Event Correlation Techniques
Several correlation techniques are used to isolate and localize fault in networks. All are based on
(1) Detecting and filtering of events
(2) Correlating observed events to isolate and localize the fault either topologically or functionally
(3) Identifying the cause of the problem.
In all three cases, different reasoning methods distinguish one technique from another.
Six approaches to correlation techniques:
(1) Rule-based reasoning
(2) Model-based reasoning
(3) Case-based reasoning
(4) Codebook
(5) State transition graph model
(6) Finite state machine model
i. Rule-based reasoning (RBR) is the earliest form of correlation technique. It is also known by many other names, including rule-based expert system, expert system, production system, and blackboard system.
ii. It has a working memory, an inference engine and a knowledge base. The three levels representing the three components are the data level, control level, and knowledge level, respectively.
iii. The knowledge base contains expert knowledge as to (1) definition of a problem in the network and (2) action that needs to be taken if a particular condition occurs.
iv. The knowledge base information is rule-based in the form of if-then or condition-action, containing rules that indicate which operations are to be performed when.
v. The working memory contains, as working memory elements, the topological and state information of the network being monitored.
vi. The working memory recognizes when the network goes into a faulty state.
vii. The inference engine, in cooperation with the knowledge base, compares the current state with the left side of the rule-base and finds the closest match to output the right side of the rule. The knowledge base then executes an action on the working memory element.
viii. In Figure1, the rule-based paradigm is interactive among the three components and is iterative. Several strategies are available for the rule-based paradigm.
The basic Rule-Based Reasoning Paradigm
ix. A specific strategy is implemented in the inference engine. When a specific rule has been chosen, an action is performed on the working memory element, which can then initiate another event. This process continues until the correct state is achieved in the working memory.
x. Rules are established in the knowledge base from the expertise of people in the field. The rule is an exact match and the action is very specific.
xi. If the antecedent and action in the rule do not match, the paradigm breaks and it is called brittle. However, it can be fixed by adding more rules, but doing so increases the database size and degrades performance, called a knowledge acquisition bottleneck.
xii. As the number of working memory elements grows, memory requirements grow exponentially. In addition, the action is specific, which can cause unwanted behavior.
xiii. For example, we can define the alarm condition for packet loss as follows:
If packet $loss \lt 10%$ alarm green
If packet $loss =\gt 10% \lt 15%$ alarm yellow
If packet $loss =\gt 15%$ alarm red
xiv. The left side conditions are the working memory elements, which if detected would execute the appropriate rule defined in the rule-base
xv. This action could cause the alarm condition to flip back and forth in boundary cases. An application of fuzzy logic is used to remedy this problem, but it is difficult to implement.
- An RBR-Based Correlation Example :
i. Figure2 is used here to illustrate an implementation of RBR. It shows a four-layer network.
ii. Backbone router A is linked to router B. Hub C is connected to router B and has four servers, D1-D4, in its LAN.
iii. Without a correlation engine, failure in the interface of router A will generate an alarm. This fault then propagates to router B, hub C, and finally to servers D1 -D4, Time delay is involved in alarm generation.
iv. In general, propagation of faults and the time delay associated with them need to be fully recognized in fault management.
An RBR-Based Correlation Example Scenario
v. Four correlation rules are specified in Figure3.
vi. Rule 0 has no associated condition with, but rules 1-3 are conditional. To allow for propagation time, a correlation window of 20 seconds is set.
Rule Specification for the RBR Scenario
and 5 others joined a min ago.
teamques10
★ 68k