Abstract: Techniques for mining or discovering one or more patterns in an input data set, wherein the input data set is characterized by attributes, comprises the following steps. First, the technique includes mapping attributes of the input data set to mapping values. Then, one or more candidate patterns are formed as groupings of two mapping values that occur within a predefined time period. Next, for each of the one or more candidate patterns, a qualification function is computed and a result of the qualification function is compared with at least one predefined threshold value. The one or more candidate patterns whose qualification function results are greater than or equal to the predefined threshold value are identified as one or more qualified patterns.

Abstract: A new form of pattern referred to as a fully dependent pattern or d-pattern is provided. The d-pattern captures dependence among a set of items based on a dependency test. An efficient algorithm is provided for discovering all d-patterns in data. Specifically, a linear algorithm is provided for testing whether a pattern is an d-pattern. Further, a pruning algorithm is provided that prunes the search space effectively. Still further, a level-wise algorithm for mining d-patterns is provided.

Abstract: Techniques are provided for decision support for event management, both to support operational problem determination and to validate/construct correlation rules. The system comprises a set of tools for the analysis of events as a mechanism to construct and validate correlation rules. The methods describe how to use these tools for several decision support processes.

Abstract: Techniques for data-driven validation, completion and construction of event relationship networks (ERNs) are provided. Event relationship networks are widely used in event management system design. To date, ERNs are constructed purely based on human expertise and there is no automatic or event semi-automatic method that validates or completes ERNs. The present invention provides techniques for automatically validating and completing existing ERNs and/or constructing new ERNs, based on collected event data.

Abstract: A new form of pattern is provided, referred to as a mutual dependence pattern or m-pattern. The m-pattern captures mutual dependence among a set of items. Intuitively, the m-pattern represents a set of items that often occur together. In our experience, such m-patterns often provide great values for certain tasks, such as event correlation in event management. Further, an efficient algorithm is provided for discovering all m-patterns in data for a given minimum mutual dependence threshold. Specifically, a linear algorithm is provided for testing whether a pattern is an m-pattern. Further, a pruning algorithm is provided that prunes the search space effectively. Still further, a level-wise algorithm for mining m-patterns is provided.

Abstract: Electronic contracts or “eContracts” for representing service level agreements are provided. In one illustrative embodiment, the eContract may comprise information pertaining to: (a) descriptions of business transactions in IT terms; (b) financial implications of business transaction service levels; and (c) reporting to be done in business terms. Of course, the eContract may comprise other terms and conditions. In an illustrative aspect of the invention, a system for managing IT resources in terms of business financials comprises an electronic contract authoring system or “ecAuthoring system,” an electronic contract manager module or “ecManager,” and one or more electronic contract agent modules or “ecAgents” that may run on IT elements (e.g., components of the network) that are being managed. Analysts interact with the ecAuthoring system to construct eContracts.

Abstract: A computer-based method of processing multidimensional data is disclosed which comprises the steps of: (i) obtaining categorical attributes associated with the multidimensional data; (ii) automatically ordering at least a portion of the categorical attributes associated with the multidimensional data wherein the automatic ordering step arranges the attributes to provide a substantially optimized visualization of the categorical attributes; and (iii) making results of the automatic ordering step available for use in accordance with a data visualization system.

Abstract: Systems and methods for instance counting and for the identification of a temporal pattern in an event sequence. The system addresses the use of “earliest-first” and “no-reuse” policies as criteria for the correctness of counting. The system also achieves higher performance than conventional methods by utilizing incremental computation.

Abstract: A technique is provided for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices. The technique comprises the following steps. First, in association with an event cache, event data representing past or historical events associated with the network of computing devices being managed by the event management system is obtained. Next, a first pattern is found or detected in the obtained event data associated with the event cache. The pattern is then classified. Then, at least one correlation rule is constructed based on the classified pattern. Lastly, in association with the event cache, the one or more events included in the pattern are replaced with a composite or cumulative event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.

Abstract: Techniques for ordering categorical attributes so as to better visualize data are provided. In accordance with one embodiment of the invention, an ordering algorithm comprises the steps of: (a) translating the discrete ordering problem to a continuous optimization problem; (b) solving the continuous optimization problem; and (c) mapping an optimal continuous solution to the closest discrete solution.

Abstract: Techniques for use in accordance with application performance decomposition are provided which take advantage of the communications protocol used to carry a transaction between application components in a distributed computing network. Specifically, the invention extends the communications protocol by embedding data, such as timestamp and duration measurement data, in the protocol itself, rather than extending or altering the application or transaction data carried by the protocol as in existing approaches. Thus, the invention provides natural correlation of interactions of distributed application components on such transactions without modification to the application or transaction data. Because the correlation is performed in-line with the application component interactions, minimal data management overhead is required, and correlated performance decomposition is made possible in real-time for the transaction.

Abstract: Computer-based methods and systems for performing automated distribution of a software package to one or more target machines in one or more regions of a distributed network of target machines, comprises the following steps. First, a base software package is prepared for each of the one or more regions based on at least one of: (i) policy data indicating which of the one or more regions are candidates for receiving the software package, (ii) dependency information indicating requisites for a service provided by the software package, and (iii) configuration information for each of the candidate regions. The base software package is then distributed to each of the candidate regions of the distributed network.

Abstract: Systems and methods for discovering partially periodic temporal associations, referred to herein as p-patterns, are provided. For example, a p-pattern in computer networks might comprise five repetitions every 30 seconds of a port-down event followed by a port-up event, which in turn is followed by a random gap until the next five repetitions of these events. In one embodiment, the present invention comprises: (i) a normalization step to convert application-oriented event data into an application-independent normalized table; (ii) an algorithm for finding significant period lengths from normalized events (e.g., 30 seconds) using a Chi-squared test; and (iii) an algorithm for finding a partially periodic temporal association (e.g., port-down followed by port-up) given a know period.

Abstract: A method, system and program storage device for measurement acquisition using predictive models which: (a) can improve scalability; (b) can accommodate devices that operate in a disconnected mode; and (c) enable integration of data from sources with different time granularities. Various features can be embodied in software and an object-oriented implementation is described. Different implementations are described, such as standalone predictive models implemented only on a manager (for example systems management/load balancing) or managed system (for example router management); or a parallel implementation with predictive models running on both the manager and managed (agent) systems (for example financial trading or system health monitoring). In a parallel model implementation, the agent constructs a predictive model that is conveyed to the manager system. The models are used in parallel, possibly with no communication for an extended time.

Abstract: A method, system and program storage device for measurement acquisition using predictive models which: (a) can improve scalability; (b) can accommodate devices that operate in a disconnected mode; and (c) enable integration of data from sources with different time granularities. Various features can be embodied in software and an object-oriented implementation is described. Different implementations are described, such as standalone predictive models implemented only on a manager (for example systems management/load balancing) or managed system (for example router management); or a parallel implementation with predictive models running on both the manager and managed (agent) systems (for example financial trading or system health monitoring). In a parallel model implementation, the agent constructs a predictive model that is conveyed to the manager system. The models are used in parallel, possibly with no communication for an extended time.

Abstract: Methods and systems are described for learning correlation rules used in event management. In one aspect of the invention, a method comprises the steps of: (a) marking one or more event groupings; (b) employing a machine learning program to learn the underlying concept of these groupings; (c) including a rule right-hand side; and (d) putting the new rule in the Rule DB. A system to implement this method may comprise components for: (1) interactive visualization and user interface control; (2) query-based learning; (3) Event DB access; and (4) correlation Rule DB access.

Abstract: A system and method are described for automating navigations in systems with measurement data that are structured as a multidimensional database (MDDB). The navigation includes an Automated Navigation Engine that uses external representations of a dimension selection function and a cube selection function to guide MDDB navigations. The method consists of the steps: (1) select the MDDB dimension that has the largest dimension selection score; (2) if this score is too small, terminate the method; (3) otherwise, select the cube with the largest cube selection score. These steps are performed repeatedly until (2) applies. Navigations can be performed for data mining, problem isolation, trending analysis, etc.

Abstract: A method and apparatus are described for building diagnostic systems for performance problems in computer and communications systems. The diagnostic system outputs explanations that quantify contributions to performance problems, such as "90% of the increase in response time is due to increased LAN traffic." The preferred embodiment comprises: (1) a representation of the target system as a directed acyclic graph; (2) diagnostic techniques that compute numerical weights for arcs in the directed graph; and (3) a diagnosis engine that uses the directed graph and arc weights to output quantitative performance diagnoses. Nodes in the directed graph are measurement variables in the target system. Arcs in the graph indicate functional dependencies between measurement variables. Arc weights indicate the contribution of a child variable to performance problems manifested in the parent variable.