A Method for Temporal Event Correlation

In recent years, the use of data-driven algorithms has gained significant traction as a method of localizing faults in commercial networks through the analysis of network events.While the number of different failure scenarios in any IT infrastructure is potentially unbounded, the fundamental mechanisms of fault propagation and related failure modes are much smaller. A significant component of many failure modes is a statistically predictable time pattern of event production. In this paper we describe a novel approach for identifying faults that produce such a sequence of events, based only upon their temporal arrival pattern.The approach uses state-of-the-art optimization techniques to establish a temporal similarity graph for a given group of alerts. Community detection algorithms are then applied to the event similarity graph in order to determine groups of faults with similar arrival patterns. We demonstrate the efficacy of the new approach by applying it to simulated event streams in realistic failure scenarios, reproducing results that are consistent with experience of deploying the technique in real world networks.