Brink of failure and breach of security detection and recovery system
View Patent ↗A method and apparatus for managing a network includes detecting occurrence of a network event associated with a new network condition including unplanned and planned macro-events associated with network elements and communication links of the network. The network event is classified as being associated with at least one of a network element failure, communications link failure, and a security breach. In response to the network event exceeding a network degradation threshold, the network event is identified as a network degradation event, and an alert is sent to a network administrator to normalize the network degradation event.
1. A method for managing a network, comprising the steps of:
detecting occurrence of a network event, said network event having associated with it a network condition comprising at least one of an unplanned macro-event and a planned macro-event related to at least one of a network element and a communication link of said network;
classifying said network event as being at least one of a network element failure, a communications link failure, and a security breach; and
identifying said network event as a network degradation event in response to at least one network event exceeding a network degradation threshold, wherein said network degradation event is defined as at least one of a brink of failure (BOF) event and a breach of security (BOS) event, wherein if said network degradation event is defined as a BOF event a determination is made as to whether said BOF event also causes a BOS event, wherein if said network degradation event is defined as a BOS event a determination is made as to whether said BOS event also causes a BOF event.
2. The method of claim 1 , further comprising the step of:
sending an alert to normalize said network degradation event.
3. The method of claim 1 , wherein said network event is associated with at least one of a network management system, a security management system, and a system timer.
4. The method of claim 1 , wherein said step of identifying comprises the step of:
defining said network degradation event as a brink of failure (BOF) event in an instance where said network event is at least one of a type determined to cause a failure of at least one network element within a predetermined time interval and a type determined to cause a failure of at least one communication link within a predetermined time interval.
5. The method of claim 4 , wherein said step of identifying further comprises the step of:
defining said network degradation event as a breach-of-security (BOS) event in an instance where said network event exploits a security vulnerability resulting in at least one of an unauthorized access, an unauthorized modification or compromise, a denial of access to information, a denial of access to network monitoring capability, and a denial of access to network control capability.
6. The method of claim 5 , further comprising the steps of:
reporting at least one of said BOF event and BOS event.
7. The method of claim 6 further comprising the steps of:
categorizing said BOF event;
determining at least one corrective action procedure associated with said BOF event; and
reporting at least one of a network element and a communications link associated with said BOF event, and said at least one corrective action procedure.
8. The method of claim 7 , wherein said step of determining at least one corrective action procedure comprises the step of assessing a BOF database comprising historical information associated with global network reliability practices.
9. The method of claim 6 , wherein in an instance where said network degradation event is associated with a BOS event, said method further comprises the steps of:
categorizing said BOS event;
determining at least one corrective action procedure associated with said
BOS event; and
displaying at least one of a network element and a communications link associated with said BOS event, and said at least one corrective action procedure.
10. The method of claim 9 , wherein said step of determining at least one corrective action procedure comprises the step of assessing a Security Vulnerabilities and Procedures database comprising at least one of historical information of said network and associated global security vulnerabilities and procedures.
11. The method of claim 6 further comprising the steps of:
initiating a new network event upon resolving said network degradation event;
removing said network degradation event from said existing conditions database; and
reporting said network degradation event as a resolved event.
12. The method of claim 11 , wherein resolving said network degradation event further comprises at least one of:
resolving said BOF event, such that the BOF event and a BOS condition are cleared; and
resolving said BOS event, such that the BOS event and a BOF condition are cleared.
13. The method of claim 4 , wherein said step of defining said network degradation event as a brink-of-failure (BOF) event further comprises the step of:
correlating network events stored in an existing conditions database with information stored in said a network topology database and events stored in a scheduled events database.
14. The method of claim 1 , wherein said step of identifying said network degradation event comprises the step of:
assessing at least one of failure rates, mean-time-between-failures (MTBF), mean-time-to-repair (MTTR), and spare parts availability for at least one of network elements and communication links associated with said network event.
15. The method of claim 1 , wherein in response to the step of classifying said network event, said method further comprises the steps of:
updating an existing conditions database with indicia of said network event;
determining a latest network topology associated with said network event; and
updating a network topology database with said latest network topology.
16. The method of claim 1 , wherein said step of identifying a network event comprises the step of identifying events associated with at least one of end-user data traffic, in-band control traffic, out-of-band control traffic, in-band network management traffic, and out-of-band network management traffic.
17. A method for managing a network, comprising the steps of:
detecting occurrence of a network event, said network event having associated with it a network condition comprising at least one of an unplanned macro-event and a planned macro-event related to at least one of a network element and a communication link of said network;
classifying said network event as being at least one of a network element failure, a communications link failure, and a security breach;
identifying said network event as a network degradation event in response to at least one network event exceeding a network degradation threshold by defining said network degradation event as a brink of failure (BOF) event in an instance where said network event is at least one of a type determined to cause a failure of at least one network element within a predetermined time interval and a type determined to cause a failure of at least one communication link within a predetermined time interval;
determining whether said BOF event also causes a BOS event; and
sending an alert to normalize said network degradation event.
18. The method of claim 17 , wherein said step of identifying further comprises the step of:
defining said network degradation event as a breach-of-security (BOS) event in an instance where said network event exploits a security vulnerability resulting in at least one of an unauthorized access, an unauthorized modification or compromise, a denial of access to information, a denial of access to network monitoring capability, and a denial of access to network control capability.
19. The method of claim 18 , wherein in response to the step of classifying said network event, said method further comprises the steps of:
updating an existing conditions database with indicia of said network event;
determining a latest network topology associated with said network event; and
updating a network topology database with said latest network topology.
20. The method of claim 18 , further comprising the steps of:
determining whether said BOS event also causes a BOF event; and
reporting at least one of said BOF event and BOS event.
21. The method of claim 20 further comprising the steps of:
categorizing said BOF event;
determining at least one corrective action procedure associated with said BOF event; and
reporting at least one of a network element and a communications link associated with said BOF event, and said at least one corrective action procedure.
22. The method of claim 20 , wherein in an instance where said network degradation event is associated with a BOS event, said method further comprises the steps of:
categorizing said BOS event;
determining at least one corrective action procedure associated with said BOS event; and
displaying at least one of a network element and a communications link associated with said BOS event, and said at least one corrective action procedure.
23. The method of claim 20 , further comprising the steps of:
initiating a new network event upon resolving said network degradation event;
removing said network degradation event from said existing conditions database; and
reporting said network degradation event as a resolved event.
24. Apparatus for managing a network, comprising:
means for detecting occurrence of a network event, said network event having associated with it a network condition comprising at least one of an unplanned macro-event and a planned macro-event related to at least one of a network element and a communication link of said network;
means for classifying said network event as being at least one of a network element failure, a communications link failure, and a security breach;
means for identifying said network event as a network degradation event in response to at least one network event exceeding a network degradation threshold, wherein said network degradation event is defined as at least one of a brink of failure (BOF) event and a breach of security (BOS) event;
means for determining whether a network degradation event defined as a BOF event also causes a BOS event; and
means for determining whether a network degradation event defined as a BOS event also causes a BOF event.
25. The apparatus of claim 24 , further comprising:
means for sending an alert to normalize said network degradation event.
26. The apparatus of claim 24 , wherein said means for identifying comprises:
means for defining said network degradation event as a brink of failure (BOF) event in an instance where said network event is at least one of a type determined to cause a failure of at least one network element within a predetermined time interval and a type determined to cause a failure of at least one communication link within a predetermined time interval.
27. The apparatus of claim 26 , wherein said means for identifying further comprises:
means for defining said network degradation event as a breach-of-security (BOS) event in an instance where said network event exploits a security vulnerability resulting in at least one of an unauthorized access, an unauthorized modification or compromise, a denial of access to information, a denial of access to network monitoring capability, and a denial of access to network control capability.
28. The apparatus of claim 27 , further comprising:
means for reporting at least one of said BOF event and BOS event.
29. The apparatus of claim 28 further comprising:
means for categorizing said BOF event;
means for determining at least one corrective action procedure associated with said BOF event; and
means for reporting at least one of a network element and a communications link associated with said BOF event, and said at least one corrective action procedure.
30. The apparatus of claim 28 , wherein said apparatus further comprises:
means for categorizing, in an instance where said network degradation event is associated with a BOS event, said BOS event;
means for determining at least one corrective action procedure associated with said BOS event; and
means for displaying at least one of a network element and a communications link associated with said BOS event, and said at least one corrective action procedure.
31. The apparatus of claim 28 further comprising:
means for initiating a new network event upon resolving said network degradation event;
means for removing said network degradation event from said existing conditions database; and
means for reporting said network degradation event as a resolved event.
32. The apparatus of claim 31 , wherein resolving said network degradation event further comprises at least one of:
means for resolving said BOF event, such that the BOF event and a BOS condition are cleared; and
means for resolving said BOS event, such that the BOS event and a BOF condition are cleared.
33. The apparatus of claim 24 , wherein said means for classifying further comprises:
means for updating an existing conditions database with indicia of said network event;
means for determining a latest network topology associated with said network event; and
means for updating a network topology database with said latest network topology.
34. A network management system for characterizing at least one network degradation event in a communications network, comprising:
a processing unit having access to at least one storage device;
at least a portion of said at least one storage device having a program product configured to:
detect occurrence of a network event, said network event having associated with it a network condition comprising at least one of an unplanned macro-event and a planned macro-event related to at least one of a network element and a communication link of said network;
classify said network event as being at least one of a network element failure, a communications link failure, and a security breach; and
identify said network event as a network degradation event in response to at least one network event exceeding a network degradation threshold, wherein said network degradation event is defined as at least one of a brink of failure (BOF) event and a breach of security (BOS) event, wherein if said network degradation event is defined as a BOF event a determination is made as to whether said BOF event also causes a BOS event, wherein if said network degradation event is defined as a BOS event a determination is made as to whether said BOS event also causes a BOF event.