Real-time telecommunication network management: extending event correlation with temporal constraints

Abstract

Event correlation is becoming one of the most central techniques in managing the high volume of event messages. Practically, no network management system can ignore network surveillance and control procedures which are based on event correlation. The majority of existing network management systems use relatively simple ad hoc additions to their software to perform alarm correlation. In these systems, alarm correlation is handled as an aggregation procedure over sets of alarms exhibiting similar attributes. In recent years, several more sophisticated alarm correlation models have been proposed. In this paper, we will expand our knowledge-based event correlation model to capture temporal constraints.

Chasing a Definition of “Alarm”

“…The focus of alarm correlation is to interpret alarm notifications and give (new) meaning to them [45]. Alarm correlation research efforts address several underlying problems: correlation of notifications relating to the same underlying fault, repeated alarm notifications, the same fault as identified by several components, and fault propagation [46].…”

A framework for service quality assurance using event correlation techniques

“…Therefore, real-world systems like the GTE Impact system [12,13] are often designed as a hybrid model-based/rule-based (see below) system.…”

Correlation DialTone-Building Internet—Based Distributed Event Correlation Services

“…The event correlation process is defined as a conceptual interpretation procedure that assigns new meaning to a set of events [9]. It may range in complexity from simple event compression to complex pattern matching across asynchronous events.…”

“…We will follow the event correlation model described in [9], where event correlation is broadly defined as a conceptual interpretation procedure of assigning a new meaning to a set of events that happen within a predefined time interval. This conceptual interpretation procedure could stretch from a trivial task of event compression to a complex dynamic pattern-matching task.…”

“…The raw events are external events originated outside the correlation process, while the derived events are results of a correlation process. Depending on the nature of the operations performed on events, different types of event correlation could be defined, including event compression, filtering, suppression, generalization, specialization, temporal relations, and event clustering [9]. Each event correlation process has an assigned correlation time window, a maximum time interval during which the component events should happen.…”