Fusing information from tickets and alerts to improve the incident resolution process

Abstract

In the context of network incident monitoring, alerts are useful notifications that provide IT management staff with information about incidents. They are usually triggered in an automatic manner by network equipment and monitoring systems, thus containing only technical information available to the systems that are generating them. On the other hand, ticketing systems play a different role in this context. Tickets represent the business point of view of incidents. They are usually generated by human intervention and contain enriched semantic information about ongoing and past incidents. In this article, our main hypothesis is that incorporating tickets information into the alert correlation process will be beneficial to the incident resolution life-cycle in terms of accuracy, timing, and overall incident's description. We propose a methodology to validate this hypothesis and suggest a solution to the main challenges that appear. The proposed correlation approach is based on the time alignment of the events (alerts and tickets) that affect common elements in the network. For this we use real alert and ticket datasets obtained from a large telecommunications network. The results have shown that using ticket information enhances the incident resolution process, mainly by reducing and aggregating a higher percentage of alerts compared with standard alert correlation systems that only use alerts as the main source of information. Finally, we also show the applicability and usability of this model by applying it to a case study where we analyze the performance of the management staff.

Present and Future of Network Security Monitoring

“…NSM deployments with numerous and disparate sensors result in massive databases from which detecting when and where there is an attack is a challenging task. Besides, the data format varies widely among the set of sensors [15,16]. For this reason, after data collection, data sources need to be processed to become fit for purpose.…”

“…Like this, event correlation provides the following benefits: i) extending the semantic information by considering the context of the event, ii) reducing the volume of data to be analyzed, and iii) escalating and prioritizing important events, thus reducing the number of false positives. This yields useful information for the detection of attacks or abnormal activities, especially when they affect different assets [16,17,23].…”

“…Detectors are actually engines which goal is to detect suspicious behavior in the data. The volume of data to be analyzed can be reduced by filtering or grouping data, by feature extraction (considering only those features that are of interest) [28,29], or by using a correlation engine [16,17,23].…”

An Image Classification Algorithm of Financial Instruments Based on Convolutional Neural Network

“…Simple things, such as edge curves, can be combined into extremely complex features, such as shapes and angles. Recently, the CNN has been introduced to the analysis of financial instruments, e.g., tax bill identification and bill classification [18]. In this research, a CNN is developed specifically for the image classification of multi-class financial instruments, without invoking overfitting.…”

“…The network performance was improved by randomly disabling nodes in each layer [21]. At the beginning of each training iteration, a DropOut with the same size of nodes was initialized in each layer to label the on or off state of the corresponding nodes.…”