempt of parent-child relations are carried out for each of the two samples; after these steps, identifying the parent-child relations of the first attempt which are identical in the two samples; and use the parent-child relations which are identical in the two samples to provide the final set of parent-child relations between tuples, which are used in the remainder steps of the method.

4. The method according to claim 3, wherein, prior to the step of dividing the data into two samples, the method comprises the step of cleaning the tuples, by deleting those tuples which do not fulfil a plurality of minimum requirements.

5. The method according to claim 3, wherein the step of creating a first attempt of parent-child relations comprises creating a graph of parent-child relations based on the results of the heuristic function calculating a probability for each parent-child relation and mark those parent-child relations which has a probability higher than a predetermined threshold as strong.

6. The method according to claim 4, wherein the step of creating a first attempt of parent-child relations comprises creating a graph of parent-child relations based on the results of the heuristic function calculating a probability for each parent-child relation and mark those parent-child relations which has a probability higher than a predetermined threshold as strong.

7. The method according to claim 3, wherein the step of creating the co-occurrence matrix comprises creating a plurality of co-occurrence matrixes for each sample, wherein each co-occurrence matrix is created for a different time interval.

8. The method according to claim 4, wherein the step of creating the co-occurrence matrix comprises creating a plurality of co-occurrence matrixes for each sample, wherein each co-occurrence matrix is created for a different time interval.

9. The method according to claim 5, wherein the step of creating the co-occurrence matrix comprises creating a plurality of co-occurrence matrixes for each sample, wherein each co-occurrence matrix is created for a different time interval.

10. The method according to claim 6, wherein the step of creating the co-occurrence matrix comprises creating a plurality of co-occurrence matrixes for each sample, wherein each co-occurrence matrix is created for a different time interval.

11. The method according to claim 7, further comprising the step of choosing an optimal co-occurrence matrix and use the parent-child relations generated by the optimal co-occurrence matrix to provide the final set of parent-child relations between tuples.

12. The method according to claim 8, further comprising the step of choosing an optimal co-occurrence matrix and use the parent-child relations generated by the optimal co-occurrence matrix to provide the final set of parent-child relations between tuples.

13. The method according to claim 9, further comprising the step of choosing an optimal co-occurrence matrix and use the parent-child relations generated by the optimal co-occurrence matrix to provide the final set of parent-child relations between tuples.

14. The method according to claim 10, further comprising the step of choosing an optimal co-occurrence matrix and use the parent-child relations generated by the optimal co-occurrence matrix to provide the final set of parent-child relations between tuples.

15. The method according to claim 1, wherein the step of presenting the parent tuples comprises presenting the instances associated to each parent tuple.

16. The method according to claim 2, wherein the step of presenting the parent tuples comprises presenting the instances associated to each parent tuple.

17. The method according to claim 3, wherein the step of presenting the parent tuples comprises presenting the instances associated to each parent tuple.

18. The method according to claim 4, wherein the step of presenting the parent tuples comprises presenting the instances associated to each parent tuple.

19. The method according to claim 1, wherein the step of presenting the parent tuples comprises conferring a severity index to each parent tuple of each family, so that the final list of parent tuples is hierarchized.

20. The method according to claim 2, wherein the step of presenting the parent tuples comprises conferring a severity index to each parent tuple of each family, so that the final list of parent tuples is hierarchized.

21. The method according to claim 3, wherein the step of presenting the parent tuples comprises conferring a severity index to each parent tuple of each family, so that the final list of parent tuples is hierarchized.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0057] To complete the description and in order to provide for a better understanding of the invention, a set of drawings is provided. Said drawings form an integral part of the description and illustrate an embodiment of the invention, which should not be interpreted as restricting the scope of the invention, but just as an example of how the invention can be carried out. The drawings comprise the following figures:

[0058] FIG. 1 shows a first step of a method according to the invention, which is the creation of tuples.

[0059] FIG. 2 shows further steps of this method, which includes the creation of a plurality of co-occurrence matrixes.

[0060] FIG. 3 shows a graph of a first attempt of parent-child relations as a result of some steps of a method according to the invention.

[0061] FIG. 4 is an example of a tuples family obtained by a method according to the invention.

DETAILED DESCRIPTION OF THE INVENTION

[0062] The example embodiments are described in sufficient detail to enable those of ordinary skill in the art to embody and implement the systems and processes herein described. It is important to understand that embodiments can be provided in many alternate forms and should not be construed as limited to the examples set forth herein.

[0063] Accordingly, while embodiment can be modified in various ways and take on various alternative forms, specific embodiments thereof are shown in the drawings and described in detail below as examples. There is no intent to limit to the particular forms disclosed. On the contrary, all modifications, equivalents, and alternatives falling within the scope of the appended claims should be included. Elements of the example embodiments are consistently denoted by the same reference numerals throughout the drawings and detailed description where appropriate.

[0064] The invention provides a method for managing a plurality of events, wherein each event comprises physical attributes and logical attributes. This method comprises several steps.

[0065] FIG. 1 shows a first step of a method according to the invention, which is the creation of tuples.

[0066] From the original event dataset, and based on the logical attributes of each event 1, tuples 2 are defined, in such a way that each tuple 2 comprises all the events 1 with the same logical attributes.

[0067] Hence, the original event dataset 10 has been converted into a tuples dataset 20. Each tuple is identified by a tupleID.

[0068] Afterwards, the tuples dataset 20 is cleaned, obtaining a clean tuples dataset 20′ by deleting those tuples which do not fulfil a plurality of minimum requirements. These requirements may be related to sparsity, redundancy, null events or any other requirement imposed by the user.

[0069] The clean tuples dataset 20′ is then divided into two stable data samples 21, 22. These two stable data samples have substantially the same number of tuples.

[0070] FIG. 2 shows further steps of this method. For each data sample, a plurality of co-occurrence matrixes are created.

[0071] For each co-occurrence matrix, time is divided into different time intervals. Hence, one co-occurrence matrix is, for example, created with time intervals of 1 second, then another co-occurrence matrix is created with time intervals of 2 seconds, and so on. For each co-occurrence matrix, each column correspond with a tuple and each row corresponds with a time window, so each matrix entry represents the number of times that each tuple appears in each time window.

[0072] For each stable sample, there is a plurality of co-occurrence matrixes, each one reflecting the time succession of the different tuples when time is divided according to different time intervals.

[0073] For the first stable sample, there will be, for example, 20 different co-occurrence matrixes, and there will be another 20 different co-occurrence matrixes for the second stable example.

[0074] For each of the co-occurrence matrixes of each of the stable samples, a heuristic function is applied to obtain a co-occurrence probabilistic score of each pair of tuples. This probabilistic score reflects the probability that one tuple of the pair occurs after the other tuple of the pair.

[0075] FIG. 3 shows a first attempt of parent-child relations as a result of this heuristic function, where pairs of tuples with a probabilistic score higher than 0.4 are shown according to their preliminary parent-child relation.

[0076] There will be one graph like the one of this figure for each one of the co-occurrence matrixes and for each one of the two samples.

[0077] Provided these results, an optimal co-occurrence matrix is chosen for each sample. The optimal co-occurrence matrix is that which provides parent-child relation with the better probabilistic scores. The parent-child relations provided by the optimal co-occurrence matrix are used to provide a set of hierarchized relations between tuples. The time interval of this optimal co-occurrence matrix is called optimal time window. For example, it may be that the co-occurrence matrix which was created using time intervals of 6 second is the optimal co-occurrence matrix, since it gives place to optimal parent-child relations. In this case, the optimal time window would be 6 seconds.

[0078] Hence, each stable sample gives place to a set of hierarchized relations between tuples. Each group of tuples related by the parent-child relations is called a tuples family. Hence, each stable sample gives place to a set of tuples families.

[0079] Then, the common parent-child relations which are identical in the two samples are identified and used to provide the final set of tuples families.

[0080] Once the final set of tuples families is achieved, the following steps of the method are carried out [0081] identify the parent tuple of each family, defined as the tuple which has at least one children and has no parent, and [0082] present the parent tuples, together with the physical attributes of the events associated to each parent tuple.

[0083] FIG. 4 is an example of a tuples family, wherein five tuples are hierarchically organized according to the parent-child relations obtained in the previous steps.

[0084] Tuples connected hierarchically within a family share a relationship provided by the pipeline algorithm. The parent tuple in each of the families is called “root issue” and is presented at the end of the method as the most important events to deal with.

[0085] This significantly reduces the amount of crucial events, and provides the NOC with a set of events which is far easier to handle than the original dataset.

[0086] In some particular embodiments, the step of presenting the parent tuples comprises presenting the instances associated to each parent tuple.

[0087] Whether an instance is associated with an issue is analyzed in validation phase where we map how many families are associated with issues etc.

[0088] In some particular embodiments, the step of presenting the parent tuples comprises conferring a severity index to each parent tuple of each family, so that the final list of parent tuples is hierarchized.

[0089] The severity index is related, among others, with the number of tuples of the family. This severity classification can be done if a severity index is available in the original dataset of events.