Constructing a bayesian network based on received events associated with network entities

Records of events associated with network entities in a network environment are received, where the network entities are selected from hardware entities, software entities, and combinations of hardware and software entities. The records of the events are identified to identify relationships between events associated with different ones of the network entities, where the records of the events identify corresponding network entities impacted by the events. A Bayesian network is constructed based on the analyzing, wherein the constructed Bayesian network is able to make predictions regarding relationships between events associated with the network elements.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a national stage application under 35 U.S.C. §371 of PCT/US2009/052222, filed 30 Jul. 2009.

BACKGROUND

In a network environment where there are a relatively large number of network entities that can span multiple geographic regions, it may be difficult to quickly identify the impact of an outage or defect at one or more network entities on other parts of the network.

Some network environments may maintain knowledge databases (sometimes referred to as configuration management databases) regarding the configuration of the network. In response to detected outages, an administrator can consult the knowledge database to attempt to determine what impact the outage of defect would have on other parts of the network. For a large network environment, manually consulting this knowledge database to perform the diagnosis can be a time-consuming and tedious task, which may ultimately produce inaccurate results.

Moreover, a knowledge database can become obsolete relatively quickly. Thus, even if an automated process is provided to consult such a knowledge database to diagnose impacts of outages or defects at network entities, such automated processes may nevertheless produce inaccurate results if the knowledge database is not updated.

DETAILED DESCRIPTION

In accordance with some embodiments, an automated learning system is provided to determine cause and effect relationships between events occurring in a network environment that includes network entities. Some network environments can include a relatively large number of network entities (which can be hardware entities, software entities, and/or combinations of hardware and software entities). For example, network entities can include computers, switches, routers, storage servers, and so forth. Software entities can include software applications, web software, scripts, and so forth.

The automated learning system receives records of events associated with network entities in the network environment. In some embodiments, the events represented by the records are fault events that indicate something wrong has occurred at corresponding network entities. For example, the network entity may have crashed or may have produced an error that caused inaccurate outputs to be produced. In other embodiments, the events can represent other occurrences associated with the network entities. More generally, an “event” refers to an occurrence of some phenomenon, act, operation, alarm, and so forth, at or in connection with a network entity.

The records of the events are analyzed to identify relationships between events associated with different ones of the network entities. Each of the records of the events identifies a corresponding network entity impacted by the event. The order in which the events are received is significant. The event ordering can occur temporally (events received in time) or the event ordering can occur spatially (events received over a given space). In the former case, the events will indicate a causal (cause-and-effect) relationship, such as event A has a high likelihood of preceding event B. In the latter case, the events will indicate a spatial relationship, such as event A has a high likelihood of being near event B. The automated learning system constructs a Bayesian network based on the analyzing.

The constructed Bayesian network is able to make predictions regarding relationships (e.g., causal relationships, spatial relationships, etc.) between events connected with the network elements. For example, the Bayesian network can predict events associated with some of the network entities based on detecting events at others of the network entities. As another example, the Bayesian network can diagnose a source of a problem based on detected events at one or more network entities. In addition, based on analyzing the events, the Bayesian network can be used to output a representation of the infrastructure of the network environment. This can assist administrators in maintaining updated system interconnections as changes are continually made in the network environment, which can be a tedious and time-consuming task.

A Bayesian network is a probabilistic structured representation of a domain to allow existing knowledge to be captured about the domain. The Bayesian network is able to learn the stochastic properties of the domain (on a continual and real-time basis, for example) to update a model of the domain over time. A Bayesian network has a directed acyclic graph structure, where the directed acyclic graph has nodes that represent variables from the domain, and arcs between the nodes represent dependencies between the variables. The arcs of the Bayesian network also are associated with conditional probability distributions over the variables, where the conditional probability distributions encode the probability that variables assume different values given values of parent variables in the graph. More generally, a Bayesian network is a graphical model for representing conditional dependencies between, random variables of a domain. In accordance with some embodiments, the domain is a network environment having network entities that are associated with events, such as fault events.

In the context of representing a network environment having interconnected network entities, the nodes of the Bayesian network represent corresponding network entities, and the arcs between the nodes are associated with conditional probability distributions that represent likelihoods of events associated with some of the network entities being related to events associated with others of the network entities.

FIG. 1illustrates an exemplary arrangement in which some embodiments of the invention can be incorporated. InFIG. 1, a network environment102includes various network entities104, and possibly one or more monitoring agents106. The monitoring agents106can be part of the network entities104or separate from the network entities104. The monitoring agents106are used for monitoring operations of the network entities104. Thus, any outages or defects at the network entities104can be detected by the monitoring agents106. Note that the network entities104can be software entities, hardware entities, or combinations of software and hardware entities. The monitoring agents106are able to create records of the events detected by the monitoring agents.

FIG. 1also shows a call center108. The call center108can receive calls from users of the network environment102regarding any errors that are experienced by the users. Call agents at the call center108can then create records regarding the calls received about events that have occurred in the network environment102.

The records generated at the call center108and/or the monitoring agents106can be sent to an analysis computer100over a network110. A “record” regarding an event refers to any representation of the event. The record can have a predefined format, be in a predefined language, or can have any other predefined structure. The record associated with a particular event identifies the network entity, such as by using a configuration identifier or some other type of identifier. In some embodiments, the records can also identify different types of events that may have occurred. For example, the records may identify different types of fault events (such as fault events that caused a network entity crash (outage), fault events that produced data error, software fault events, hardware fault events, fault events associated with defects, and so forth).

The records of the events are stored as events112in a storage media114in the computer100. The storage media114can be implemented with one or more disk-based storage devices and/or integrated circuit or semi-conductor memory devices. The computer100includes analysis software114that is able to analyze the events112received from the call center108and/or monitoring agents106.

The analysis software114is executable on one or more processors116, which is (are) connected through a network interface118to the network110to allow the computer100to communicate over the network110. Although shown as a single block, it is contemplated that the computer100can refer to either a single computer node or to multiple computer nodes.

The analysis software114implements the automated learning system referred to above for analyzing events associated with network entities in a network environment for constructing a Bayesian network120that identifies relationships between the events associated with different ones of the network entities104in the network environment102. The constructed Bayesian network120is stored in the storage media114. Note that although the Bayesian network120and analysis software114are shown as being two separate elements, it is noted that the Bayesian network120is part of the analysis software114to allow for the capture of knowledge about the network environment based on the records112of the events. The Bayesian network120can continually update its model of the network environment based on continued receipt of records112of the events over time.

The analysis software114is able to construct inferences based on the frequency of event types and to automate the entire process from start to end. In some embodiments, the analysis software114looks at the propagation of fault events through the network environment102(as reported by the event records112). The relationships can be inferred from the frequency and occurrence of the events as detected by the call center108and/or by the monitoring agents106. As noted above, the event records contain identifiers of corresponding network entities.

In addition, to assist in constructing the Bayesian network120, an ontology122is also created and stored in the storage media114. The ontology is a structured, machine-readable data model. The ontology122models the concepts of the domain being analyzed, in this case the network environment102. The ontology122captures concepts of the domain (and relationships between the concepts) to provide a shared common understanding of the domain. The ontology122serves as a repository of knowledge about the network environment102to enable the construction of the Bayesian network120.

In some implementations, the ontology122provides a System class with a Components subclass that contains a simple diagnostic parameter that can take on one of the following three values: available, degraded and unavailable. Each network entity can be associated with the foregoing ontology model. Depending upon the state of operation of the network entity, the network entity will have be associated with the diagnostic parameter that is assigned one of the foregoing three values. The value available indicates that the network entity is operating normally. The value degraded indicates that the network entity has degraded performance. The value unavailable indicates that the network entity is down or otherwise not available. Although a specific exemplary ontology is provided above, note that alternative implementations can employ other exemplary ontologies.

The records that are incoming can include unstructured text, which may make conforming to the given ontology relatively difficult. However, if the records are defined to have specific tags that are consistent with the ontology, then an automated process can provided to extract information from the records according to the ontology.

In the process of learning the Bayesian network, analysis is performed of the frequency of the incoming events, categorized by event type, over a period of time. Based on the analyzed event records, the Bayesian network120is able to determine the likelihood that different events are related and also determine the type of relationship (e.g., whether it is a cause or an effect relationship). As noted above, there is an order associated with the incoming events, where the order can be a temporal order or a spatial order. A temporal ordering of the events allows for a causal relationship to be derived using the Bayesian network120. However, a spatial ordering of the events allows for the Bayesian network120to learn a spatial relationship among events. In some embodiments, both temporal and spatial ordering of the events are considered in learning the Bayesian network120.

Once the Bayesian network120is trained (learned), the Bayesian network can be used to make predictions. For example, the Bayesian network can predict if an event at network entity A will impact network entity B, or that failure at network entity D is likely caused by a failure at network entity C.

FIG. 2is a flow diagram of building and using a Bayesian network, in accordance with an embodiment. The process ofFIG. 2can be performed by the analysis software114and Bayesian network120ofFIG. 2.

A stream of records of events is received (at202). The events in some embodiments are fault events for indicating faults in the network environment102(FIG. 1). As noted above, the records can be received from monitoring agents106and/or the call center108.

The information contained in the records of the fault events are analyzed (at204). The analysis involves looking at the propagation of faults along network entities in the network environment102. Also, frequencies of fault events categorized by event type (e.g., different types of faults) are also analyzed. Since there is a correspondence between events and network entities (as identified by configuration identifiers in the records), a relationship between events implies an underlying relationship between network entities that the events refer to. Analyzing the frequencies of events categorized by event types allow the Bayesian network120to learn conditional probability distributions between fault events associated with the network entities. For example, if occurrences of fault events of a particular type at network entity A correlates frequently with fault events at network entities C and F, then the Bayesian will reflect this relationship in the arcs connecting nodes corresponding to network entities A, C, and F.

Based on the analysis of task204, the Bayesian network120is updated (at206). The updated Bayesian network120is then used (at208) to make predictions. For example, the predictions can be as follows: if a fault event occurs at network entity A, how will that impact network entity B; if a fault event occurred at network entity D, how likely is it that this fault event was caused by a failure at network entity C.

It is noted that the outputs of the Bayesian network120can also be used to discover the network infrastructure of the network environment102. Propagation of fault events along a particular path will reveal relationships among the network entities along that path. Since the records of events contain identifiers of the network entities, this information can be leveraged to build up a representation of the network infrastructure.

The process ofFIG. 2can be recursively repeated to continually update the Bayesian network120as conditions change or as the infrastructure of the network environment102changes (e.g., network entities added, network entities removed, or network entities upgraded). In this manner, it is ensured that the model of the network environment102used is an updated representation that does not become obsolete quickly.

FIG. 3is a flow diagram of a process according to a further embodiment. An ontology of the domain to be modeled is provided (at302), where the domain in this case is the network environment102. In some implementations, the ontology122provides a System class with a Components subclass that contains a simple diagnostic parameter that can take on one of the following three values: available, degraded and unavailable, as discussed above.

The received records of the events are mapped (at304) to the ontology. This is to allow meaningful information that are relevant to learning the Bayesian network to be extracted. In cases where the received records contain unstructured data, pre-processing can be applied to perform the mapping. Alternatively, tag fields can be provided in the records that contain information relevant to the ontology.

Next, the mapped records are provided (at306) to the analysis software114and Bayesian network120to continue to learn the Bayesian network120.

By employing techniques according to some embodiments, a relatively convenient and automated way of predicting cause and effect relationships (or spatial relationships) among fault events (or other types of events) associated with corresponding network entities of a network environment is achieved. Administrators can be quickly informed of faults such that solutions can be developed, or temporary workaround plans can be developed.

Instructions of software described above (including the analysis software114and Bayesian network120ofFIG. 1) are loaded for execution on a processor (such as processor(s)116inFIG. 1). A processor includes microprocessors, microcontrollers, processor modules or subsystems (including one or more microprocessors or microcontrollers), or other control or computing devices.