International Business Machines Corporation

Marc Dacier

Klaus Julisch

Paolo Scotton

A method and system is designed for processing alarms, that have been triggered by a monitoring system such as an intrusion detection system, a firewall, or a network management system, comprising the steps of entering the triggered alarms into an alarm log, evaluating similarity between alarms, grouping similar alarms into alarm clusters, summarizing alarm clusters by means of generalized alarms, counting the covered alarms for each generalized alarm and forwarding generalized alarms for further processing if the number of alarms covered satisfies a predetermined criterion. In the event of high rates of alarm messages, possibly containing many false alarms, a system administrator will therefore not be confronted with a flood of messages with little significance. Instead, only generalized alarms, more meaningful and smaller in number, are presented. The method can further comprise copying the alarm log to a cluster log and for each generalized alarm in the cluster log counting the number of covered alarms that are identical to the generalized alarm or more specific than the generalized alarm, and, if the number of covered alarms exceeds a predetermined minimum number, then terminating the loop. A heuristic is used to select an attribute of the alarms of the cluster log and for each alarm thereof the selected attribute is replaced by a more general attribute. A taxonomy on the attributes can be used to define the similarity between the alarms. The forwarded generalized alarm can furthermore be investigated in order to identify a root cause.

Method, computer program element and a system for processing alarms triggered by a monitoring system

A method and system is designed for processing alarms, that have been triggered by a monitoring system such as an intrusion detection system, a firewall, or a network management system, comprising the steps of entering the triggered alarms into an alarm log, evaluating similarity between alarms, grouping similar alarms into alarm clusters, summarizing alarm clusters by means of generalized alarms, counting the covered alarms for each generalized alarm and forwarding generalized alarms for further processing if the number of alarms covered satisfies a predetermined criterion.

In an ATM network operating in accordance with PNNI standards, the operation of a switch is divided into two phases, a learning mode phase and an active mode phase. During learning mode phase, each time a reachability is received from a sending switch, the reachability is recorded in the database of the receiving switch and the received reachability is sent to other switches in the same peer group. At the end of the learning mode phase, the database of each of the switches contains the reachabilities advertised by all the switches of the peer group during the learning mode group phase. On a termination of the learning mode, the switches enter the active mode phase. During the active mode, each time a reachability is received from a sending switch, the receiving switch checks to see if the reachability has been advertised in the past by that sending switch. If it has, the reachability is considered to be valid and the receiving switch waits for the next reachability. On the other hand, if the particular reachability has never been announced before the sending node, it is compared to the reachability in the database for all other nodes of the peer group. If the reachability causes the reachability from other node to be overlapped and the overlapping is suspicious, then an alarm is raised.

Growing community of inventors

Mouans Sartoux, France

Marc Dacier