Scoring events as likely cause events in a resource network

A computer-implemented method for scoring events as likely cause events in a resource network, comprising:

• processing incoming events relating to resources in a resource network to correlate a related group of incoming events;
• classifying each of the incoming events into a category, wherein the categories represent event status types that cause events, and wherein each category has a different event classification weight;
• obtaining a sub-topology of a topology having nodes representing resources in the resource network and edges representing relationships between the resources, wherein the sub-topology graph includes nodes representing resources at which the related group of incoming events have occurred;
• mapping the incoming events of the related group onto the sub-topology graph as node events and discovering paths between the node events;
• scoring each node event relative to other node events in the related group based on scores of one or more discovered paths between a node event and other node events, wherein the scoring is based on a combination of an event classification weight of the node event and a discovered path score comprising aggregated directional relationship scores of edges of a discovered path from a node event to another node event of the related group, wherein a directional relationship score of an edge of the discovered path is configured according to a direction of relationship from the node event, and wherein the scoring indicates a likelihood of an event being a proximate cause event in the related group;
• and
• dynamically mapping and scoring events such that the scores are updated as new incoming correlated related events occur, wherein the dynamic mapping comprises extending the sub-topology as required to include new nodes representing resources of the new incoming correlated related events, and wherein the scoring is resource agnostic by being based on event classification weight rather than a node weight.

A system for scoring events as likely cause events in a resource network, comprising:

• one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories to execute the function of the components:
• an event correlating component for processing incoming events relating to resources in a resource network to correlate related events as a related group;
• a classifying component for classifying each of the incoming events into a category, wherein the categories represent event status types that cause events, and wherein each category has a different event classification weight;
• an event mapping component for mapping the events of the related group onto nodes of a sub-topology representing resources of the resource network and having edges representing relationships between the resources;
• an event scoring component for scoring each event by discovering one or more paths between a node event and other node events of the related group, wherein the scoring is based on a combination of an event classification weight of the node event and a discovered path score comprising aggregated directional relationship scores of edges of a discovered path from the node event to another node event of the related group, wherein a directional relationship score of an edge of the discovered path is configured according to a direction of relationship from the node event, and wherein the scoring indicates a likelihood of an event being a proximate cause event in the related group;
• and
• dynamically mapping and scoring events such that the scores are updated as new incoming correlated related events occur, wherein the dynamic mapping comprises extending the sub-topology as required to include new nodes representing resources of the new incoming correlated related events, and wherein the scoring is resource agnostic by being based on event classification weight rather than a node weight.

A system for scoring events as likely cause events in a resource network, comprising:

• one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories to execute the function of the components:
• an event correlating component for processing incoming events relating to resources in a resource network to correlate a related group of incoming events;
• a classifying component for classifying each of the incoming events into a category, wherein the categories represent event status types that cause events, and wherein each category has a different event classification weight;
• a sub-topology obtaining component for obtaining a sub-topology of a topology having nodes representing resources in the resource network and edges representing relationships between the resources, wherein the sub-topology includes nodes representing resources at which the related group of incoming events have occurred;
• an event mapping component for mapping the incoming events of the related group onto the sub-topology as node events and discovering paths between the node events;
• an event scoring component for scoring each node event relative to other node events in the related group based on scores of one or more discovered paths between a node event and other node events, wherein the scoring is based on a combination of an event classification weight and a discovered path score comprising aggregated directional relationship scores of edges of a discovered path from a node event to another node event of the related group, wherein a directional relationship score of an edge of the discovered path is configured according to a direction of relationship from the node event, and wherein the scoring indicates a likelihood of an event being a proximate cause event in the related group;
• and
• dynamically mapping and scoring events such that the scores are updated as new incoming correlated related events occur, wherein the dynamic mapping comprises extending the sub-topology as required to include new nodes representing resources of the new incoming correlated related events, and wherein the scoring is resource agnostic by being based on event classification weight rather than a node weight.

A computer program product for scoring events as likely cause events in a resource network, the computer program product comprising one or more computer-readable tangible storage medium and program instructions stored on at least one of the one or more tangible storage medium, the program instructions executable by a processor capable of performing a method, the method comprising:

• processing incoming events relating to resources in a resource network to correlate related events as a related group;
• classifying each of the incoming events into a category, wherein the categories represent event status types that cause events, and wherein each category has a different event classification weight;
• mapping the events of the related group onto nodes of a sub-topology representing resources of the resource network and having edges representing relationships between the resources;
• scoring each event by discovering one or more paths between a node event and other node events of the related group, wherein the scoring is based on a combination of an event classification weight and a discovered path score comprising aggregated directional relationship scores of edges of a discovered path from a node event to another node event of the related group, wherein a directional relationship score of an edge of the discovered path is configured according to a direction of relationship from the node event, and wherein the scoring indicates a likelihood of an event being a proximate cause event in the related group;
• and
• dynamically mapping and scoring events such that the scores are updated as new incoming correlated related events occur, wherein the dynamic mapping comprises extending the sub-topology as required to include new nodes representing resources of the new incoming correlated related events, and wherein the scoring is resource agnostic by being based on event classification weight rather than a node weight.