System for decomposing events from managed infrastructures using a topology proximity engine, graph topologies, and k-means clustering

摘要

An event clustering system includes an extraction engine in communication with an infrastructure. The extraction engine receives data from the infrastructure and produces events. An alert engine receives the events and creates alerts mapped into a matrix, M. A sigalizer engine includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine. The sigalizer engine determines one or more common steps from events and produces clusters relating to the alerts and or events.