Pattern discovery and specification techniques for alarm correlation

Ever increasing amounts of alarm data threaten the stability of management systems in high speed telecommunications networks. As networks continue to develop, becoming larger, using substantially higher bandwidth links and using more complex equipment, so the danger of alarm inundation is increased. Alarm correlation systems have been seen to play a vital role in dealing with the problem. However, the question of what to correlate and how to recognise and specify related alarms has either been left largely unanswered or distinct from the physical correlation process. In this presentation, we describe a unifying framework which uses a purpose-designed language to specify alarm patterns and then use the results in a real-time correlation engine. In order to test the effectiveness of the solution, the language was translated onto an existing proprietary correlation system and fed with alarm data from an SDH network test-bed. Preliminary evaluation has indicated the system to be extremely fast, potentially robust to network dynamics and, importantly, resilient to a degree of input space error. Furthermore, it is easy to use, intuitive and may be extended through the incorporation of artificial intelligence modules.