Method of correlating events in data packet streams

[0001] In the network management domain various approaches have been proposed for event correlation including rule-based systems, model-based reasoning systems, fault propagation models, and the code-book approach.

[0002] A traditional approach to event correlation is that of rule-based analysis. Rule-based systems are composed of rules in the form of “conclusion if condition” which are used to match incoming events. Based on the results of each test, and the combination of events in the system, the rule-processing engine analyzes data until it reaches a final state. The condition part is a logical combination of propositions about the current set of received alarms and the system state; the conclusion is determined by the state of the correlation process. Rule-based systems require a time-consuming translation of the processes to model into rules and large amounts of processing power to apply all rules in a real-time environment.

[0003] Another group of approaches incorporates an explicit representation of the structure and function of the system being diagnosed. The representation provides information about dependencies of components in the network or about cause-effect relationships between network events. The fault discovery process explores the network model to verify correlation between events. While these approaches can be used for a wide range of continuous queries, the actual processing of the selected data has to be specified in a query statement and the processing of the query is hidden from the developers. This makes it difficult for developers to implement user-defined functions because all processing is limited to the functionality provided by the query language.

[0004] It is an object of the invention to overcome the problems associated with the prior art and to propose a method of correlating events which allows fast implementations of event flow handling for all kinds of technical and commercial processes and which can be performed in real-time without undue processing power, especially in distributed computing environments.

[0005] To this end, the invention proposes a method of correlating events in a stream of data packets each representing an event, each data packet carrying at least one attribute of its event, comprising:

[0006] classifying events according to event types and incorporating an identifier of the type of its event into each data packet,

[0007] providing at least one correlation set of selectors, each selector being responsive to data packets of a predetermined event type identifier only and extracting one or more attributes therefrom,

[0008] applying said correlation set of selectors to said stream of data packets, and

[0009] assessing two or more data packets as correlating events if the attributes so extracted by the responding selectors match.

[0010] The method of the invention enables the fast real-time correlation of events in event processing systems, regardless of their technical scope of application, and a quick and easy-to-understand modelling and implementation of such systems. The invention can be carried out in all fields of application, e.g. industrial process controls, data processing systems, telecommunications networks, network management systems etc.

[0011] According to a preferred embodiment the method of the invention further comprises:

[0012] for each correlation assessed, creating or accessing a correlation session in a data store,

[0013] which correlation session is used for holding data items of tasks processing said correlating events.

[0014] Correlation sessions based on event types provide direct access to correlated event data and leave the developer with the simplified task of developing processing logic for the event services. Developers can reconfigure the behavior of correlation sessions without changing any code, making components useful in a wider range of contexts. The configuration of correlation session includes correlation sets which define the selectors for event types. Based on the configuration information, the system automatically associates events according to their event types and the selectors responsive thereto as defined in the correlation set. The extracted event data is used by the system to create or activate correlation sessions that can be used by developers for maintaining states in their processing logic.

[0015] Further preferred features and embodiments of the invention are defined in the enclosed claims and will now be described in more detail with reference to the enclosed drawings, in which:

[0028] Preferred embodiments of the invention and their best modes of execution will now be disclosed by means of the following examples of applications:

• [0029] 1) the correlation of events in an event data packet stream by means of event types, including the management of data items with correlation sessions for events which have been assessed as correlating,
• [0030] 2) the synchronization of processing tasks for events which have been assessed as correlating as in example 1, and
• [0031] 3) the introduction of virtual event types into the embodiments of the examples 1 and 2.

[0032] FIG. 1 shows the application of a method of correlating events in a stream of data packets E each representing an event. Each data packet E has an identifier T, S, M etc. of the type of its event and at least one attribute A₁, B₁, etc. of this event.

[0033] As will be further explained in detail below, the method comprises the following steps:

[0034] classifying events according to event types and incorporating an identifier of the type of its event into each data packet,

[0035] providing at least one correlation set of selectors, each selector being responsive to data packets of a predetermined event type identifier only and extracting one or more attributes therefrom,

[0036] applying said correlation set of selectors to said stream of data packets, and

[0037] assessing two or more data packets as correlating events if the attributes so extracted by the responding selectors match.

[0038] In general, the time instant of an event is relative to the time granularity that is needed or desired. Thus, certain activities that are of short duration relative to the time granularity are represented as a single event. An activity spanning some significant period of time is represented by the interval between two or more events. For example, a system transaction might have a “begin-transaction-processing” and “end-transaction-processing” event-pair.

[0039] The event attributes A₁, B₁ hold information about the context within which an event occurred, e.g. about agents, resources, the result of an activity (e.g., the result of a system transaction), or any other information that gives character to the specific occurrence of that type of event. The attributes form the structure of an event data packet which formally comprises an event type identifier.

[0040] Elements of the context of a certain event type can be used to define a relationship with elements of the context of other event types. This relationship can be expressed by a correlation set which includes a set of selectors for extracting the elements from an event of a certain event type. The extracted data can e.g. be used to create or activate a data container in the form of a correlation session for storing arbitrary data (=session data), as will be further explained with reference to FIG. 2.

[0041] An event correlation is defined by a correlation set which consists of a set of selectors for various event types. During the event processing, the correlation set is used as follows:

[0042] For a given event of an event stream, an event correlation is performed successfully if

• [0043] 1) the event type of the given event conforms to the event type of one of the selectors of the correlation set,
• [0044] 2) this selector is used to extract one or more event attributes from the events,
• [0045] 3) the extracted event data is used to assess the correlation of events.
  FIG. 2 shows a preferred embodiment of the method of FIG. 1 wherein the assessed correlations are used to-directly or by means of an intermediate service-establish, access, modify and destroy sessions for managing data items of correlated events. These sessions will be called “correlation sessions” in the following.

[0046] In FIG. 2 an event stream with a correlation of two event types is shown: events of type T that include an attribute A₁ and events of type S that include an attribute B₁. Assuming that we use the attribute A₁ and B_i for correlating the events, we will create a separate correlation session for each different value of the attribute A₁ and B₁. For instance, in FIG. 2, Session 3 is managing data items for all events of type T that have an attribute A₁ with the value 4 and all events of type S that have an attribute B₁ also with the value 4. This means in particular:

• • [0047] Elements of an event content (such as event attributes) of a certain event type can be used to define a relationship between elements of an event context of other event types.
  • [0048] This relationship is defined by a correlation set which has selectors for event types.
  • [0049] The selectors are used to extract attributes from events.
  • [0050] The selected data is sued to create or activate a data container for storing data or correlated events.
  • [0051] The container for holding the data of correlated events is defined as a correlation session container.
    Managing Correlation Sessions Based on Event Types

[0052] FIG. 3 shows how correlation sessions based on event types can be managed in a distributed environment.

[0053] In FIG. 3 correlation sessions are centrally managed by a dedicated administration node (admin node). Event processing is performed on distributed worker nodes. During event processing the worker nodes apply selectors of a correlation set to a stream of data packets, and assess two or more data packets as correlating events if the attributes so extracted by the responding selectors match. The extracted attributes are used by the worker nodes to create or activate correlation sessions via a central correlation session service running on the administration node. The correlation session service on the administration node has the role of a coordinator and it ensures that only one worker node can access a single correlation session at the same point in time. In the case that two worker nodes want to use the same correlation session, the correlation session service automatically blocks the request of the second worker node as long the correlation session is in use of the first worker node. In other words, the correlation session service ensures exclusive access to correlation sessions for a single worker node which can be a prerequisite for the consistent functioning of correlation sessions in specific distributed environment applications.

[0054] If no correlation sessions should be lost after a computer crash, the correlation session service stores the data of correlation sessions in a data store. This way, the correlation session service is able to recover after a computer crash by retrieving the latest data for correlation sessions from the data store.

Correlation Sessions and Transactions

[0055] During the event processing event services can create, destroy and change correlation sessions. FIG. 4 shows an example where correlation sessions are used to calculate the cycle time of technical processes. In this example the “Process Started” and “Process Completed” events are correlated in order to collect the data for calculating the cycle time of a technical process instance. For each process instance there is a “Process Started” and “Process Completed” event. Therefore, these two events are correlated by the event attribute “ProcessInstID” which represents an ID of the process instance. If the “Process Started” event is received by the event service “Cycle Time Calculation”, a new correlation session is automatically created and the event service stores the timestamp about the process start into the session (see “process_started” data items in FIG. 4). When the “Process Completed” event is received, the event service uses the timestamp of the correlation session in order to calculate the cycle time (cycle time=timestamp “Process Completed”−timestamp “Process Started”). After the calculation of the cycle time the correlation session is destroyed.

[0056] In the previous example correlation sessions are created, accessed, modified and destroyed. These operations are done in context of other processing steps. For example, for calculating the cycle time the following steps are performed: 1) extraction of the event attribute “ProcessInstID” by means of the respective selector which has responded to the event type identifier for “Process Completed” events, 2) access correlation session for retrieving the timestamp of the correlating “Process Started” event, 3) calculation of the cycle time, 4) destruction of the correlation session, and 5) publishing of the cycle time as new event. In order to ensure consistency, all these steps are performed atomic in a single transaction. If one of the steps fails the transaction is rolled back. For instance, if the publishing of the cycle time as new event fails, also the correlation session destruction and all previous steps are undone by a rollback of the transaction.

Correlation Sessions and Time Windows

[0057] The processing of recent data or data with certain freshness is often a requirement for the event stream processing. An example would be the processing of recent phone call data of a particular customer within a certain period of time (e.g. several hours or days). A correlation session can help in this scenario to find fraud patterns by 1) collecting and processing most recent call data, 2) correlating the phone call events and other technical or commercial events of a particular customer.

[0058] Correlation sessions are a simple but effective mechanism for capturing and processing the data of a moving time window. FIG. 5 illustrates an event stream with sliding time windows.

[0059] Correlation sessions based on event types can be configured to hold their session data only for a certain time interval. When data items are added to the session, they can have a lifetime assigned to it. After attaching the data items to the session, the data item will stay in the session until they expire. Expired data items will be automatically removed from the session by the correlation session service. Since the data items only stay in the correlation session for a certain period of time, the correlation session hold data of a time window that moves along with the most recent event.

[0060] FIG. 6 shows an example of a correlation session with six data items. Four of the six data items have a lifetime and they expire after a certain period of time. The other two data items (data item 5 and 6) are permanent and do not expire. The lifetime of the data items is individually monitored by the correlation session service and it will automatically remove the expired data items.

[0061] The lifetime of data items can be defined programmatically or declaratively in the configuration. If data items are added programmatically, developers can assign individually different lifetimes to the data items. In other words, this mechanism allows them to control for each data item how long it should be available for future event stream processing.

[0062] For performing time window operations, the current data in the correlation session is always being processed. Therefore, operations that access a correlation session do not have to care about filtering the correct set of data for a time window.

[0063] The event synchronization is based on the same mechanisms as the event correlation and goes further beyond. Instead of using correlation session for correlated event data, event synchronization uses locks for synchronizing event processing steps.

[0064] An event synchronization is defined by a correlation set which consists of a group of selectors for various event types. During the event processing, the correlation set is used as follows:

[0065] For a given event of an event stream, an event synchronization is performed successfully if

1) the event type of the given event conforms to the event type of one of the selectors of the correlation set,

2) this selector is used to extract one or more event attributes from the events,

3) the extracted event data is used to issue locks, and

4) the locks are used to control the concurrency of event processing steps.

[0066] FIG. 7 shows an event stream with a synchronization of events of two types: events of type T that include an attribute A₁ and events of type S that include an attribute B₁. Although the events are received on this example in sequence, the processing tasks of these events are executed in parallel. Event synchronization controls the concurrent event processing tasks and ensures that the processing of certain events is not executed in parallel for various reasons (for instance, concurrent event processing causes side effects, deadlocks or unlicensed resource usage).

[0067] In this example it is assumed that the attribute A₁ of the event type T and the attribute B₁, of the event type S are used for synchronizing event processing steps. A separate lock for each different value of the attribute A₁ and B₁ is issued by a synchronisation service. For instance, in FIG. 7 Lock 2 is used for all events of type T that have an attribute A₁ with the value 2 and all events of type S that have an attribute B₁ also with the value 2. If Lock 2 is issued for a processing step, this processing step is able to block other processing steps that also would like to acquire Lock 2.

[0068] The following steps describe how Lock 2 synchronizes event processing tasks of FIG. 1:

• [0069] 1) If event E_B1=2^S is received, an event processing task for this event starts and Lock 2 is issued.
• [0070] 2) During the processing of the event E_B1=2^S another event E_A1=2^T is received. The processing of the event E_A1=2^T will be blocked as long as the event processing task of E_B1=2^S is in progress. The event of E_A1=2^T is automatically blocked since E_A1=2^T also would have to issue Lock 2.
• [0071] 3) The processing of the event E_A1=2^T starts when Lock 2 is released after the completion if the event processing task for E_B1=2^S.
• [0072] 4) The event processing task of E_A1=2^T completes; the event E_B1=2^S and E_A1=2^T were processed in sequence.
  In short:
  • [0073] Elements of an event context (such as event attributes) of a certain event type can be used to define a relationship between elements of an event context of other event types.
  • [0074] This relationship is defined by a correlation set which has selectors for event types.
  • [0075] The selectors are used to extract attributes from events. The selected data is used to issue locks for synchronizing event processing steps.
    Managing Locks in a Distributed Environment

[0076] FIG. 8 shows how locks can be managed in a distributed environment.

[0077] Locks are centrally managed by a dedicated administration node (admin node). The event processing is performed on distributed worker nodes. During event processing the worker nodes apply selectors of a correlation set to a stream of data packets, and assess two or more data packets as correlating events if the attributes so extracted by the responding selectors match. The extracted attributes are used by the worker nodes to issue locks via central a synchronization service running on the administration node. The synchronization service on the administration node has the role of a coordinator and it ensures that only tone worker node can use a lock at the same point in time. In the case that two worker nodes want to use the same lock, the synchronization service automatically blocks the request of the second worker node as long as the lock is not released by the first worker node.

[0078] Furthermore, synchronization service also allows a limited number of worker nodes to issue a lock at the same time. This mechanism can be used to throttle the parallel processing of an event service among worker nodes.

[0079] FIG. 9 shows a first application of lock handling wherein the synchronisation obtained can be used to restrict the access of processing tasks (here: Event Service 1, Event Service 2) to e.g. an external analysis system.

[0080] The created locks can also be used to serialize the order of processing tasks for events which have been assessed as correlating events. FIG. 10 shows such a second application of the locks for serializing processing tasks (here: “Processing Event: Process Started P200” on Worker Node 2 and “Processing Event: Process Completed P200” on Worker Node 3) which need to consecutively process a common resource (here: “Process P200”).

Locks and Transactions

[0081] An event processing task can issue a lock from the synchronization service. If the event processing task is executed as an atomic transaction, the synchronization service has to participate in this transaction. If the transaction for the event processing task completes, the synchronization service automatically releases all locks that were previously issued for the event processing task.

[0082] As described so far, for purposes of maintaining information about an action (e.g. something changed in an industrial process control environment), event data packets can have attributes about the context when the event occurred. Event attributes hold information about e.g. agents, resources, the result of an activity (e.g. the result of a system transaction), or any other information that gives character to the specific occurrence of that type of event. The attributes form the structure of an event which is formally defined by an event type. In other words, an event type formally defines the structure of an event. These event types are “concrete” event types, called herein also simply “event types”.

[0083] In further detailing the above concept of event types, a so-called “virtual event type” is created which allows to conjoin existing event types by merging conjunct (=common) attributes. The conjoined event types are called “base” event types in the following. Base event types can be concrete or also virtual.

[0084] Virtual event types are constructed based on the current structure of their base event types. If one of the base event types changes (e.g. an attribute is removed or added), the virtual event type reflects this change. Consequently, a virtual event type represents a view of conjunct attributes from its base event types.

[0085] Every existing event always conforms to one concrete event type. Furthermore, an event can be compatible to one or more virtual event types which have to be based on the underlying concrete event type.

[0086] In order to determine whether an existing event is compatible to a virtual event type, the concrete event type of the event is used to recursively check whether it is contained in one of the base event types of the virtual event type.

[0087] FIG. 11 shows an example of concrete and virtual event types for process events. The event types “Process Started”, “Process Completed”, “Transaction Started” and “Transaction Completed” are concrete since they do not have any base event type. There are several virtual event types derived from these concrete event types, such as the “Transaction Events” event type which contains all conjunct attributes of concrete transaction events (=ProcessInstID, TransactionID), or the “Process Events” event type which contains all conjunct attributes of the other shown event types (=ProcessInstID).

[0088] There is one special event type (called “All Events”) that has all existing (concrete and virtual) event types as base event types.

[0089] It should be noted that virtual event types are not comparable with the concept as inheritance. Inheritance is a top down process in order to specialize event types. In the case of inheritance, the base event types would contain common characteristics of the new event types which are further extended. Therefore, in general, the number of attributes increases for specialized event types.

[0090] In contrast thereto, virtual event types are constructed the other way around. Based on specialized event types, new event types with only conjunct attributes are created. Therefore, in general, the number of attributes decreases for virtual event types, i.e. virtual event types

• • [0091] combine common (=conjunct) attributes of the base event types;
  • [0092] are always compatible to their base event types;
  • [0093] can be based on other virtual event types (virtual event types can be nested);
  • [0094] the root nodes of a virtual event type hierarchy are always concrete event types; and
  • [0095] the special virtual event type “All Events” is compatible to all (concrete and virtual) event types.
    Concrete and virtual event types can be used to model event streams between components for the event processing such as event services. FIG. 12 shows four event processing tasks (Event Service 1, Event Service 2, Event Service 3, Event Service 4) with various input and output interfaces that conform to event types. Some of these event types are concrete and some are virtual ones.

[0096] Various rules for using multiple event types for an event stream in order to connect event services are advisable:

1. Concrete event type: An event type is only compatible to another concrete event type when they are both equal.

2. Virtual event type: An event type that is only compatible to another virtual event type when they are either equal or the event type is (recursively) one of the base event types of the virtual event type.

The second rule for virtual events enables a more efficient management of event streams since the input/output interfaces of the event services for the event stream do not have to be equal—they only have to be compatible.

[0097] For instance, “Event Service 2” has interfaces with the concrete event type B and C, and the virtual event type E. The virtual event type E has the base event types A and C.

[0098] The interface of the “Event Service 2” with the concrete event type C can be connected with the virtual event type E on “Event Service 4” since this event type E contains the event type C in its base event types.

[0099] The following table shows a summary matrix of the compatibility of the event types from FIG. 12:

[0100]

Event Types	A	B	C	D(B, C)	E(A, C)
A	compatible
B		compatible
C			compatible
D(B, C)		compatible	compatible	compatible
E(A, C)	compatible		compatible		compatible

[0101] The invention is not limited to the specific examples described herein but covers all modifications and embodiments within the scope of the appended claims.