Method and apparatus in a data processing system for managing situations from correlated events

1. A method in a data processing system for handling a situation, the method comprising:

responsive to detecting a situation, selecting an aging function from a plurality of aging functions based on the detected situation, and applying the selected aging function to the situation; and

presenting alerts regarding the situation based on the aging function.

2. The method of claim 1 , wherein the aging function is an exponential decay function wherein a severity for the detected situation decreases exponentially with respect to time if any additional situations of a same type as the detected situation are not detected during such time.

3. The method of claim 1 , wherein the aging function includes a user settable threshold.

4. The method of claim 1 , wherein the aging function is an increasing time function wherein a severity for the detected situation increases with respect to time if any additional situations of a same type as the detected situation are not detected during such time.

5. The method of claim 4 , wherein the increasing time function is one of a linear function or an exponential function.

6. The method of claim 1 , wherein the aging function is a decreasing half-life function wherein a severity for the detected situation decreases by half after a given time window has elapsed if no additional situations of a same type as the detected situation are detected during such time window.

7. The method of claim 1 , wherein the aging function is a combination of a linear function and an exponential function.

8. The method of claim 1 , wherein the presenting step comprises:

displaying the alert on a console.

9. The method of claim 1 , wherein the situation is one of a denial of server, a suspicious Web server request, or an unauthorized access of a server.

10. A method in a data processing system for handling a situation that includes a set of events, the method comprising:

monitoring for events;

responsive to detecting an event, which triggers the situation, applying an aging function to the situation, wherein the aging function is used to identify a severity of the situation; and

presenting an alert for the situation based on the severity of the situation identified by the aging function, wherein a threshold at which the situation is triggered is based upon a correlation between the set of events.

11. The method of claim 10 , wherein the aging function is selected from a plurality of aging functions based on the triggered situation.

12. The method of claim 11 , wherein the correlation between the set of events is a severity of each of the events.

13. A data processing system comprising:

a bus system;

a communications unit connected to the bus system;

a memory connected to the bus system, wherein the memory includes a set of instructions; and

a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to apply an aging function to the situation in response to detecting a situation, and present alerts regarding the situation based on the aging function, wherein the aging function is selected from a plurality of aging functions based on the detected situation.

14. A data processing system for handling a situation, the data processing system comprising:

applying means, responsive to detecting a situation, for selecting an aging function from a plurality of aging functions based on the detected situation, and applying the selected aging function to the situation; and

presenting means for presenting alerts regarding the situation based on the aging function.

15. The data processing system of claim 14 , wherein the aging function is a an exponential decay function wherein a severity for the detected situation decreases exponentially with respect to time if any additional situations of a same type as the detected situation are not detected during such time.

16. The data processing system of claim 14 , wherein the aging function includes a user settable threshold.

17. The data processing system of claim 14 , wherein the aging function is an increasing time function wherein a severity for the detected situation increases with respect to time if any additional situations of a same type as the detected situation are not detected during such time.

18. The data processing system of claim 17 , wherein the increasing time function is one of a linear function or an exponential function.

19. The data processing system of claim 14 , wherein the aging function is a decreasing half-life function wherein a severity for the detected situation decreases by half after a given time window has elapsed if no additional situations of a same type as the detected situation are detected during such time window.

20. The data processing system of claim 14 , wherein the aging function is a combination of a linear function and an exponential function.

21. The data processing system of claim 14 , wherein the presenting means comprises:

means for displaying the alert on a console.

22. The data processing system of claim 14 , wherein the situation is one of a denial of server, a suspicious Web server request, or an unauthorized access of a server.

23. A computer program product in a computer readable medium for handling a situation, the computer program product comprising:

first instructions, responsive to detecting a situation, for selecting an aging function from a plurality of aging functions based on the detected situation, and applying the selected aging function to the situation; and

second instructions for presenting alerts regarding the situation based on the aging function.