A new adaptive evidential reasoning approach for network alarm correlation

Abstract

In computer networks, fault detection and identification techniques rely substantially on analyzing a set of observed alarms generated by different network entities due to unknown failures. However, network alarms are subject to becoming lost and spurious and their information is often incomplete, ambiguous, and inconsistent. In this paper, an adaptive distributed Dempster-Shafer evidential reasoning technique is proposed to effectively reduce the negative impact of the uncertainty properties which network alarms can exhibit. Each observed alarm is perceived as a piece of evidence and as such, the incomplete and ambiguous properties can be tackled within the framework of the evidential theory. A discounting mechanism by which the observed alarms are assigned certain weights is also presented. A given weight reflects the significance of the information in the corresponding alarm. Then, the alarms are correlated by the Dempster's rule of combination and the inconsistent alarms play a limited role in the alarm correlation process since they are given lower weights. Simulations confirm that the proposed scheme has a high detection rate even in the presence of defective alarms.