Abstract: A method and apparatus for automatically localizing failures in a network. Failures can be localized by receiving an observation, querying a database for a plurality of models of risks and calculating a hypothesis from the plurality of models of risks that explains the observation. The observation comprises link failures reported by a plurality of data sources. The plurality of models or risks represents links that would likely be impacted by the failure of each component within the network stored in a Shared Risk Link Group (SRLG) database. A Spatial Correlation Engine (SCORE) applies an algorithm to calculate a hypothesis from the plurality of models of risks that explains the observation, thereby, automatically localizing failures in a network.

Abstract: An apparatus (520) for archiving signatures associated with packets received at a node in a network includes a first memory (620), a second memory (625), a signature tap (610), a multiplexer (615), and a controller (630). The signature tap (610) receives packets at the node and computes one or more signatures for each of the received packets. The multiplexer (615) aggregates the computed one or more signatures in the first memory (620) to produce one or more signature vectors. The controller (630) archives the one or more signature vectors in the second memory (625).