Alert correlating using sequence model with topology reinforcement systems and methods

Abstract

Alert correlation plays an important role in IT event management. It helps reduce the number of alerts that IT staff have to act upon. The disclosure describes a method, a computer program product that applies a machine driven deep learning model to effectively correlate alerts caused by a common root cause. In addition, this method of correlation provides the user the context of the root cause. Therefore, it helps the user to quickly identify, understand and resolve the problem thereby reducing the mean time to identification and resolution. Alerts that are caused by the same root cause therefor come together. In the machine learning world, language sequence models are doing very well on learning the sequence patterns between words. For example, the machine can learn the subtle difference between choice of words and the order of words in order to fake a person's writing. The disclosed embodiments use similar technology but apply it on IT resource and application monitoring alerts across private and public clouds to learn the alert's sequence pattern. Once the sequence model is trained with alert sequences, the model is fed with a stream of new alerts, the model then identifies the two or more alerts that are together or clustered. Clustered alerts are often caused by the same root cause and should be correlated as one unit of work to understand cause, impact and resolution.

What is claimed is: 
     
         1 . A method of correlating a plurality of alerts in a network environment including multiple computing devices coupled through one or more networks comprising:
 receiving a plurality of alerts from one or more applications operating in the network environment;   analyzing the plurality of alerts in a time sequence;   correlating the plurality of alerts via an alert correlation module comprising one or more of a sequence model, a topology reinforcement module, and a similarity reinforcement module;   clustering the plurality of alerts attributable to a common triggering event.   
     
     
         2 . The method of  claim 1  further comprising: converting one or more raw alerts into one or more normalized alerts for analysis. 
     
     
         3 . The method of  claim 2  wherein the raw alerts are normalized for analysis and provided to a data pipeline. 
     
     
         4 . The method of  claim 1  wherein the sequence model is trainable using historical alert sequences on a neural network. 
     
     
         5 . The method of  claim 1  wherein the topology reinforcement is created through a network discovery. 
     
     
         6 . The method of  claim 1  wherein the similarity reinforcement is based on a natural language process. 
     
     
         7 . The method of  claim 1  wherein a first alert in an alert sequence is used to invoke a sequence model. 
     
     
         8 . The method of  claim 1  further comprising alert sequence training of a neural network. 
     
     
         9 . The method of  claim 8  further comprising:
 taking information from an input alert at a first timestep; 
 calculating an alert sequence; and 
 predicting a time interval for which a simulation will progress. 
 
     
     
         10 . The method of  claim 8  further comprising alert embedding. 
     
     
         11 . The method of  claim 8  further comprising running a training workload as a scheduled batch job on a training node. 
     
     
         12 . The method of  claim 1  wherein the plurality of alerts are not analyzed individually or in alert pairs. 
     
     
         13 . One or more computer-readable storage media storing computer-executable instructions for causing a computer to perform a method, the method comprising:
 receiving a plurality of alerts from one or more applications operating in a network environment;   analyzing the plurality of alerts in a time sequence;   correlating the plurality of alerts via an alert correlation module comprising one or more of a sequence model, a topology reinforcement module, and a similarity reinforcement module;   clustering the plurality of alerts attributable to a common triggering event.   
     
     
         14 . The computer-readable storage media of  claim 13  further comprising:
 converting one or more raw alerts into one or more normalized alerts for analysis. 
 
     
     
         15 . The computer-readable storage media of  claim 14  wherein the raw alerts are normalized for analysis and provided to a data pipeline. 
     
     
         16 . The computer-readable storage media of  claim 13  wherein the sequence model is trainable using historical alert sequences on a neural network. 
     
     
         17 . The computer-readable storage media of  claim 13  wherein the topology reinforcement is created through a network discovery. 
     
     
         18 . The computer-readable storage media of  claim 13  wherein the similarity reinforcement is based on a natural language process. 
     
     
         19 . The computer-readable storage media of  claim 13  wherein a first alert in an alert sequence is used to invoke a sequence model. 
     
     
         20 . The computer-readable storage media of  claim 13  further comprising alert sequence training of a neural network. 
     
     
         21 . The computer-readable storage media of  claim 20  further comprising:
 taking information from an input alert at a first timestep; 
 calculating an alert sequence; and 
 predicting a time interval for which a simulation will progress. 
 
     
     
         22 . The computer-readable storage media of  claim 20  further comprising alert embedding. 
     
     
         23 . The computer-readable storage media of  claim 20  further comprising running a training workload as a scheduled batch job on a training node. 
     
     
         24 . The method of  claim 13  wherein the plurality of alerts are not analyzed individually or in alert pairs. 
     
     
         25 . A system for correlating alerts in a computing environment including multiple computing devices coupled through one or more networks comprising:
 an alert processing service comprising an alert correlation module having one or more of a sequence model, topology reinforcement module, and similarity reinforcement module; and   an alert normalization engine.   
     
     
         26 . The system of  claim 25  wherein the system is configurable to convert one or more raw alerts received by the alert processing service into one or more normalized alerts for analysis. 
     
     
         27 . The system of  claim 25  wherein the sequence model is trainable using historical alert sequences on a neural network. 
     
     
         28 . The system of  claim 25  wherein the topology reinforcement is created through a network discovery.