Abstract: A storage system comprises multiple storage apparatuses and the multiple storage apparatuses provide a host system with a virtual volume in which multiple logical volumes are virtualized into one. When a first storage apparatus has detected a first event, the first storage apparatus changes the status of a first resource. Thereafter, the first storage apparatus sends a notice of the status change with respect to a first logical volume to a second storage apparatus comprising a second logical volume which is the basis of a virtual volume associated with the first logical volume, when the first storage apparatus has detected a second event which signifies that the host system is informed, in the future, of the status of the first resource. The second storage apparatus receives the notice and configures the status change based on the received notice.

Abstract: An apparatus comprises a processing platform configured to implement an analytic engine for evaluation of at least one of a converged infrastructure environment and one or more components of the converged infrastructure environment. The analytic engine comprises an extraction module configured to extract one or more features corresponding to the converged infrastructure environment, a learning and modeling module configured to predict an expected quantitative performance value of at least one of the converged infrastructure environment and the one or more components of the converged infrastructure environment based on the extracted one or more features, and comparison and ranking modules. The comparison module is configured to calculate a difference between an actual quantitative performance value of at least one of the converged infrastructure environment and the one or more components of the converged infrastructure environment and the expected quantitative performance value.

Abstract: This disclosure relates generally to data processing, and more particularly, to methods and systems for determining an equipment operation based on historical data. In one embodiment, a hardware processor-implemented method for facilitating an operation of a device is provided. The method comprises: receiving an indication of an operation problem for a first device; acquiring historical operation data of a plurality of devices including the first device, the historical operation data including structured data and unstructured data; determining at least a list of first entities and a list of second entities based on the structured data; determining a set of entity associations, each entity association including at least one of the first entities and at least one of the second entities; determining one or more relationships between each of the entity associations; and determining, based on the one or more determined relationships, an operation solution to solve the operation problem.

Abstract: An expert system extracts events associated with executing an application from log files generated by various topological resources in a distributed computing environment. The events are plotted as plot points on a time series graph. Patterns are identified in the plot points that are associated with application problems, along with the computing environment configurations both before the problem and after the problem was resolved. The difference in the configurations represents a corrective action for the application problem, and the expert system links the corrective action to the pattern. When a pattern repeats in conjunction with another application problem, the corrective action is identified as a possible solution to the new problem. A confidence level associated with the pattern/corrective action may be increased when a user accepts the corrective action and may be decreased when a user rejects the corrective action.

Abstract: A method is disclosed that estimates causal relationships between events based on heterogeneous monitoring data. The monitoring data consists in transaction tracing data, describing the execution performance of individual transactions, resource utilization measurements of infrastructure entities like processes or operating systems and network utilization measurement data. A topology model of the monitored environment describing its entities and the communication activities of these entities is incrementally created. The location of occurred events in the topology model is determined. The topology model is used in conjunction with a domain specific causality propagation knowledge base to calculate the possibility of causal relationships between events. Different causality determination mechanisms, based on the type of involved events are used to create graphs of causal related events.

Abstract: Embodiments provide a fault management method, which can implement fault reporting and processing in an NFV environment. The method includes acquiring first fault information, including a faulty entity identifier and a fault type, of a network functions virtualization infrastructure NFVI entity, where the first fault information is used to indicate that a fault occurs in a first NFVI entity having the faulty entity identifier. The method also includes generating first comprehensive fault information according to the first fault information, where the first comprehensive fault information comprises the first fault information and correlated fault information of the first fault information. The method also includes performing fault repair or reporting processing according to the first comprehensive fault information.

Abstract: A method may include determining first network data corresponding to a first time period, including alarm data and incident data collected by a set of network devices of a core network during the first time period. The method may include creating, based on the first network data, an incident prediction model. The method may include receiving second network data, associated with the core network, corresponding to a second time period. The second network data may include alarm data and incident data collected by a network device, of the set of network devices, during the second time period. The method may include generating, based on the second network data and the incident prediction model, an incident prediction that includes a prediction whether the network device will experience an incident during a third time period.

Abstract: Simulating sector changes in an application module (AM) in a wireless communications system (WCS) to simulate site walks in the WCS. The AMs are wireless telecommunication circuitry wired or wirelessly associated with wireless communications system components in a WCS. In one embodiment, the AMs are configured to determine signal information (e.g., signal strength, power and/or quality) of live communications signals in a WCS. The measured signal strength values are then artificially changed to simulate a site walk in the WCS. For example, the signal strength of communication signals received by an AM from a particular sector can be artificially lowered so that the signal strength from a neighboring sector located further away from the AM appears to be stronger. In this manner, a site walk of the AM in the sectors in which communications signals are received by the AM in the WCS can be simulated.

Abstract: A method performed by a print service provider (PSP) for printing, including: (a) obtaining from a network a print job issued by a user mobile device and specifying a printer feature; (b) obtaining a location of the user mobile device; (c) determining a first printer having the printer feature and located within a predetermined distance of the location of the user mobile device; (d) sending a notification identifying the first printer to the user mobile device; (e) checking if a confirmation for the first printer issued by the user mobile device is obtained; (f) if the confirmation is not obtained in the step (e), repeating the steps (b) through (e); and (g) if the confirmation is obtained in the step (e), sending the print job to the first printer, where the first printer generates a hardcopy document from the print job using printer requirement.

Abstract: A workflow engine may be used to resolve service issues in a more expedient and effective manner. The workflow engine may select a troubleshooting flow to detect problems associated with a user device that uses communication services provided by a wireless telecommunication network. The workflow engine may determine alert notifications that are relevant to the troubleshooting operations. The workflow engine may make such a determination based on information from multiple data sources of the wireless telecommunication network. The workflow engine may further assign priority ratings to the alert notifications. Subsequently, a presentation layout may be assigned to the troubleshooting operations of the troubleshooting flow and the alert notifications by the workflow engine based on the priority ratings. The troubleshooting operation and the alert notifications are then provided for presentation on a computing device according to the presentation layout by the workflow engine.

Abstract: Aspects of the present disclosure provide systems and methods directed toward identifying causes of attenuated performance at computing systems. Performance data corresponding to performance metrics may be stored at a data store. Performance metrics may be associated with application servers. Alerts may be received from a performance monitoring agent triggered by performance attenuations at the application servers. A timeframe in which a performance attenuation occurred may be selected and the performance data may be searched in order to identify another performance attenuation that occurred at one of the application servers during or before the selected timeframe. Performance data may be evaluated to identify one of the application servers associated with the additional performance attenuation as a potential source of the performance attenuation that triggered the alert.

Abstract: Methods, systems, and media for detecting covert malware are provided. In accordance with some embodiments, a method for detecting covert malware in a computing environment is provided, the method comprising: receiving a first set of user actions; generating a second set of user actions based on the first set of user actions and a model of user activity; conveying the second set of user actions to an application inside the computing environment; determining whether state information of the application matches an expected state after the second set of user actions is conveyed to the application; and determining whether covert malware is present in the computing environment based at least in part on the determination.

Abstract: Provided are a computer program product, system, and method for processing main cause errors and sympathetic errors in devices in a system. Error data for the devices in the system are analyzed to determine a main cause error for one of the devices that cause at least one sympathetic error in the system. A main cause event object for the determined main cause error and at least one sympathetic event object for the determined at least one sympathetic error resulting from the main cause error are generated. A determination is made from the at least one sympathetic event object of at least one sympathetic event action to perform. The determined at least one sympathetic event action is performed to recover from the at least one sympathetic error represented by the at least one sympathetic event object providing the at least one sympathetic event action.

Abstract: Machines, systems and methods for enhancing data recovery in a data storage system, the method comprising determining whether one or more data storage mediums in a data storage system are unavailable; determining data that are at a risk of loss, due to said one or more data storage mediums being unavailable; from among the data that is determined to be at the risk of loss, identifying data that is highly vulnerable to loss; and creating one or more temporary replicas of the data that is highly vulnerable to loss.

Abstract: A computer executes a first version of a code module in a first test environment, collects a first set of execution measurements, and creates a first profile based on the first set of execution measurements. The computer executes the first version of the code module in a second test environment, collects a second set of execution measurements, and creates a second profile based on the second set of execution measurements. In response to a difference between the first profile and the second profile exceeding a threshold, the computer provides diagnostic data characterizing the difference, analyzes an impact of the difference on the execution of the code module, calculates a risk of code module failure value based on analyzing the impact of the difference, and provides a recommended action based on analyzing the impact of the difference and the calculated risk of code module failure value.

Abstract: System component failure diagnosis is provided. In response to determining that a number of component failure cases corresponding to a complex system stored in a historical diagnosis database is less than a pre-defined threshold number of component failure cases, a system component failure root cause is predicted using a rule-based reasoning method. In response to determining that the number of component failure cases corresponding to the complex system is greater than or equal to the pre-defined threshold number of component failure cases, the system component failure root cause is predicted using the rule-based reasoning method and a machine learning method. The diagnosis accuracy of the system component failure root cause predicted by the rule-based reasoning method and the machine learning method is calculated using a cross-validation method. The performance of the rule-based reasoning method and the machine learning method is evaluated using a statistical process control method.

Abstract: According to various example embodiments, a request transmitted from a client and directed to a service application is intercepted. A logical database (DB) host specified by a hint value included in the request is then identified. Moreover, a target physical DB host is identified, based on the identified logical DB host and DB host mapping information. Thereafter, the request is routed to an instance of the service application co-located with the identified target physical DB host at a particular data center.

Abstract: Techniques for detecting malicious content using simulated user interactions are described herein. In one embodiment, a monitoring module monitors activities of a malicious content suspect executed within a sandboxed operating environment. In response to detection of a predetermined event triggered by the malicious content suspect requesting a user action on a graphical user interface (GUI) presented by the malicious content suspect, simulating, a user interaction module simulates a user interaction with the GUI without user intervention. An analysis module analyzes activities of the malicious content suspect in response to the simulated user interaction to determine whether the malicious content suspect should be declared as malicious.

Abstract: From an error information containing a content of a correctable error that has occurred in a controller of a failure prediction system and an ID of the controller and manufacturing information of a machine to which the controller is attached, a failure of a controller belonging to a group of controllers in which such an error as indicated in the error information has not occurred yet is predicted.

Abstract: Attempts to make code secure often are associated with performance penalties. To facilitate striking an acceptable balance between performance and security, vulnerable areas of source code are identified. The vulnerable areas are examined for areas that are actually safe and the safe areas are filtered from the universe of code that receives security mitigations. The remaining code receives security mitigations appropriate to the level of risk of the code.

Abstract: A device may determine use case information associated with a use case for a development project. The device may determine a set of use case objects associated with the use case based on the use case information. The device may select an abstract machine model. The abstract machine model may be associated with modeling the development project based on the set of use case objects. The abstract machine model may be selected from a set of abstract machine models associated with modeling development projects. The device may generate program code for the development project based on the abstract machine model and the use case information. The device may provide information associated with the generated program code.

Abstract: A method of assistance for troubleshooting is provided. A purpose is to prioritize identifiers each associated with a piece of equipment the failure of which can be the cause of a fault within an aircraft. The method is based on transmitting to an expert system, a list of identifiers, and receiving, for each identifier, a family of pertinent parameters, with each pertinent parameter being associated with at least one sensor of the aircraft and taking measurements of the pertinent parameters. Knowing these measurements, it is possible to deduce therefrom, for each identifier, a priority corresponding to the probability that the associated equipment is effectively defective. A system for implementing this method is also provided.

Abstract: In response to a test case error generated by execution of a test case against a code build, a source code segment that caused the test case error is identified by a defect monitor. The identified source code segment is linked to the test case that generated the test case error. The linked source code segment is monitored for code changes. A determination is made as to whether a test case re-execution criterion associated with the test case has been satisfied based upon a detected code change of the linked source code segment. An indication to re-execute the test case is generated in response to determining that the test case re-execution criterion associated with the test case has been satisfied.

Abstract: A runtime classifier hardware circuit is incorporated into an electronic device for implementing hardware security by storing a support vector model in memory which is derived from pre-silicon verification data to define secure behavior for a first circuit on the electronic device; monitoring input and/or output signals associated with the first circuit using the runtime classifier hardware circuit which compares the input and/or output signals to the support vector model to detect an outlier input signal and/or outlier output signal for the first circuit; and blocking the outlier input and/or output signal from being input to or output from the first circuit.

Abstract: Novel solutions for detecting and/or treating malware on a subscriber's premise network. Such solutions can include, but are not limited to, tools and techniques that can detect, and/or enable the detection of, malware infections on individual subscriber devices within the subscriber's network. In a particular embodiment, for example, a premise gateway, or other device on the subscriber's premise network, is configured to analyze packets traveling through the premise gateway and, based on that analysis, identify one or more subscriber devices that are infected with malware.

Abstract: A method includes receiving a plurality of metric-pattern combinations, each including a respective performance metric and a respective graph pattern. The method also includes receiving a corresponding parameter value for a parameter of each respective graph pattern. The method further includes determining an event equation comprising the plurality of metric-pattern combinations and a boolean operator. The method still further includes evaluating the event equation by determining a respective graph pattern fit curve by applying the corresponding parameter value to the respective graph pattern, and determining an operand value based on whether associated performance data for the respective performance metric exhibits the associated graph pattern by matching the respective graph pattern fit curve to the associated performance data. Evaluating the operand values using the boolean operator to determine a result. The method additionally includes displaying a notification, at a user interface, based on the result.

Abstract: Multi-data analysis based proactive defect detection and resolution may include analyzing operational data for an application to determine whether a functionality related to the application is below a predetermined threshold associated with the functionality related to the application, and based on the analysis, generating an indication to perform defect analysis related to the functionality related to the application. A sentiment analysis may be performed on consumer data related to the application to determine a sentiment of the consumer data related to the application, and a natural language processing (NLP) analysis may be performed on the consumer data related to the application to determine a function associated with a negative sentiment. Application code and process data related to the application may be analyzed to determine a defect associated with the application. Further, a code of the application may be modified to correct the defect associated with the application.

Abstract: An operation management to grasp a metric in which a continuous abnormality has occurred in a system, easily, is provided. An operation management apparatus 100 includes a metric collection unit (101) and an abnormality score calculation unit (104). The metric collection unit (101) collects a measured value of each of a plurality of metrics in a system sequentially. The abnormality score calculation unit (104) calculates and outputs, on the basis of a continuity level indicating a degree of continuity of an abnormality of the measurement value for each of the plurality of metrics at each time, an abnormality score for the metric.

Abstract: In accordance with the present disclosure, a system and method are herein disclosed for providing in-service diagnostics based on health signatures of an information handling system. In one embodiment, the health of an information handling system is periodically probed by a software agent running as a service. The service polls a set of probes from interfaces on the host system and tracks parameters indicative of system and component health and performance. An analytics engine processes the data to identify anomalies and outliers, and to detect signatures that are precursors to potential service incidents. A rule set matches signatures to potential actions. Based on the detected signatures and rule sets, the service is operable to select, schedule, and execute one or more diagnostic tests. If an information handling system or component thereof fails a diagnostic test, the results are archived to persistent storage and communicated to an administrator.

Abstract: Certain examples described herein provide a system and method for validating a routing function for a network device. In one example, a network device has a run-time policy engine, wherein the run-time policy engine implements a routing configuration file and the routing configuration file defines a routing function for network traffic. A file editor is also provided that loads the routing configuration file. The file editor has an editor policy engine that duplicates a functionality of the run-time policy engine. In one example, the routing configuration file has at least one validation portion that has one or more route statements with definitions indicative of expected routing function behavior. The file editor parses the routing configuration file by implementing the routing configuration file using the editor policy engine.

Abstract: Systems, apparatuses, and methods for automatic automated electronic computing and communication system event analysis and management are disclosed. Automatic automated electronic computing and communication system event analysis and management may include identifying an event, generating a computer readable representation of the electronic computing and communication system using automated topology enumeration, identifying an element of the electronic computing and communication system based on the representation, identifying a metric for the element, automatically investigating to determine a value for the metric, generating a remediation priority for the element based on a metric weight associated with the metric and a network layer value associated with a network layer associated with a network layer role associated with the element, and generating a graphical representation of the electronic computing and communication system indicating the remediation priority.

Abstract: A method and system to verify active content at a server system include receiving, at the server system a communication (e.g., an e-mail message or e-commerce listing) that includes active content that is to be made accessible via the server system. At the server system, the active content is rendered to generate rendered active content. The rendered active content presents a representation of information and processes to which an end user will be subject. At the server system, the rendered active content is verified as not being malicious.

Abstract: Systems and techniques for obtaining and maintaining maintenance records for various assets are described. In one embodiment, a computing device may be wirelessly coupled to a measurement device when the computing device is placed in proximity with the computing device. Upon measuring one or more parameters of a device under test (DUT), the measurement device may provide the measured parameters to the computing device in the form of measurement data. In some embodiments, the computing device associates the measured parameters with the corresponding DUT from which the measurements were obtained and provides the associated measured parameter to, for example, a service provider for future access. In another embodiment, the measurement device itself is configured to associate the measurement parameters with the DUT and provide the associated measurement parameters to the service provider.

Abstract: Methods, systems, and devices are described for providing proactive cloud orchestration services for a cloud hardware infrastructure. A health management system may monitor component(s) of the cloud hardware infrastructure. The health management system may determine a failure probability metric for the component(s) based on the monitoring of the component and in consideration of historical information associated with the component, or similar components. The health management system may determine an optimization strategy for the component and, when an optimization decision has been reached, initiate a reconfiguration procedure to implement the optimization strategy. The optimization strategy may provide for mitigating or eliminating the consequences of the component failure associated with data loss, downtime, and the like.

Abstract: In order to perform system-capability testing, an application in an application layer may provide predefined system capabilities and/or requirements of or associated with the application to a communication plugin in a data-link layer, such as availability of communication via a network and/or a latency of the network less than a predefined value. In response, the communication plugin may determine feedback information that specifies whether the predefined system capabilities are available and whether the predefined requirements are satisfied. Then, the communication plugin may provide the feedback information to the application. When the feedback information indicates that a system capability is unavailable, remedial action may be performed. For example, the remedial action may include updating a version of the application, updating a version of the communication plugin, and/or updating a path to a location in a network.

Abstract: Methods of detecting anomalous behaviors associated with a fabric are presented. A network fabric can comprise many fungible networking nodes, preferably hybrid-fabric apparatus capable of routing general purpose packet data and executing distributed applications. A nominal behavior can be established for the fabric and represented by a baseline vector of behavior metrics. Anomaly detection criteria can be derived as a function of a variation from the baseline vector based on measured vectors of behavior metrics. Nodes in the fabric can provide a status for one or more anomaly criterion, which can be aggregated to determine if an anomalous behavior has occurred, is occurring, or is about to occur.

Abstract: The present invention provides a fault prediction and condition-based repair method of an urban rail train bogie. An optimum service life distribution model of a framework, a spring device, a connecting device, a wheel set and axle box, a driving mechanism, and a basic brake device of a bogie is determined by adopting a method based on survival analysis; a reliability characteristic function of each subsystem is obtained; then, a failure rate of each subsystem of the bogie is calculated by adopting a neural network model optimized by an evolutionary algorithm; and finally, proportional risk modelling is conducted by taking the failure rate and safe operation days of each subsystem of the bogie as concomitant variables; and on the basis of cost optimization, thresholds and control limits for condition-based repair of a bogie system are obtained.

Abstract: A computing device processor may be configured with processor-executable instructions to implement methods of using behavioral analysis and machine learning techniques to evaluate the collective behavior of two or more software applications operating on the device. The processor may be configured to monitor the activities of a plurality of software applications operating on the device, collect behavior information for each monitored activity, generate a behavior vector based on the collected behavior information, apply the generated behavior vector to a classifier model to generate analysis information, and use the analysis information to classify a collective behavior of the plurality of software applications.

Abstract: The system may include a troubleshooting activity recorder configured to record troubleshooting sessions. Each troubleshooting session may include a sequence of queries and query results. The troubleshooting activity recorder may include a query transformer configured to transform the queries and the query results into transformed queries and transformed query results before recording the troubleshooting sessions. The troubleshooting activity recorder may be configured to record the transformed queries and the transformed query results as troubleshooting session information in a troubleshooting activity database. The system may include a troubleshooting pattern learning unit including a graph builder configured to generate a troubleshooting pattern graph having query nodes and links between the query nodes based on the troubleshooting session information.

Abstract: Service issues predicted by detecting anomalies in an event signal is provided. An application such as a signal analysis application receives an event signal for analysis. The event signal includes events captured during a time period. The event signal is processed to generate a trend line. The trend line includes a best fit line transposed across averages of number of events of each data point across the time period. The number of events of an end data point may be compared to an upper confidence score and a lower confidence score associated with the end data point on the trend line. In response to detecting the number of events of the end data point exceed the upper confidence score, a notification is transmitted to a stakeholder associated with the event signal. The notification may describe a symptom associated with the number of events on the end data point.

Abstract: A failure analysis of a cloud based service is provided using synthetic measurements of the cloud based service. The synthetic measurements associated with a customer experience is executed on the cloud based service to determine a health of the cloud based service. The synthetic measurements simulate the customer experience which includes a use scenario of a customer of the cloud based service. Failures associated with the health of the cloud based service are aggregated, where the failures are detected from the synthetic measurements. A distribution is generated from the failures. The distribution is presented to a stakeholder.

Abstract: A self-adjusting calibrator is provided. The calibrator may include a calibrator datastore. The calibrator datastore may store assimilated performance data. The assimilated performance data may relate to a collection of configuration items. The calibrator datastore may also store performance metrics. The performance metrics may map historic error events in a system to a plurality of configuration items. The calibrator may also include an optimal value computation engine. The optimal value computation engine may be in communication with the calibrator datastore. The optimal value computation engine may determine an optimal threshold value for each configuration item in the collection of configuration items. The optimal threshold value may enable a receiver, which may be associated with calibrator datastore, to receive true error event information that occurred in the system. The optimal threshold value may also prevent the receiver from receiving false error event information that occurred in the system.

Abstract: A technique for communicating in a network management system is disclosed. The technique includes transferring information from an application server to a gateway that processes the information, transferring the gateway processed information from the gateway to a plurality of adapters associated with the gateway that process the gateway processed information, and transferring the adapter processed information from one of the adapters to a client.

Abstract: A system analysis device 100 includes a whole model generation unit 1021 which generates a whole model which is obtained by modeling elements or whole of a system and which includes a plurality of partial models, a core model generation unit 1023 which extracts, from a plurality of whole models generated on the basis of the same event, the partial models whose prediction precision satisfies a predetermined criteria, and generates a core model by integrating the extracted partial models, and a threshold setting unit 1024 which calculates a distance between the core model and the plurality of whole models using a predetermined definition, and outputs the distance as a threshold value for error determination using the core model.

Abstract: A first electronic message collector collects electronic messages travelling on a first network and stores the electronic messages in a first storage. A second electronic message collector collects electronic messages travelling on a second network and stores the electronic messages in a second storage. An electronic message associator retains a mapping table in which the correlation, or similar, between electronic messages travelling from the first network to a gateway device and electronic messages travelling from the gateway device the second network are defined. The electronic message associator references the mapping table and associates the electronic messages stored in the second storage with the electronic messages stored in the first storage. From the result of the above-mentioned association, a status analyzer determines whether or not receipt of electronic message between the first network and the second network is accomplished normally.

Abstract: The disclosed embodiments provide a system that analyzes telemetry data from a computer system. During operation, the system obtains the telemetry data, which includes first information containing telemetric signals gathered using sensors in the computer system and second information that indicates one or more transaction latencies of software running on the computer system. Upon detecting an upward trend in the one or more transaction latencies, the system analyzes the telemetry data for a correlation between the one or more transaction latencies and one or more environmental factors represented by a subset of the telemetric signals. Upon identifying the correlation between the one or more transaction latencies and an environmental factor, the system stores an indication that the environmental factor may be contributing to the upward trend in the one or more transaction latencies.

Abstract: Systems and methods are provided for automatically provisioning resources based on application characteristics. In accordance with an embodiment, a system can include a computer, including a computer readable medium and processor, and a template engine, executing on the computer. The template engine is configured to receive applications and associated metadata. The system can also include a virtualized environment, and a plurality of templates, each defining a different resource available within the virtualized environment. When the template engine receives an application and associated metadata, the template engine determines resource requirements for the application based on the associated metadata, compares the resource requirements with the plurality of templates, identifies appropriate templates for the resource requirements, and provisions resources in the virtualized environment using the appropriate templates.

Abstract: A method provides a debug service in a network environment. One or more processors initiate a debug service as a remote shared service in the network environment. The debug service receives a call from a deployed workload process within a virtual machine in the network environment, and gathers required information for a debug session of the workload process, where the required information includes source code used by the workload process. One or more processors attach the debug service to the workload process to carry out the debug session, such that the debug service working with a debug agent at the workload process attaches to and debugs a virtual environment that obscures the virtual machine.

Abstract: A computer-implemented method, a system, and a network include receiving network data from a network and non-network sourced data from one or more external sources relative to the network; performing data mining on the network data and the non-network sourced data; developing a predictive analytics model based on the data mining; and performing predictive analytics on the network data and the non-network sourced data using the predictive analytics model to detect likely future failures in the network. The network can include a Software Defined Network (SDN) operating at any of Layers 0, 1, 2 and/or 3.

Abstract: Plural clusters or occurrences of a pattern of event types are identified (304). Based on configuration items relating to events associated with the event types, a correlation rule is created (308) to define a relationship between the event types.