Intelligent Search of Correlated Alarms for GSM Networks with Model-based Constraints*

Qingguo Zheng Ke Xu Weifeng Lv Shilong Ma National Lab of Software Development Environment Department of Computer Science and Engineer Beijing University of Aeronautics and Astronautics, Beijing 100083 {zqg, kexu, lwf , slma}@nlsde.buaa.edu.cn

to control the process of data mining, make the Abstract process of data mining more focus, and reduce the number of rules being generated, many researchers In order to control the process of data mining and [9,10,11] have studied putting various constraints, focus on the things of interest to us, many kinds of including Boolean expressions, regular expressions, constraints have been added into the algorithms of and aggregation constraints etc., into the methods of data mining. However, discovering the correlated mining association rules. But the analysis of alarm alarms in the alarm database needs deep domain correlation will need deep domain constraints into the constraints. Because the correlated alarms greatly method of data mining, for the rules of alarm depend on the logical and physical architecture of correlation are closely related to the logical and networks. Thus we use the network model as the physical architecture of networks. constraints of algorithms, including Scope constraint, Model-Based Reasoning (MBR) was originally Inter-correlated constraint and Intra-correlated proposed in [12], the principles of which have been constraint, in our proposed algorithm called SMC widely applied in the analysis of alarm correlation (Search with Model-based Constraints). The [1,13,14,15,16,17]. MBR system consists of a experiments show that the SMC algorithm with network model and a function model. In the case of Inter-correlated or Intra-correlated constraint is about telecommunication networks, network model is two times faster than the algorithm with no composed of network topology and network constraints. elements. In this paper, we propose the intelligent search of Keywords correlated alarms with model-based constraints, Alarm correlation, model-based diagnosis, sequence called SMC (Search with Model-based Constraints), mining, fault management, network management which use network configuration model as constraints to discover alarm correlation rules from the alarm 1. Introduction database. We adopt three types of constraints, i.e. Scope constraint, Intra-correlated constraint and Alarm correlation [1] plays an important role in Inter-correlated constraint, according the network isolating the root cause of problems from a stream of model of GSM networks. The experiments in this alarms for networks. Modern telecommunication paper show that the algorithm of Inter-correlated networks generate a massive number of alarms, constraint is faster than the algorithm of which make the analysis of alarm correlation more Intra-correlated constraint. The algorithms of difficult than before. Many researchers look for a Inter-correlated constraint and Intra-correlated new method to solve the problem. constraint are about two times faster than the Mannila et al. [2] first studied the methods of algorithm with no constraints. mining frequent episodes in alarm sequences, which The rest of this paper is organized as follows. In has been applied into TASA system [3]. Subsequently, Section 2 we give the related works in the network many researchers [4,5] have studied adopting data management. In Section 3 we first briefly describe mining methods [2,6,7,8] to make analysis of alarm the architecture of GSM networks and then give the correlation. However, the methods of data mining for network configuration of GSM networks and define alarm correlation will generate too many rules, which the Scope, intra-correlated alarms and inter-correlated still need network administrator to distinguish the alarms. Section 4 gives the definitions of the useful rules from the results of data mining. In order algorithm of searching correlated alarms. In Section 5

* This research was supported by National 973 Project of China Grant No. G1999032709 and No.G1999032701

1 we propose the intelligent search of correlated alarms categories. After that they proposed a Mining with model-based constraints, called SMC (Searching algorithm called CAP, which achieves a maximized based on Model constraints). The mode-based degree of pruning for all categories of constraints. constraints include Scope constraint, Inter-correlated Garofalakis et al. [11] proposed the use of Regular constraint and Intra-correlated constraint. In Section Expressions as a flexible constraint specification tool 5 experiments show that the SMC algorithm with that enables user-controlled focus to be incorporated Inter-correlated or Intra-correlated constraint is about into the pattern mining process, and developed a two times faster than that with no constraints. Finally, family of novel algorithms called SPRIIT (sequential we make conclusions in Section 6. pattern mining with regular expression constraints) for mining frequent sequential patterns under 2. Related work constrains. These constraints above are too general to be fit for the analysis of alarm correlation in the In the past, the principles of model-based reasoning network management. So some deep constraints of [12] have been widely used in network management telecommunications networks are needed to discover [1,13,14,15,16,17]. Fröhlich and Nejdl [13] the correlated alarms. introduced a model-based solution to the problem of Some groups of network management also alarm correlation for cellular phone networks (GSM). studied the layered model of networks [18,19,20]. They proposed an abstract simulation to identify the Malheiros and Marcos Silva [18] presented a cause of the propagation of alarm messages through proposal of a general model for telecommunication the network by comparing the predicted behavior network based on distributing sets of sub-networks with the actual alarm pattern. It is very difficult to into layers, according to functional affinity criteria. build the relevant functional, causal and structural The proposed model uses an acyclic directed graph to semantics of model of GSM networks, because the represent a telecommunication network and is being system of GSM networks are very complex, used in network management applications, especially including the wireless networks and fixed networks, in alarm correlation. Appleby et al. [19] have and GSM networks evolve quickly, which now developed a mode-based event correlation engine, migrate into 2.5 Generation i.e. GPRS. So the SMC called Yemanja, for multi-layer fault diagnosis. algorithm uses the network model as constraints to Yemanja uses the entity-models to encapsulate each discover the correlated alarms from the database. device and conceptual layer. The entity-models Furthermore, the SMC algorithm adopts the concept contain a set of scenarios that embody its problem of GSM networks rather than the network behavior. Barros et al. [20] presented a diagnostic configuration as constraints and so avoids the approach based on a complete representation of the problem of frequent changes of GSM networks. network in its logical and physical levels, which have Sabin et al. [16] proposed a constraint-based been called the network Configuration Model. The model and a problem-solving approach to network Layered model is fit for the changes of networks, fault management. The approach is based on the which is an overview from the whole network. So we concept of constraints which represent relations use the concept network configuration model of the among network components. Subsequently, Sabin et GSM network as the constraints of SMC (Search with al. [17] applied an extension to the constraint Model-based constraints) algorithm. satisfaction paradigm, called composite constraint satisfaction, to facilitate modeling of complex 3. Problem definition systems and demonstrate the applicability of their approach on an example of a basic groupware service, 3.1 The GSM networks namely, distributed database replication. The PSTN/ISDN constraints of mode-based algorithms are only MSC obtained from the expert, which is a bottleneck to the constraints-based model methods. MSC MSC MSC Switched Network Many researchers of data mining also studied A Interface adding some constraints to the algorithms of data BSC BSC BSC mining [9,10,11]. Srikant et al. [9] first studied the Access problem of discovering association rules in the BTS BTS BTS Network present of constraints that are Boolean expressions over the presence of absence of items. Integrating Um Interface such constraints as a post-processing step can greatly reduce the execution time. Raymond et al. [10] Mobile introduced and analyzed two properties: Station anti-monotonicity and succinctness, and developed characterizations of various constraints into four Figure 1. GSM Network

2 GSM is a second-generation, digital, TDMA-based, 3.2 GSM Network Configuration model cellular stand with extensive coverage in Europe, The concept of GSM networks topology can be including seamless coverage across European considered as a tree. The first level of tree i.e. the root countries. Now GSM has been widely used in over 50 of tree is PLMN (Public land Mobile Network). The countries in the world. second level of tree is MSC (Mobile Service A GSM network is composed of several Switching Center) level, which corresponds to the functional entities, with defined functions and Switched network in Figure 1. The third level of tree interfaces [24]. Figure 1 shows the layout of a generic is BSC (Base Station Controller). The fourth level of GSM network. The GSM network can be divided into tree is BTS level. The adjacent levels are connected three broad parts: Mobile Station, Access Network by Data Link Channel, descried in Figure 2. and Switched Network.. We can describe the concept of GSM networks The Mobile Station is carried by the subscriber. topology illustrated in Figure 3 by 2-tuples: The controls the radio where link with the Mobile Station. object_class is the class of a network element and The Access Network consists of the Base Station parent_object_class is the class of the upper level Transceiver (BTS) and the Base Station object of the network element. Controller (BSC). The BSC provides the radio resource management, which serves the control PLMN LEVEL and selection of appropriate radio channels to interconnect the MS and the Switched Network. MSC LEVEL The Access Network of GSM is also called the Base Station subsystem (BSS). BSC LEVEL The Switched Network, the main part of which is the Mobile services Switching Center, performs the switching of calls between the mobile and BTS LEVEL other fixed (PSTN/ISDN) or mobile network users, as well as management of mobile services, Figure 3. The Concept Structure of GSM such as authentication. We can describe the structure of GSM networks The Mobile Station and the Base Station in Figure 4 by 4-tuples where interface, also known as the or radio link. object_class is the class of a network element, The Base Station Subsystem communicates with the object_instance is the serial NO. of the network Mobile service Switching Center across the A element, parent_object_class is the class of the upper interface. level object of the network element, and The basic interconnection of a mobile station to parent_object_instance is the serial No. of the the fixed Public Switched Telephone Network (PSTN) network element of the upper level object. The class is described in Figure 2. The communication between of PLMN is defined as 0 and the instance of PLMN is a mobile station and the base station subsystem (BSS) defined as 0. Furthermore, PLMN hasn’t parent class is through four types of channels: reverse control in GSM networks and it is the concept root of GSM channel, forward control channel, reverse voice networks. The classes of MSC, BSC, BTS are channel, and forward voice channel. These channels defined as 10,20 and 30, respectively. Note that the are implemented based on the Um interface, class of data circuit between MSC and BSC is described above. A BSS will serve many mobiles in defined as 12 and that between BSC and BTS is its coverage area. The BSS connects with an MSC defined as 23. In the followings we’ll give the through two types of connections, voice circuit and features of the correlated alarms according to the data, which can be carried over terrestrial or configuration model of GSM. microwave links. An MSC may serve many BSSs. Voi c e PLMN

Reverse CC

Forward CC MSC MSC

Reverse VC BSS

MSC

Mobile Mobile Forward VC BSC BSC

Data Link BTS BTS (9.6 Kbps)

Figure 2. Mobile/BAS/MSC interconnection Figure 4. The structure of GSM

3 If the correlated alarms come from the same class then Qi=(( ek1), ti)=( < ek1, ti>)= Ek1. of network element, then the degree of correlation 2.) The length of alarm tuple is among alarms is high. The alarms that are tightly |Qi|=|( ek1, ek2, ……, ekm)|=m, which is the correlated may indicate the mutual effect of number of the alarm types contained in the components of network facility. If the correlated alarm tuple. alarms come from the different class of network Definition 4. An alarm queue and its length elements, then the degree of correlation among 1.) An alarm queue is defined as Sij= i,j=1,2,3,…, where ti< ti+1 <…=< (Ei1,.., Eik), may indicate the mutual effect of network elements in (Ei+1),…, (Ej1, …, Ejm)>= < (Ei1,…, Eik), Ei+1,…, the whole networks, which will benefit planning and (Ej1, …, Ejm)>, i1,…,ik ,j1,…, jm=1,2,3,… . optimizing the whole networks. In what follows, we 2.) The length of alarm queue is defined as | will give the definitions of Scope, Inter-correlated Sij|=||=j-i+1, which is equal to alarms and Intra-correlated alarms. the number of alarm tuple contained in alarm 1.) Scope defines the area of alarms occurring in the queue. networks. In this paper, we use the network Definition 5. An alarm type sequence and its element control area as the scope constraint in length the GSM network. For example, if we specified 1.) An alarm type sequence is the m-tuple MSC scope constraint, then the area includes the consisting of alarm types, which is denoted by specified MSC, the BSCs that the MSC connects Seqm=< ei1, ei2,…,eim> , where m=1,2,3, … ; with and the BTSs that these BSCs connect with. i1,…,im=1,2,3,… . 2.) Inter-correlated alarms: at least one of the 2.) Given alarm type sequence Seqm=< ei1, correlated alarms belongs to the different class of ei2,…,eim>,The length of alarm type sequence is network elements. By Inter-correlation constraint, defined as |Seqm|=| < ei1, ei2,…,eim>|=m. we can make focus on discovering multi-level Definition 6. Given an sequence seqm =< ei1, correlation relations among the MSC level, BSC ei2,…,eim > and a transaction database DB, the level, and BTS level. times of the sequence seqm occurring in the DB are 3.) Intra-correlated alarms: all of the alarms in the defined as correlation rules must belong to the same class of occur (seqm, DB)=| the times of seqm occurring in DB| network element i.e. BTS or BSC or MSC. By Definition 7. Given an sequence seqm =< ei1, ei2,..,eim >, Intra-correlation constraint, we can discover the The support of seqm in database DB is defined as correlation relations in the same level of GSM occur()seq , DB support()seq , DB = m network. m | DB | 3.3 The Alarm Model [23] Obviously, we have occur(seq , DB) = support(seq , DB)× | DB| Definition 1. An alarm event m m Definition 8. Given two alarm type sequences: X, Y An alarm event is defined as Ei=, i, n=1,2,3,…, and an alarm viewing window Wk, the confidence of where ei is an alarm type and tn is the time of alarm occurring. the alarm correlation rule X⇒Y is defined as Definition 2. An alarm type Conf(X⇒Y, W k)= An alarm type is defined as |Support(XY,Wk)/Support(X, Wk)- Support(Y, Wk)| Definition 9. A frequent alarm type sequence is ei=, i=1,2,3,…, where object_class is the serial NO. of defined as follows. In an alarm viewing window Wk, object class, object_instance is the serial NO. of given that the minimum support of alarm type object instance, alarm_number is the NO. of alarm sequence is Mini_support, if the support of an alarm type and desc is the alarm information consisting of type sequence seqm is greater than Mini_support, then alarm priority and alarm description. the alarm type sequence seqm is a frequent alarm type Definition 3. An alarm tuple and its length sequence. 1.) An alarm tuple is defined as Definition 10. An alarm correlation rule

Qi=( ( ek1, ek2, …… , ekm), ti ), i, m=1,2,3,…; ∆ t k1,k2,…,km=1,2,3,… , where ‘ek1, ek2,……, e , e ,…,e ⇒ e , e ,…, e i1 i2 ij ik ik+1 im ekm’ are the alarm types which concurrently [conf=q%, supp=p% ,W ] k occur at the time ti . An alarm tuple can be represented by an alarm event i.e. Q =(< e , t >,< After the alarm types ei1, ei2,…,eij occur, in the i k1 i interval of ∆t, the probability of alarm type sequence ek2, ti> ,……, )=( Ek1, Ek2, ….. , Ekm). If an alarm tuple Q only contains one alarm type, occurring is equal to q%. i

4 4. Intelligent Search Algorithm After the above analysis, we propose the with Model-based Constraints intelligent search of correlated alarms with model-based constraint, called SMC (Search with The different classes of alarm correlation often have Model-based Constraints),which consists of different support values in the alarm database. Some Algorithm 1, Algorithm 2, Algorithm 3 and may be high, while others may be low. In many cases Algorithm 4. we only have interest in one class of alarm The Algorithm 1 is the main part of the SMC correlation. If we don’t add the constraints to filter algorithm. Algorithm 1 is based on the framework of out these uninteresting classes of alarm correlation, the algorithms [6,7,8] and composed of Algorithm 2 the number of candidates in the algorithm will be and Algorithm 3. The Algorithm 2 is the very large. Thus the computing time of data mining Robust_search algorithm in [23], which search the will grow exponentially. But if we add the constraints times of an alarm type sequence occurring in the to filter out these uninteresting correlated alarms, we given alarm queue. Algorithm 3 generates the can greatly enhance the performance of mining frequent alarm type sequences F_ALARMm+1 from correlated alarms. the candidate alarm sequences Cm. As mentioned in Section 3.2, the correlated The constraints, i.e. Scope constraint, alarms in the GSM network are divided into two Inter-correlated constraint and Intra-correlated groups: inter-correlated alarms and intra-correlated constraint are in line 8 of Algorithm 1. We use these alarms. Because the inter-correlated alarms are constraints to prune the candidates that don’t satisfy loosely correlated, the support of inter-correlated the constraints mentioned above. Thus, we can alarms may be low. For the reason that the reduce the number of frequent alarm type sequences Intra-correlated alarms are tightly correlated, the and so reduce the computing time of the algorithm. values of support of Inter-correlated alarms may be By use of the constraints, we could control the high. If we have interest in inter-correlated alarms in process of mining alarms and focus on mining the the GSM networks, we can use the Inter-correlated sequences, which are interesting to us. constraint in the algorithm and don’t need to worry The Algorithm 4 generates the correlated rules about the computing time of data mining. It is the from the frequent alarms. The interesting measure of same thing for Intra-correlated constraint. correlation rules in the frequent pattern mining was Furthermore, we also use the Scope as the constraint first studied by Brin et al.[21]. Later K. M. Ahmed et of the algorithm to discover correlated alarms in the al. [22] improved the interesting measure that was specified part of GSM networks. presented by Brin et al. we use the interesting measure i.e. |P(XY)/P(X)-(Y)| of correlation rule The Constraints definition based on the X⇒Y in [22] as the one in Algorithm 4. configuration model of GSM 1.) Scope constraint: the area of the networks Algorithm 1

under the specified network element. Given the Input: alarm queue (Sij, Wk)

specified object_class i.e. sp_class, an alarm Output: t frequent alarm sequence set: F_ ALARMm sequence set Cm and an alarm sequence ∈ . seqm= where seqm Cm Scope 1. compute C1:={ α | α∈F_ALARM1}; constraint={ seqm∈ Cm | ∀ ex in seqm 2. m:=1; ≥ (ex.object_class sp_class) }. 3. while Cm≠Φ do 2.) Inter-correlated constraint: at least two alarms 4. begin

belongs to the different classes of network 5. For all α∈Cm , Search alarm queue Sij to find support(α, Wk); elements. Given an alarm sequence set Cm and /*Algorithm 2 */

an alarm sequence seqm= where 6. F_ALARMm={ α∈Cm| support(α, Wk)≥ min_support seqm∈ Cm . Inter-correlation constraint={ seqm∈ ∧ ( ( α∈Inter-correlated-constraint ) || Cm | ∃ ex, ey in seqm ( ex.object_class≠ ( α∈Intra-correlated-constraint ) ∧ ( α∈Scope-constraint ));

ey.object_class) }. 7. Generate Candidate Cm+1 from F_ALARMm; /* Algorithm 3 */ 3.) Intra-correlated constraint: the alarms in the 8. m=m+1; correlation rules must belong to the same class 9. end.

of network element i.e. BTS or BSC or MSC. 10. for all m , output F_ALARMm; Given an alarm sequence set Cm and an alarm sequence seq = where seq ∈ m i1 i2 im m Cm.. Intra-correlation constraint={ seqm∈ Cm | ∀ex, ey in seqm (ex.object_class= ey.object_class) }.

5 Alarm_sequence_length=2 750

Agorithm 3 700

Input: frequent alarm sequence set F_ALARMm. 650

600 Output: frequent alarm sequence Candidate set Cm+1. 550 1. Cm+1:=Φ; 500 2. For α,β∈F_ALARMm and α≠β and α=< ei1, ei2,…, eim>, 450 β=< ei1`, ei2`,…, eim`> 400

3. begin 350 Average times of alarm sequence occurring 4. If (ei2= ei1` ∩ei3= ei2` ∩,…,∩eim= ei m-1` ) then begin 300 20 30 40 50 60 70 80 90 100 110 Minimum support 5. generate alarm sequence γ=< ei1, ei2,…, eim, eim`>; Interlen2 Intralen2 Nolen2 /* Candidate generate */

6. Cm+1:= {γ | For all L⊆γ and |L|=m ,we have Alarm_sequence_length=3 L∈ F_ALARMm }; /*Pruning Candidate */ 7. end 550 8. end 500 450 400 Algorithm 4 350 Input: Frequent alarm sequence set F_ALARM m 300 Output: output the correlation rules β→(α-β) and 250 confidence |P(α)/P(β)-P(α-β)| 200

1. for all α∈F_ALARMm do /* generate correlation rules */ Average times of alarm sequence occurring 20 30 40 50 60 70 80 90 100 110 2. for all β⊆α do Minimum support Interlen3 Intralen3 Nolen3 α β α β ≥ 3. if|P( )/P( )-P( - )| min_conf then 4. begin 5. generate the rule β→ (α-β) with Figure 5 Average times of alarm sequences of 6. confidence |P(α)/P(β)-P(α-β)| ; 7. end Inter, Intra, no constraints The graph of alarm_sequence_len=2 indicates that the broken lines of Intra, Inter and Nocons are to converge with the increment of Minimum support, 5. Experiments while the graph of alarm_sequence_len=3 indicates that the broken lines of Intra, Inter and Nocons are to We conducted a set of experiments to test the diverge with the increment of Mini_support. In sum, performance of SMC (Search with Model-based the average times of alarm sequence occurring Constraints) algorithm. The experiments were on the increases with the increment of Minimum support. DELL PC Server with 2 CPU Pentium II, CPU MHz The average times of Intra-correlated constraint 397.952211, Memory 512M and SCSI Disk 16G. The alarms are larger than these of Inter-correlated Operating system on the server is Red Hat Linux constraint alarms with the same Minimum support, version 6.0. which indicates that Inter-correlated alarms are more The data in experiments are the alarms in GSM correlated than Intra-correlated alarms. Networks, which contain 181 alarm types and 90k From Figure 6, it is obvious to see that with the alarm events. The time of alarm events range from increment of Minimum support, the executing time of 2001-03-15-00 to 2001-03-19-23. In Figure 5, Figure algorithms will be smaller than before. The algorithm 6 and Figure 7 Intra-correlated constraint, with Inter-correlated constraint and Intra-correlated Intra-correlated constraint and no constraints are constraint are two times faster than that with no denoted by Intra, Inter and Nocons respectively. In constraints at the same Minimum support. The experiments, we use the minimum times of alarm algorithm with Inter-correlated constraint is two sequence occurring as the Minimum support. times faster than that with Intra-correlated constraint First we give the definition of average times of at the same Minimum support. From Figure 7, The alarm sequence occurring. Average times of alarm number of alarm sequences discovered by the sequence occurring is equal to the sum of times of all algorithm with no constraints are about three times of alarm sequences divided by the number of alarm the one discovered by that with Inter-correlated sequences. constraint and about two times of the one discovered by that with Intra-correlated constraint. .

6 850 800 Reference 750 700 650 600 [1] G. Jakobson and M. D. Weissman, “Alarm 550 500 Correlation,” IEEE Network, page52-59, 450 400 November 1993. 350 Time(sec) 300 [2] H. Mannila and H. Toivonen and A. I. Verkamo, 250 200 “Discovering frequent episodes in sequences,” 150 100 KDD-95, pp. 210-215, August20-21, 1995. 50 0 [3] K. Hät\"onen, M. Klemettinen, H. Mannila, P. 20 30 40 50 60 70 80 90 100 110 120 Minimum support Ronkainen and H. Toivonen, “TASA: Nocons Intra Inter Telecommunications Alarm Sequence Analyzer, Figure 6 Execution time or How to enjoy faults in your network," IEEE/IFIP 1996 Network Operations and 900 850 Management Symposium (NOMS'96), Kyoto, 800 750 Japan, April 1996, p. 520-529. 700 650 [4] K. D. Tuchs, K. Jobman, “Intelligent Search for 600 550 Correlated Alarm Events in Database,” 500 450 IFIP/IEEE International Symposium on 400 350 Integrated Network Management, 14-18 May 300

Number ofSequences 250 2001. 200 150 [5] R. D. Gardner and D. A. Harle, “Fault 100 50 Resolution and Alarm Correlation in High-Speed 20 30 40 50 60 70 80 90 100 110 120 Minimum support Networks using Database Mining Techniques,” nocons intra inter Information, Communications and Signal

Figure 7 Number of sequences Processing 1997, pp.1423-1427, September 1997. [6] R. Agrawal and R. Srikant, "Fast Algorithms for 6. Conclusion Mining Association Rules," Proc. of the 20th Int'l Conference on Very Large Databases, We presented a new algorithm for intelligent search Santiago, Chile, Sept. 1994. of correlated alarms with model-based constraints. In [7] R. Agrawal and R. Srikant, “Mining Sequential the algorithm we use three kinds of constraints i.e. Patterns,” In Proceedings of the Eleventh Scope constraint, Inter-correlated constraint and International Conference on Data Engineering, Intra-correlated constraint. The experiments shows Taipei, Taiwan, March 1995. that the algorithm with the Inter-correlated constraint [8] R. Srikant and R. Agrawal, “Mining Sequential and Intra-correlated constraint are about two times Patterns: Generalizations and Performance faster than the one with no constraints. From the Improvements,” In Proceedings of the Fifth result of experiments, we can see that the International Conference on Extending Inter-correlated alarms are more correlated than the Database Technology (EDBT’96), Avigonon, Intra-correlated alarms. The constraints for alarm France, March 1996. correlation are not limited to the three kinds of ones [9] R. Srikant, Q. Vu and R. Agrawal. "Mining above. According to the features of the thing that we Association Rules with Item Constraints". Proc. want to discover, we can design new kinds of of the 3rd Int'l Conference on KDD, Newport constraints for the intelligent search of correlated Beach, California, August 1997. alarms. [10] Raymond T. Ng, Laks V. S. Lakshmanan, Jiawei Han, and Alex. Pang, “Exploratory Mining and Acknowledgements Pruning Optimizations of Constrained Association Rules,” In Proceedings of the 1998 Thanks Professor LI Wei for the choice of subject and ACM SIGMOD International Conference on guidance of methodology. Thanks for the suggestions Management of Data, Seattle, Washington, June from Professor SUI YueFei of Chinese Academy 1998. Sciences. Thanks for Nan Liu, Zhi Cui and Xinzhang Li of Beijing Mobile Telecom. The author would like [11] M. N. Garofalakis, R. Rastogi and K. Shim, to thank Xin Gao, Peng Cheng, Gang Zhou , the other SPIRIT: Sequential Pattern Mining with Regular member of the NLSDE lab. Expression Constraints, the VLDB Conference, Edinburgh, Scotland, UK, 1999 [12] R. Davis, H. Shrobe, W. Hamscher, K.

7 Wieckeert, M. Shirley, and S. Polit, “Diagnosis [22] K. M. Ahmed, N. M. EI-Makky, Y. Taha, “A based on description of structure and functions,” note on ‘Beyond Market Baskets: Generalizing In National Conference on Artificial Intelligence, Association Rules to Correlations’,” SIGKDD pages 137-142, Pitsburg, PA, 1982 Explorations, Volume1, Issue2-page46, Jan, [13] P. Fröhlich and W. Nejdl, “Model-based alarm 2000. correlation in cellular phone networks,” In [23] Qingguo Zheng, Ke Xu, Weifeng Lv, and Proceedings of the 5th International Symposium Shilong Ma, “Intelligent Search of Correlated on Modeling, Analysis, and Simulation of Alarms from Database Containing Noise Data,” Computer and Telecommunications Systems Proceedings of the 8th International IFIP/IEEE (MASCOTS), Jan 1997. Network Operations and Management [14] L. Ricciulli, N. Shacham, “Modeling correlated Symposium (NOMS 2002), Florence, Italy, April alarms in network management systems,” In 2002 http://arXiv.ogr/abs/cs.NI/0109042 Proceedings of the Conference on [24] Michel Mouly and Marie-Bernadette Pautet, Communication Networks and Distributed “The GSM System for Mobile Communications”, System. Modeling and Simulation, CNDS'97, Published by the authors, 1992. pages 9-16, 1997. [15] D. Sabin, M. Sabin, R. D. Russell, and Eugene C. Freuder, “Constraint-based Approach to Diagnosing Configuration Problems”, Working Notes of IJCAI'95 Workshop on AI in Distributed Information Networks, Montreal, Canada, Sue Abu- Hakima, August 19, 1995. [16] M. Sabin, R. D. Russell, and E. C. Freuder, “Generating Diagnostic Tools for Network Fault Management”,In the proceeding of the Fifth IFIP/IEEE International Symposium on Integrated Network Management ( IM'97 ), San Diego, CA, May 1997. [17] M. Sabin, A. Bakman, E. C. Freuder, and R. D. Russell, “Constraint-Based Approach to Fault Management for Groupware Services,” In Proceedings of the Sixth IFIP/IEEE International Symposium on Integrated Network Management (IM'99), Boston, May 1999. [18] Malheiros M. D. and Marcos Silva N. J., “Modeling a telecommunication network for fault management applications,” Network Operations and Management Symposium, NOMS 98, IEEE, Volume: 3 , Page(s): 723 –732, 1998 [19] K. Appleby, G. Goldszmidt, and M.steinder, “Yemanja - A Layered Event Correlation Engine for Multi-domain Server Farms,” Integrated Network Management Proceedings IFIP/IEEE International Symposium 2001, page(s): 329 –344, 2001 [20] L. N. Barros, M. Lemos, V. Bernal, and J. Wainer, “Model Based Diagnosis to Network Communication Faults,” In Third International Workshop on Artificial Intelligence in Distributed Information Networking (AiDIN'99), Held in conjunction with AAAI'99, Technical Notes by the AAAI Press. Orlando, Flórida, EUA, July, 1999, page(s).: 57-62 [21] S. Brin, R. Motwani and C. Silverstein, “Beyond Market Baskets: Generalizing Association Rules to Correlations,” In the Proceedings of SIGMOD, pp. 265-276, AZ, USA, 1997.

8