Determining similarity scores of anomalies

摘要

A method and system comprise abstracting configuration items (CI) in at least a first anomaly and a second anomaly based on type of CI. Further, CIs are matched of a common type between the first and second anomalies based on a cost function. Additionally, a similarity score is computed for the first and second anomalies based, at least in part, on the cost function of the matched CI's and based on topology of the first and second anomalies.

主权项

1. A method of computing a similarity score between first and second anomalies, each anomaly comprising one or more configuration items (CI), one or anomaly metrics associated with at least some of the CI's, and at least one CI dependent on another CI via a link, the method comprising:
for the first anomaly and for each CI of a given type in the first anomaly and a CI in the second anomaly of the same type, computing a score function corresponding to said CI's, said score function based on at least one of: the number of common anomaly metrics associated with said CI's for which the score function is computed, the number of CI types in common that are dependent on the given pair of CI's for which the score function is being computed, and the number of anomaly metrics associated with each of the CI's for which the score function is being computed; determining assignments between CIs of the first anomaly with CIs of the second anomaly; and computing a similarity score for the first and second anomalies based on the computed score functions and based on at least one of: the number of links which match between the anomalies, the number of CIs in each anomaly, and the number of links between CIs in each anomaly in which at least one of such CIs has been assigned to a CI in the other anomaly.