# US 12,764,013 B2 · Systems and methods for determining causal relationships among network alarms

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,764,013 B2
- Document ID: US12764013B2
- Status: Granted
- Kind: B2
- Application number: 18/412,338
- Filed: 2024-01-12
- Published: 2025-07-17
- Granted: 2026-10-13
- Earliest claimed: 2024-01-12
- Assignees: JPMorgan Chase Bank, N.A.
- Applicants: Jpmorgan Chase Bank, N.A.
- Inventors: Najah Ghalyan; Marcus Kaiser; Mohammed Ayub; Sean Moran
- Web page: https://patentgrep.com/patent/US12764013B2

## CPC

- H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies}
- H04L 41/06: Management of faults, events, alarms or notifications
- H04L 41/0604: using filtering, e.g. reduction of information by using priority, element types, position or time
- H04L 41/064: {involving time analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In some aspects, the techniques described herein relate to a method including: receiving, at an alarm management service, a plurality of alarms, wherein each of the plurality of alarms includes respective alarm data; clustering the plurality of alarms into an alarm cluster group; generating a plurality of binary time sequences, wherein each of the plurality of binary time sequences corresponds to one of the plurality of alarms; generating an initial alarm graph based on the alarm cluster group and the plurality of binary time sequences; providing, as input to a causal inference process, the initial alarm graph and the plurality of binary time sequences; and generating, by the causal inference process, a causal alarm graph, wherein the causal alarm graph is a partially connected and directed graph.

## Claims

### Claim 1

A method comprising:
receiving, at an alarm management service, a plurality of alarms generated in a network, wherein each of the plurality of alarms includes respective alarm data including an alarm identifier, a device identifier, an alarm start timestamp and an alarm end timestamp;
clustering the plurality of alarms into an alarm cluster group based on time factors and/or a persistent homology technique, wherein the persistent homology technique is based on topological features of a topology of the network;
generating a plurality of binary time sequences, wherein each of the plurality of binary time sequences corresponds to one of the plurality of alarms and wherein each of the plurality of binary time sequences is generated based on the alarm start timestamp and the alarm end timestamp of a corresponding alarm of the plurality of alarms;
generating an initial alarm graph based on the alarm cluster group, the topology of the network, and the plurality of binary time sequences, wherein the initial alarm graph is a completely connected, undirected graph based on the plurality of alarms being generated for each received alarm identifier including the alarm identifier;
providing, as input to a causal inference process, the initial alarm graph and the plurality of binary time sequences; and
generating, by the causal inference process, a causal alarm graph based on the input, wherein the causal alarm graph is a partially connected and directed graph and wherein the partially connected and directed graph comprises a direction of each edge in the partially connected and directed graph;
wherein the generating the initial alarm graph includes deleting an edge from between a first node of the initial alarm graph and a second node of the initial alarm graph when: (i) a first node device identifier associated with the first node is different from a second node device identifier associated with the second node; (ii) there is an absence of a network connection between a network device represented by the first node and a network device represented by the second node; and (iii) there is an absence of overlap between active intervals defined by the alarm start timestamp and the alarm end timestamp of the corresponding alarm of the plurality of alarms, where in the plurality of alarms are associated with the first node and the second node in their corresponding binary time sequences of the plurality of binary time sequences.

### Claim 2 (depends on 1)

The method of claim 1, comprising:
deleting the edge from between the first node of the initial alarm graph and the second node of the initial alarm graph based on an absence of an alarm represented by the first node from the alarm cluster group.

### Claim 3

A system comprising at least one computer including a processor, wherein the at least one computer is configured to:
receive, at an alarm management service, a plurality of alarms generated in a network, wherein each of the plurality of alarms includes respective alarm data including an alarm identifier, a device identifier, an alarm start timestamp and an alarm end timestamp;
cluster the plurality of alarms into an alarm cluster group based on time factors and/or a persistent homology technique, wherein the persistent homology technique is based on topological features of a topology of the network;
generate a plurality of binary time sequences, wherein each of the plurality of binary time sequences corresponds to one of the plurality of alarms and wherein each of the plurality of binary time sequences is generated based on the alarm start timestamp and the alarm end timestamp of a corresponding alarm of the plurality of alarms;
generate an initial alarm graph based on the alarm cluster group, the topology of the network, and the plurality of binary time sequences, wherein the initial alarm graph is a completely connected, undirected graph based on the plurality of alarms being generated for each received alarm identifier including the alarm identifier;
provide, as input to a causal inference process, the initial alarm graph and the plurality of binary time sequences; and
generate, by the causal inference process, a causal alarm graph based on the input, wherein the causal alarm graph is a partially connected and directed graph and wherein the partially connected and directed graph comprises a direction of each edge in the partially connected and directed graph;
wherein the generating the initial alarm graph includes deleting delete an edge from between a first node of the initial alarm graph and a second node of the initial alarm graph when: (i) a first node device identifier associated with the first node is different from a second node device identifier associated with the second node; (ii) there is an absence of a network connection between a network device represented by the first node and a network device represented by the second node; and (iii) there is an absence of overlap between active intervals defined by the alarm start timestamp and the alarm end timestamp of the corresponding alarm of the plurality of alarms, where in the plurality of alarms are associated with the first node and the second node in their corresponding binary time sequences of the plurality of binary time sequences.

### Claim 4 (depends on 3)

The system of claim 3, wherein the at least one computer is configured to:
deleting the edge from between the first node of the initial alarm graph and the second node of the initial alarm graph based on absence of an alarm represented by the first node from the alarm cluster group.

### Claim 5

A non-transitory computer readable storage medium, including instructions stored thereon, which instructions, when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:
receiving, at an alarm management service, a plurality of alarms generated in a network, wherein each of the plurality of alarms includes respective alarm data including an alarm identifier, a device identifier, an alarm start timestamp and an alarm end timestamp;
clustering the plurality of alarms into an alarm cluster group based on time factors and/or a persistent homology technique, wherein the persistent homology technique is based on topological features of a topology of the network;
generating a plurality of binary time sequences, wherein each of the plurality of binary time sequences corresponds to one of the plurality of alarms and wherein each of the plurality of binary time sequences is generated based on the alarm start timestamp and the alarm end timestamp of a corresponding alarm of the plurality of alarms;
generating an initial alarm graph based on the alarm cluster group, the topology of the network, and the plurality of binary time sequences, wherein the initial alarm graph is a completely connected, undirected graph based on the plurality of alarms being generated for each received alarm identifier;
providing, as input to a causal inference process, the initial alarm graph and the plurality of binary time sequences; and
generating, by the causal inference process, a causal alarm graph based on the input, wherein the causal alarm graph is a partially connected and directed graph and wherein the partially connected and directed graph comprises a direction of each edge in the partially connected and directed graph;
where in the generating the initial alarm graph includes deleting an edge from between a first node of the initial alarm graph and a second node of the initial alarm graph when: (i) a first node device identifier associated with the first node is different from a second node device identifier associated with the second node; (ii) there is an absence of a network connection between a network device represented by the first node and a network device represented by the second node; and (iii) there is an absence of overlap between active intervals defined by the alarm start timestamp and the alarm end timestamp of the corresponding alarm of the plurality of alarms, wherein the plurality of alarms are associated with the first node and the second node in their corresponding binary time sequences of the plurality of binary time sequences.

### Claim 6 (depends on 5)

The non-transitory computer readable storage medium of claim 5, comprising:
deleting the edge from between the first node of the initial alarm graph and the second node of the initial alarm graph based on an absence of a network connection between a network device represented by the first node and a network device represented by the second node.