Automatic Alarm Correlation for Fault Identification *

Abstract In communication networks, a large number of alarms exist to signal any abnormal behavior of the network. As network faults typically result in a number of alarms, correlating these different alarms and identifying their source is a major problem in fault management. The alarm correlation problem is of major practical significance. Alarms that have not been correlated may not only lead to significant misdirected efforts, based on insufficient information, but may cause multiple COTrective actions (possibly contradictory) as each alert is handled independently. This paper proposes a general framework to solve the alarm correlation problem. We introduce a new model for faults and alarms based on probabilistic finite state machines. We propose two algorithms. The first one acquires the fault models starting from possibly incomplete and incorrect data. The second one correlates alarms in the presence of multiple faults and noisy information. Both algorithms have polynomial time complexity, use an extension of the Viterbi algorithm to deal with the corrupted data, and can be implemented in hardware. As an example, they are applied to analyze faults using data generated by the ANS (Advanced Network and Services, Inc.)/NSF T 3 network