Rule Discovery in Telecommunication Alarm Data



Mika Klemettinen
Department of Computer Science
PO Box 26
FIN-00014 University of Helsinki
Helsinki, Finland
Email: Mika.Klemettinen_AT_cs.helsinki.fi

Heikki Mannila
Department of Computer Science
PO Box 26
FIN-00014 University of Helsinki
Helsinki, Finland
Current affiliation: Microsoft Research
Email: Heikki.Mannila_AT_cs.helsinki.fi

Hannu Toivonen
Rolf Nevanlinna Institute
PO Box 4
FIN-00014 University of Helsinki
Helsinki, Finland
Email: Hannu.Toivonen_AT_rni.helsinki.fi



Abstract
Fault management is an important but difficult area of telecommunication network management: networks produce large amounts of alarm information which must be analyzed and interpreted before faults can be located. So called alarm correlation is a central technique in fault identification. While the use of alarm correlation systems is quite popular and methods for expressing the correlations are maturing, acquiring all the knowledge necessary for constructing an alarm correlation system for a network and its elements is difficult. We describe a novel partial solution to the task of knowledge acquisition for correlation systems. We present a method and a tool for the discovery of recurrent patterns of alarms in databases; these patterns can be used in the construction of real-time alarm correlation systems. The patterns we look for are episode rules which have the following form: "If a certain combination of alarms occurs within a time period, then another combination of alarms will occur within a time period with a certain probability." Given an alarm database, a set of alarm predicates that can be used to refer to the alarms, a set of possible time bounds in the episodes, and a frequency threshold, our method finds all episode rules (with arbitrary combinations of alarms and time bounds) such that the number of times that a rule applies in the alarm database is at least the specified frequency threshold. We also present tools with which network management experts can browse the large amounts of rules produced. With the described tools the construction of correlation systems becomes easier, as the episode rules provide a wealth of statistical information about recurrent phenomena in the alarm stream. This methodology has been implemented in a research system called TASA, which is used by several telecommunication operators. We briefly discuss experiences in the use of TASA.

Keywords: Alarm correlation, Fault identification, Rule discovery, Data mining, Episodes

JNSM: Vol. 7, No. 4, 1999 Rule Discovery in Telecommunication Alarm Data [Vol. 7, No. 4, 1999]



NOTE: only abstract of paper available on-line; please contact your library or the authors for the full paper

Back to JNSM main page