Automatic alarm correlation for fault identification

In communication networks, a large number of alarms exist to signal any abnormal behavior of the network. As network faults typically result in a number of alarms, correlating these different alarms and identifying their source is a major problem in fault management. The alarm correlation problem is of major practical significance. Alarms that have not been correlated may not only lead to significant misdirected efforts, based on insufficient information, but may cause multiple corrective actions (possibly contradictory) as each alert is handled independently. The paper proposes a general framework to solve the alarm correlation problem. The authors introduce a new model for faults and alarms based on probabilistic finite state machines. They propose two algorithms. The first one acquires the fault models starting from possibly incomplete and incorrect date. The second one correlates alarms in the presence of multiple faults and noisy information. Both algorithms have polynomial time complexity, use an extension of the Viterbi algorithm to deal with the corrupted data, and can be implemented in hardware. As an example, they are applied to analyse faults using data generated by the ANS (Advanced Network and Services, Inc.)/NSF T3 network.