Abstract: Devices, methods and computer program products for managing quality of monitoring models for collection of performance and/or sensing data are disclosed. A communication network node device sets up a quality of monitoring function for managing a quality of monitoring, QoM, model that defines QoM classes for processing and compressing a performance and/or sensing data stream via selection of data to be included in the performance and/or sensing data stream. The communication network node device causes a first message notifying about the set up QMF to be transmitted towards at least one first target rendezvous point, RP, in the communication network, each RP being configured to aggregate at least one of performance and/or sensing data streams or QoM models.

Abstract: Devices, methods and computer program products for managing quality of monitoring models for collection of performance and/or sensing data are disclosed. A communication network node device sets up a quality of monitoring function for managing a quality of monitoring, QoM, model that defines QoM classes for processing and compressing a performance and/or sensing data stream via selection of data to be included in the performance and/or sensing data stream. The communication network node device causes a first message notifying about the set up QMF to be transmitted towards at least one first target rendezvous point, RP, in the communication network, each RP being configured to aggregate at least one of performance and/or sensing data streams or QoM models.

Abstract: Apparatus including functionality configured to monitor said apparatus for security attacks; and a reporter configured to send data to a security node, wherein the data sent to said security node is dependent on a security level of said apparatus.

Abstract: The present invention relates to a method and apparatus for compressing a log record information provided e.g. to a monitoring system. Frequent patterns in the log information are detected and, then, redundant frequent patterns whose value or record combination is a subset of a value or record combination of another one of said detected frequent patterns are removed. Accordingly, a general method is provided which can be applied to all event logs arising from communication networks or other monitoring systems. The detection of frequent patterns is only based on value or record combinations and is thus independent of the specific application. On the other hand, the size of the stored log files can be decreased remarkably while remaining readable for human beings.

Abstract: A method for teaching an anomaly detecting mechanism in a system comprising observable elements (302), at least one of which has a periodic time-dependent behaviour, the anomaly detecting mechanism comprising a computerized learning mechanism (314). The method comprises assembling indicators (304) indicating the behaviour of the elements (302) and arranging the assembled indicators such that each observable element's indicators are assigned to the same input data component. The learning mechanism (314) is taught so that the input data of the learning mechanism comprises the input data components which are based on the assembled indicators (304). Points which approximate the input data are placed in the input space. A presentation of time (420-424) is incorporated into at least one input data component wherein the presentation of time is periodic, continuous and un-ambiguous within the period of the at least one element with periodic time-dependent behaviour.

Abstract: A method and system for monitoring the behavior of at least one observable object, e.g. a network element, of a network, wherein at least one parameter of the observable object is repeatedly detected. An actually detected parameter is input to a learning process and to an analyzing process, wherein the learning process forms a reference, based on at least two detected parameter values, for describing the behavior of the observable object. The analyzing process compares the input parameter and the reference for detecting an anomal behavior. The parameter preferably is a vector which includes several values describing properties or functioning of the observable object, and is formed based on events and/or reports from the object.

Abstract: A data processing system processes data arrays that collectively describe cyclic behavior of at least one variable in several entities in a physical process. Each cycle comprises several time slots. An input routine (2-4) receives multiple data arrays, each data array containing multiple data items, each of which describes a variable of an entity in one time slot. A magnitude-determination routine (2-6) determines a specific magnitude parameter, such as average, volume or peak, for each of the several entities. A scaling routine (2-8) scales the data arrays between entities such that the specific magnitude parameters are suppressed and only their shape is maintained. A training routine (2-10) trains a clustering system with a first plurality of the scaled data arrays, to determine a set of cluster centers. After training, a clustering routine (2-12) applies a second plurality of the scaled data arrays to the trained clustering system.

Abstract: Apparatus including functionality configured to monitor said apparatus for security attacks; and a reporter configured to send data to a security node, wherein the data sent to said security node is dependent on a security level of said apparatus.

Abstract: A method and system for parsing textual report data found in free-text fields is disclosed. The textual report data may be included in log files that document a systems operation. A message template is created from reports or log data and used to automate the parsing of these variable data fields.

Abstract: In a computerized system, a frequent pattern is provided from patterns of data. A first checksum is then assigned for the frequent pattern. Upon an occurrence of the frequent pattern in data, a second checksum is computed based on information regarding the first checksum and information regarding the occurrence of the frequent pattern in the data.

Abstract: A data processing system processes data arrays that collectively describe cyclic behavior of at least one variable in several entities in a physical process. Each cycle comprises several time slots. An input routine (2-4) receives multiple data arrays, each data array containing multiple data items, each of which describes a variable of an entity in one time slot. A magnitude-determination routine (2-6) determines a specific magnitude parameter, such as average, volume or peak, for each of the several entities. A scaling routine (2-8) scales the data arrays between entities such that the specific magnitude parameters are suppressed and only their shape is maintained. A training routine (2-10) trains a clustering system with a first plurality of the scaled data arrays, to determine a set of cluster centers. After training, a clustering routine (2-12) applies a second plurality of the scaled data arrays to the trained clustering system.

Abstract: The invention discloses a method, a system and a computer program for storing data on a database in a manner that the integrity and authenticity of the database can be verified later. According to the invention a data record is signed with a checksum that is computed from the previous checksum, the data record to be stored and a storage key.

Abstract: The present invention relates to a method and apparatus for compressing a log record information provided e.g. to a monitoring system. Frequent patterns in the log information are detected and, then, redundant frequent patterns whose value or record combination is a subset of a value or record combination of another one of said detected frequent patterns are removed. Accordingly, a general method is provided which can be applied to all event logs arising from communication net-works or other monitoring systems. The detection of frequent patterns is only based on value or record combinations and is thus independent of the specific application. On the other hand, the size of the stored log files can be decreased remarkably while remaining readable for human beings.

Abstract: The invention proposes a method for configuring a network, wherein the network comprises a plurality of network sections, the method comprising the steps of accessing (S2) data from network sections; forming (S3) groups of network sections using a clustering method by using at least part of the accessed data as input data; and processing (S4) parameter on network section group level. By this method, the operation load during optimising a network consisting of a large number of cells can be greatly reduced. The invention also proposes a corresponding network optimising system.

Abstract: The invention relates to a method and system for monitoring the behaviour of at least one observable object, e.g. a network element, of a network, wherein at least one parameter of the observable object is repeatedly detected. An actually detected parameter is input to a learning process and to an analyzing process, wherein the learning process forms a reference, based on at least two detected parameter values, for describing the behaviour of the observable object. The analyzing process compares the input parameter and the reference for detecting an anomal behaviour.

Abstract: A method for teaching an anomaly detecting mechanism in a system comprising observable elements (302), at least one of which has a periodic time-dependent behaviour, the anomaly detecting mechanism comprising a computerized learning mechanism (314). The method comprises assembling indicators (304) indicating the behaviour of the elements (302) and arranging the assembled indicators such that each observable element's indicators are assigned to the same input data component. The learning mechanism (314) is taught so that the input data of the learning mechanism comprises the input data components which are based on the assembled indicators (304). Points which approximate the input data are placed in the input space. A presentation of time (420-424) is incorporated into at least one input data component wherein the presentation of time is periodic, continuous and unambiguous within the period of the at least one element with periodic time-dependent behaviour.