document: Dynamic syslog mining for network failure monitoring Syslog monitoring technologies have recently received vast attentions in the areas of network management and network monitoring . They are used to address a wide range of important issues including network failure symptom detection and event correlation discovery . Syslogs are intrinsically dynamic in the sense that they form a time series and that their behavior may change over time . This paper proposes a new methodology of dynamic syslog mining in order to detect failure symptoms with higher confidence and to discover sequential alarm patterns among computer devices . The key ideas of dynamic syslog mining are 1 ) to represent syslog behavior using a mixture of Hidden Markov Models , 2 ) to adaptively learn the model using an on-line discounting learning algorithm in combination with dynamic selection of the optimal number of mixture components , and 3 ) to give anomaly scores using universal test statistics with a dynamically optimized threshold . Using real syslog data we demonstrate the validity of our methodology in the scenarios of failure symptom detection , emerging pattern identification , and correlation discovery .
doc_bio_tags: O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O