Adative correlation time window

Event correlation plays a key role in network management. It is the ability in networkmanagement systems to co-relate events by reading into event attributes and extractingmeaningful information that has value to network operators. It is a conceptual interpretation ofmultiple events such that a new meaning is assigned to these events. This interpretation is usedto pinpoint the events that are behind a root cause incident. The root cause could be a faultynode or an underperforming link. Understanding correlation patterns can potentially helpidentify and localize the root cause of a problem in a network so that network operators takenecessary actions to issue restoration operations. An important technique used by event correlators is temporal correlation of events,whereby events closely related in time with each other are correlated. This technique uses acorrelation time window as an interval in time to capture and correlate events. Traditionally,event correlators have used a fixed-sized correlation time window to perform event correlationin which the size of the correlation time window is fixed. However, this does not scale properlyin modern networks where dynamic relationships are commonplace. To address this issue, thisthesis presents and discusses the idea of an adaptive correlation time window, whereby thewindow size is dynamically calculated based on observable network conditions and processingtimes. The aim of the investigation is to explore the performance of an adaptive window inseveral network scenarios and, more importantly, to compare both types of windows in termsof their performance. To do this, several experiments were designed and performed on avirtualized network test bed. The results of such experiments demonstrate that the adaptivecorrelation time window adequately adapts to varying network conditions. The investigationalso shows the conditions that need to be fulfilled in order to observe a better performance ofeither type of window