Patent Document ID: 9195943
Application ID: 13795071

Base Claim:
1. A management system for determining causal relationships among system entities, the management system comprising: at least one processor; a non-transitory computer-readable storage medium including instructions executable by the at least one processor, the instructions configured to implement, a causal relationship detector configured to receive events from a computing environment having a plurality of entities, and configured to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events, the causal relationship detector being configured to create vertices and arcs connecting temporally adjacent vertices, and annotate each arc with a coefficient value representing a level of connectivity between the temporally adjacent vertices based on the events; and a rules converter configured to convert one or more of the causal relationships into at least one behavioral rule, the rules converter configured to map the temporally adjacent vertices to corresponding entities of the plurality of entities that generated the temporally adjacent vertices when the coefficient value is above a threshold value, the at least one behavioral rule indicating a causal relationship between the corresponding entities.

---

Claim 4:
4. The management system of claim 1 , wherein the causal relationship detector includes a graph generator configured to generate a graph based on the events, the graph generator including: a vertex classifier configured to create the vertices based on an initial set of events including a first vertex, a second vertex, and a third vertex, the vertex classifier further configured to arrange the first vertex, the second vertex, and the third vertex in chronological order; and an arc classifier configured to create the arcs between the temporally adjacent vertices including a first arc connected between the first vertex and the second vertex and a second arc connected between the second vertex and the third vertex, wherein the arc classifier is configured to annotate the first arc with a first coefficient value representing a level of connectivity between the first vertex and the second vertex and annotate the second arc with a second coefficient value representing a level of connectivity between the second vertex and the third vertex.