Self-learning correlation of network patterns for agile network operations

Various aspects of the subject technology relate to methods, systems, and machine-readable media for self-correlating network operations. The method includes receiving a stream of network messages, the stream of network messages comprising a variety of network events for various network devices. The method also includes identifying patterns within the stream of network messages, the patterns comprising groupings of the variety of network events. The method also includes determining for each pattern an appropriate operationalization scenario. The method also includes operationalizing the patterns as correlation rules in a correlation engine to automatically detect or predict network alarms from input provided by a fault management system.

CROSS REFERENCE TO RELATED APPLICATIONS

This application claims priority benefit to, EP patent application Ser. No. 19315056.2, filed Jul. 3, 2019, the disclosure thereof hereby incorporated by reference in its entirety for all purposes.

BACKGROUND

Communications Service Providers (CSPs) have been using expert systems embedded in surveillance systems for decades. These expert systems have an enormous amount of human experience and knowledge captured in them, over decades, typically in the form of operational rules. With the advent of Network Function Virtualization (NFV) and Software Driven Networks (SDN), new Virtualized Network Functions (VNFs) and associated services are introduced, changed, and phased out far more rapidly than in the past. As a result, there is an increasing need to accelerate the knowledge retrieval and capture process, discover these rules, and operationalize them within the time frames in which new VNFs and associated services are pushed to the market.

DETAILED DESCRIPTION

A surveillance platform, more commonly known as a fault management system, is an important tool in operations support systems (OSS) that are utilized in operations environments by CSPs. Today, it is difficult to find a surveillance platform that does not have some capability to capture human operator experience for facilitating automated network and service problem inference. This problem inference capability is more commonly referred to as correlation in CSP contexts.

Expert systems, based on the Rete algorithm and its many variants, have been used for decades in CSP environments for this correlation purpose. One of their major weaknesses lies in the fact that they need to be populated with human intelligence, in the form of correlation rules, to work in real time on event and alarm streams to infer and identify problems needing remediation. Expert systems or production rules engines based on the Rete algorithm, and its extensions, have been exploited very successfully in finance, accounting, insurance, healthcare and medicine, energy and utilities, and even in space vehicle operations, amongst many others. The principal reason they were so successful is due to the fact that in these application domains the knowledge base, or operational rules or business rules, were known upfront and all that was needed was a software platform enabling production deployment and application of this knowledge base in real time during run-time. In contrast, in CSP or telecommunication environments, the knowledge base of operational rules is not known until the network gets assembled and production usage starts (e.g., the network begins carrying customer traffic). Following this, operations' teams and network engineers work laboriously, over long periods of time, to learn these rules.

Current generation networks are increasingly deploying VNFs with SDN to facilitate the creation of innovative services to increase revenue generation and average revenue per user, more commonly referred to as ARPU. The ability of a CSP to be creative, reduce the time to market, generate revenue, prevent churn, and reduce capital and operating costs is enabled through the use of VNFs and SDN. This essentially mandates that the CSP must be prepared to operate the network and associated services in very short time frames. System engineering teams do not have the luxury of long time frames to come up with the correlation rules as they did in the past. Therefore, there is a need for a solution that removes the dependency on human experience and automates the creation of knowledge in a surveillance platform by applying a unique combination of machine-learning techniques.

Disclosed are methods, systems, and machine-readable media that provide for self-learning correlation of network patterns for agile network operations. This works by a combination of unsupervised machine-learning techniques to discover the correlation rules and supervised machine learning-techniques to operationalize those rules in a production rules-based expert system embedded in a surveillance platform.

The disclosed methods, systems, and machine-readable media address a problem in traditional CSP fault management systems, as described above, involving resource intensive gathering and training of operational rules for operationalization in surveillance platforms. The disclosed methods, systems, and machine-readable media solve this technical problem by providing a solution also rooted in computer technology, namely, by discovering operational knowledge in the form of correlation rules (e.g., patterns), analyzing the patterns graphically through a user interface to identify patterns that are meaningful to operationalize, and providing automated flow-through operationalization of the meaningful discovered patterns in an expert system, which applies the discovered knowledge on a real-time flow of network events that are processed by a surveillance platform.

The disclosed subject technology further provides improvements to fault management effectiveness through a computer by reducing processing time and increasing automated resolution of potential network errors. The described techniques also provide improved responsiveness by reducing diagnostic time for identifying network issues, removal of non-significant alarms and duplicated alarms, and reduction in symptomatic alarm information in order to focus attention on root cause to determine a resolution.

FIG. 1is a diagram illustrating an example system100for self-learning correlation of network patterns for agile network operations, according to certain aspects of the present disclosure. The system100may include a correlation/automation engine140coupled to a fault management system150. The fault management system150may be operated by an operator170.

An analyst180(e.g., an expert user) may discover patterns through a discovery engine110, determine correlation rules114through a pattern lifecycle graphical user interface (GUI)120, and operationalize them into the correlation/automation engine140automatically through a specific system integration (e.g., system integration130). Once correlation rules have been operationalized in the correlation/automation engine140, the fault management system150may then take advantage of the reduction in the number of events/alarms to be managed by the operator170, by detecting hidden problems or by anticipating future issues.

A fault archival160, besides being used as input of the discovery process, may be utilized by the fault management system150to determine efficiency of the implemented correlation rules. The efficiency of the implemented correlation rules may be utilized as input back into the discovery engine110to further fine tune the correlation rules. In this way, the implemented correlation rules may be continuously improved for better efficiency.

According to an aspect of the present disclosure, the discovery engine110may be configured to receive a stream of network messages102. For example, the stream of network messages may include a variety of network events for various network devices. The discovery engine110may graphically display the stream of network messages on the pattern lifecycle GUI120, such that the analyst180may visually identify patterns116within the stream of network messages. For example, the analyst180may utilize data-driven analysis to discover filters or correlation rules114through the discovery engine110. The analyst180may utilize offline/automatic collaborative analysis to select filters or correlation rules122through the pattern lifecycle GUI120.

The identified patterns may be identified as correlation rules for specific network events to be integrated in the correlation/automation engine140by an automatic interface. For example, the automatic interface may include system integration130, operationalization132, and correlation rules134. According to an aspect, the analyst180may utilize offline/automatic integration to activate/operationalize132the discovered filters or correlation rules114at the correlation/automation engine140. In an implementation, the analyst180may interact with each of the discovery engine110, the pattern lifecycle GUI120, and the correlation/automation engine140in an off-line manner.

According to aspects, the discovery of the patterns112may include a preliminary step of normalizing the network messages by removing information identifying a name assigned to a network element (e.g., a network device), a time at which the network message was generated, a location of the network element, and any other such information. According to additional aspects, a post normalization step may include utilization of an unsupervised learning technique to cluster or label the network messages. For example, the Locality Sensitive Hashing (LSH) algorithm may be utilized to split the collection of network messages from a particular family of equipment into equivalence classes.

According to an aspect of the present disclosure, the discovery engine110may utilize a Frequent Pattern Growth feature of the FP-Growth algorithm (e.g., frequent pattern mining algorithm) to identify collections of related network equipment messages (e.g., patterns). For example, the FP-Growth algorithm may be presented with several transactions (e.g., groupings of network messages) at a time as the input data for discovery of the patterns. In an implementation, the Parallel Frequent Pattern growth (PFP) algorithm, which is a parallelized version of the FP-Growth algorithm, may be utilized, as the size of input data sets may be large and the messages are machine generated, which make them difficult to process without machine help.

In the context of network equipment messages, time slices or windows containing message occurrences may considered as transactions. According to aspects, an archive of network equipment messages spanning a reasonable time horizon may be retrieved for pattern analysis by the discovery engine110. The time horizon (e.g., timeline) may be split up into contiguous time slices, as illustrated below inFIGS. 2A-2C. Each time slice may contain a set of messages, such as in the form of labels or tags. The time slices may be presented as input to the FP-Growth algorithm. While splitting the time horizon into contiguous time slices, it is possible that a meaningful pattern of messages could get split across the adjacent boundaries of a pair of time slices. To account for these scenarios, a time shift may be introduced to create multiple contiguous transaction sequences using increasing time shifts, as discussed further below inFIGS. 2A-2C.

After the generated patterns have been analyzed by the analyst180(e.g., a human expert) and shortlisted for provisioning in the correlation/automation engine140(e.g., production rules engine), the correlation/automation engine140may automatically instantiate the pattern and its associated labels. For example, the system integration130may utilize a combination of Term Frequency-Inverse Document Frequency (TF-IDF) and Jaccard Similarity metrics to generate regular expressions (e.g., regexp) that enable the automation engine140to uniquely identify a label associated with a message arriving in real time in the fault management system150(e.g., surveillance system). While selecting the patterns to be provisioned, the analyst180may also decide on a type of inference processing that the discovery engine110will perform upon reception of the incoming messages.

It is understood that that all tasks performed by human users of the system100are related to decisions regarding meaningful patterns and type of inference processing. The human users are not expected to have programming expertise or machine learning background.

FIGS. 2A-2Care example diagrams of sampled network events over various time slices, according to certain aspects of the present disclosure. Referring toFIG. 2A, a timeline200may include several network events202-210. Each network event202-210may correspond to a different status message for various network devices. Each network event202-210may also be given a tag or label. For example, network event202may be labelled or tagged as the number 8, and may correspond to a connection lost for a chassis agent. Network event204may be labelled or tagged as the number 14, and may correspond to service down for a specific device. Network event206may be labelled or tagged as the number 1, and may correspond to a specific network adapter being down. Network event208may be labelled or tagged as the number 4, and may correspond to a chassis being down. Network event210may be labelled or tagged as the number 2, and may correspond to a change in fan state for a network device. It is understood that these network events and labels/tags are exemplary only, and other network events may be included with the same or different labels/tags.

According to an aspect of the present disclosure, the timeline200may be split up into time slices220and222for sampling of the network events202-210over different intervals. For example, the time slices220and222may be contiguous and non-overlapping. In an implementation, the timeline200may have a total window size of at least 20 time units (e.g., milliseconds, seconds, minutes, hours, etc.), depending on a frequency of the received network events202-210. A first time slice220may have a window size of 10 time units, and a second time slice222may have a window size of 10 time units that is shifted by 10 time units as well. As a result, the first time slice220captures network events202-208, while the second time slice222captures only network event210.

Referring toFIG. 2B, the timeline200includes the same network events202-210, but the network events202-210are captured over different time slices240-244. For example, a first time slice240may have a window size of 10 time units, a second time slice242may have a window size of 10 time units and is also shifted by 2 time units from the first time slice240. A third time slice244may also have a window size of 10 time units and is shifted by 2 time units from the second time slice242. As a result, the first time slice240captures network events202-208, the second time slice242captures network events204-210, and the third time slice captures network events206-210.

Referring toFIG. 2C, the timeline200includes the same network events202-210, but the network events202-210are captured over different time slices260-262. For example, a first time slice260may have a window size of 12 time units, and a second time slice262may have a window size of 12 time units and is also shifted by 12 time units from the first time slice260. As a result, the first time slice260captures network events202-210, and the second time slice262does not capture any of the network events202-210.

It is understood that the window sizes and time shifts are exemplary only and may vary between different time slices. For example, the window sizes may be of different sizes for each time slice, and each time shift may be different for each time slice. It is also understood that the number of time slices may be greater than or equal to one. It is further understood that by varying the window size and time shifts for different time slices, different patterns of the network events may be captured such that nothing is lost. It is further understood that a timeline of more or less than 20 time units is permitted.

FIGS. 3A-3Cillustrate example correlation action execution patterns according to certain aspects of the present disclosure. Referring toFIG. 3A, a diagram300illustrates a pattern310that is identified as including one instance of a first network event302and three instances in a row of a second network event304. It may be determined by a human expert (e.g., analyst180) that the repeat instances of the second network event304are not relevant, and so they may be suppressed by removing them from consideration in the pattern310. For example, a subset of messages in the pattern310may be suppressed. As a result, the pattern310becomes operationalized in the correlation/automation engine140and applied to the output events from the fault management system150as having only the first network event302.

Referring toFIG. 3B, a diagram330illustrates a pattern340that is identified as including three instances in a row of a first network event332, followed by one instance a second network event334and one instance of a third network event336. It may be determined by a human expert (e.g., analyst180) that the repeat instances of the first network event332are repetitive, and so may be compressed/grouped to just one instance. For example, of a subset of messages in the pattern340may be compressed. As a result, the pattern310becomes operationalized in the correlation/automation engine140and applied to the output events from the fault management system150as having only one instance of each of the first network event332, the second network event334, and the third network event336.

Referring toFIG. 3C, a diagram360illustrates a pattern370that is identified as including one instance of a first network event362, one instance of a second network event364, and one instance of a third network event366. It may be determined by a human expert (e.g., analyst180) that the second network event364and the third network event366result in the first network event362. For example, the first network event362may be a major event, such as a server shutdown. As a result, the pattern310becomes operationalized in the correlation/automation engine140and applied to the output events from the fault management system150to issue a ticket in order to prevent the occurrence of the first network event362when the third network event366and the second network event364are detected. In this way major network events may be predicted and prevented. For example, some messages in the pattern370may be grouped and followed by a generation of a synthetic problem message to a user (e.g., operator170).

It is noted that the network events described above may not necessarily occur in the order labelled. For example, the first network event362ofFIG. 3Cmay occur after the third network event366. It is further understood that the above-described network events may be for different network devices, as described inFIGS. 2A-2C.

According to aspects of the present disclosure, faults may be enriched with information coming from other data sources, which allows for an increased level of correlation/automation. For example, the different data sources may be preprocessed to fit a format expected by the pattern discovery engine (e.g., discovery engine110). By enriching alarms with information related to trouble-tickets, the number of patterns eligible to be operationalized may be reduced (i.e., as interesting patterns are only those ending up in an alarm related to a ticket), leading to a lot of time saved by the operators.

The techniques described herein may be implemented as method(s) that are performed by physical computing device(s), as one or more non-transitory computer-readable storage media storing instructions (e.g., non-transitory machine-readable storage medium encoded with instructions executable by at least one hardware processor of a network device) which, when executed by computing device(s), cause performance of the method(s), or, as physical computing device(s) that are specially configured with a combination of hardware and software that causes performance of the method(s).

FIG. 4illustrates an example flow diagram (e.g., process400) for self-learning correlation of network patterns for agile network operations, according to certain aspects of the disclosure. For explanatory purposes, the example process400is described herein with reference to the system100ofFIG. 1, the timelines200ofFIGS. 2A-2C, and the patterns ofFIGS. 3A-3C. Further, for explanatory purposes, the blocks of the example process400are described herein as occurring in serial, or linearly. However, multiple blocks of the example process400may occur in parallel. In addition, the blocks of the example process400need not be performed in the order shown and/or one or more of the blocks of the example process400need not be performed. For purposes of explanation of the subject technology, the process400will be discussed in reference toFIGS. 1, 2A-2C, and 3A-3C.

At block402, a stream of network messages is received. The stream of network messages may include a variety of network events for various network devices. At block404, patterns within the stream of network messages are identified. The patterns may include groupings of the variety of network events. At block406, it is determined for each pattern a list of operationalization/activation scenarios. At block408, the patterns are operationalized as correlation rules in a correlation/automation engine to automatically detect and predict network alarms from events received from a fault management system.

For example, at block402, a stream of network messages is received at the discovery engine110. The stream of network messages may include a variety of network events for various network devices. At block404, patterns (e.g., patterns310,340,370ofFIG. 3) within the stream of network messages are identified. The patterns may include groupings of the variety of network events. For example, the patterns may be identified over various time slices, as illustrated inFIGS. 2A-2C. At block406, an analyst180may determine that for each pattern, the list of operationalization/activation scenarios (e.g., suppression, compression, and/or problem detection/prediction). At block408, the patterns are operationalized by an automatic system interface (e.g., system integration130) into the correlation/automation engine140as correlation rules to automatically detect or predict network problems from the events received from the fault management system.

According to an aspect, the process400further includes normalizing the stream of network messages. For example, the normalizing may include removing identifying information of the various network devices, removing timestamps associated with generation of the stream of network messages, and removing location information of various network devices.

According to an aspect, the process400further includes analyzing the patterns graphically by an expert user to identify the patterns. According to an aspect, the process400further includes suppressing a subset of the variety of network events that are repetitive by removing the subset of the variety of network events from the stream of network messages.

According to an aspect, the process400further includes compressing a subset of the variety of network events that are repetitive by maintaining only one occurrence of a network event of the subset. According to an aspect, the process400further includes generating an alarm in response to an identified pattern that correlates to a hidden network issue or anticipating a future problem by triggering an alert or a ticket. For example, an actual or predictive alert may be generated in response to an identified pattern that correlates to a network incident.

According to an aspect, the process400further includes dividing the stream of network messages into contiguous and non-overlapping time slices, each time slice containing a subset of the stream of network messages. According to an aspect, the process400further includes increasing a time shift for each time slice to create multiple contiguous network message sequences for identifying the patterns.

FIG. 5is a block diagram illustrating an exemplary computer system500with which the system100ofFIG. 1may be implemented. In certain aspects, the computer system500may be implemented using hardware or a combination of software and hardware, either in a dedicated server, integrated into another entity, or distributed across multiple entities.

The computer system500includes a bus508or other communication mechanism for communicating information, and a processor502coupled with a bus508for processing information. According to one aspect, the computer system500can be a cloud-computing server of an IaaS that is able to support PaaS and SaaS services. According to one aspect, the computer system500is implemented as one or more special-purpose computing devices. The special-purpose computing device may be hard-wired to perform the disclosed techniques, or may include digital electronic devices such as one or more application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are persistently programmed to perform the techniques, or may include one or more general purpose hardware processors programmed to perform the techniques pursuant to program instructions in firmware, memory, other storage, or a combination. Such special-purpose computing devices may also combine custom hard-wired logic, ASICs, or FPGAs with custom programming to accomplish the techniques. The special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices, or any other device that incorporates hard-wired and/or program logic to implement the techniques. By way of example, the computer system500may be implemented with one or more processors502. The processor502may be a general-purpose microprocessor, a microcontroller, a Digital Signal Processor (DSP), an ASIC, an FPGA, a Programmable Logic Device (PLD), a controller, a state machine, gated logic, discrete hardware components, or any other suitable entity that can perform calculations or other manipulations of information.

The computer system500can include, in addition to hardware, code that creates an execution environment for the computer program in question, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them stored in an included memory504, such as a Random Access Memory (RAM), a flash memory, a Read-Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable PROM (EPROM), registers, a hard disk, a removable disk, a CD-ROM, a DVD, or any other suitable storage device, coupled to the bus508for storing information and instructions to be executed by the processor502. The processor502and the memory504can be supplemented by, or incorporated in, special purpose logic circuitry. Expansion memory may also be provided and connected to the computer system500through the input/output module510, which may include, for example, an SIMM (Single In Line Memory Module) card interface. Such expansion memory may provide extra storage space for the computer system500, or may also store applications or other information for the computer system500. Specifically, expansion memory may include instructions to carry out or supplement the processes described above, and may include secure information also. Thus, for example, expansion memory may be provided as a security module for the computer system500, and may be programmed with instructions that permit secure use of the computer system500. In addition, secure applications may be provided via the SIMM cards, along with additional information, such as placing identifying information on the SIMM card in a non-hackable manner.

The computer system500further includes a data storage device506such as a magnetic disk or optical disk, coupled to the bus508for storing information and instructions. The computer system500may be coupled via input/output module510to various devices. The input/output module510can be any input/output module. Example input/output modules510include data ports such as USB ports. In addition, the input/output module510may be provided in communication with the processor502, so as to enable near area communication of the computer system500with other devices. The input/output module510may provide, for example, wired communication in some implementations, or wireless communication in other implementations, and multiple interfaces may also be used. The input/output module510is configured to connect to a communications module512. Example communications modules512include networking interface cards, such as Ethernet cards and modems.

The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). The communication network can include, for example, any one or more of a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), a broadband network (BBN), the Internet, and the like. Further, the communication network can include, but is not limited to, for example, any one or more of the following network topologies: a bus network, a star network, a ring network, a mesh network, a star-bus network, tree or hierarchical network, or the like. The communications modules can be, for example, modems or Ethernet cards.

For example, in certain aspects, the communications module512can provide a two-way data communication coupling to a network link that is connected to a local network. Wireless links and wireless communication may also be implemented. Wireless communication may be provided under various modes or protocols, such as GSM (Global System for Mobile Communications), Short Message Service (SMS), Enhanced Messaging Service (EMS), or Multimedia Messaging Service (MMS) messaging, CDMA (Code Division Multiple Access), Time Division Multiple Access (TDMA), Personal Digital Cellular (PDC), Wideband CDMA, General Packet Radio Service (GPRS), or LTE (Long-Term Evolution), among others. Such communication may occur, for example, through a radio-frequency transceiver. In addition, short-range communication may occur, such as using a BLUETOOTH, WI-FI, or other such transceiver.

In any such implementation, the communications module512sends and receives electrical, electromagnetic, or optical signals that carry digital data streams representing various types of information. The network link typically provides data communication through one or more networks to other data devices. For example, the network link of the communications module512may provide a connection through a local network to a host computer or to data equipment operated by an Internet Service Provider (ISP). The ISP in turn provides data communication services through the worldwide packet data communication network now commonly referred to as the “Internet.” The local network and Internet both use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link and through the communications module512, which carry the digital data to and from the computer system500, are example forms of transmission media.

The computer system500can send messages and receive data, including program code, through the network(s), the network link, and the communications module512. In the Internet example, a server might transmit a requested code for an application program through the Internet, the ISP, the local network, and the communications module512. The received code may be executed by the processor502as it is received, and/or stored in data storage506for later execution.

In certain aspects, the input/output module510is configured to connect to a plurality of devices, such as an input device514and/or an output device516. Example input devices514include a keyboard and a pointing device, e.g., a mouse or a trackball, by which a user can provide input to the computer system500. Other kinds of input devices514can be used to provide for interaction with a user as well, such as a tactile input device, visual input device, audio input device, or brain-computer interface device. For example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback, and input from the user can be received in any form, including acoustic, speech, tactile, or brain wave input. Example output devices516include display devices, such as an LED (light emitting diode), CRT (cathode ray tube), LCD (liquid crystal display) screen, a TFT LCD (Thin-Film-Transistor Liquid Crystal Display), or an OLED (Organic Light Emitting Diode) display, for displaying information to the user. The output device516may comprise appropriate circuitry for driving the output device516to present graphical and other information to a user.

According to one aspect of the present disclosure, the systems ofFIGS. 1-3can be implemented using a computer system500in response to a processor502executing one or more sequences of one or more instructions contained in memory504. Such instructions may be read into memory504from another machine-readable medium, such as a data storage device506. Execution of the sequences of instructions contained in main memory504causes the processor502to perform the process steps described herein. One or more processors in a multi-processing arrangement may also be employed to execute the sequences of instructions contained in memory504. The processor502may process the executable instructions and/or data structures by remotely accessing the computer program product, for example, by downloading the executable instructions and/or data structures from a remote server through the communications module512(e.g., as in a cloud-computing environment). In alternative aspects, hard-wired circuitry may be used in place of or in combination with software instructions to implement various aspects of the present disclosure. Thus, aspects of the present disclosure are not limited to any specific combination of hardware circuitry and software.

Various aspects of the subject matter described in this specification can be implemented in a computing system that includes a back end component (e.g., a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a client computer having a graphical user interface), or a Web browser through which a user can interact with an implementation of the subject matter described in this specification, or any combination of one or more such back-end, middleware, or front-end components. For example, some aspects of the subject matter described in this specification may be performed on a cloud-computing environment. Accordingly, in certain aspects, a user of systems and methods as disclosed herein may perform at least some of the steps by accessing a cloud server through a network connection. Further, data files, circuit diagrams, performance specifications, and the like resulting from the disclosure may be stored in a database server in the cloud-computing environment, or may be downloaded to a private storage device from the cloud-computing environment.

As used in this specification of this application, the terms “computer-readable storage medium” and “computer-readable media” are entirely restricted to tangible, physical objects that store information in a form that is readable by a computer. These terms exclude any wireless signals, wired download signals, and any other ephemeral signals. Storage media is distinct from but may be used in conjunction with transmission media. Transmission media participates in transferring information between storage media. For example, transmission media includes coaxial cables, copper wire, and fiber optics, including the wires that comprise the bus508. Transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infra-red data communications. Furthermore, as used in this specification of this application, the terms “computer,” “server,” “processor,” and “memory” all refer to electronic or other technological devices. These terms exclude people or groups of people. For the purposes of the specification, the terms display or displaying means displaying on an electronic device.