Atropos Correlation Prototype
This document explores the Atropos Correlation Engine's capabilities in data parsing, matching, and correlation strategies as outlined in the Spring 2008 prototype. Key sections include an in-depth analysis of log data transformations, various correlation strategies leveraging multiple parameters, and the creation of rulesets for efficient data association. The conclusion summarizes the effectiveness of these methods and addresses key questions regarding matching efficiency and substring matching. A demo showcases the practical application of these strategies in real-world scenarios.
Atropos Correlation Prototype
E N D
Presentation Transcript
AtroposCorrelation Prototype COMP 415, Spring 2008
Table of Contents • Data Parsing • Matches • Correlation Strategies • Correlation Rulesets • Conclusion & Demo
Data Parsing Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo
Data Parsing • Transform raw data Log String: 846739 12-13-09 17 5000 AAB
Data Parsing • Transform raw data • Log Parser or API JPM Service Atropos API API Call To Correlation Engine Parser Log File API Call
Matches Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo
Matches • Single correlation point • One or more parameters Match One Match Two
Correlation Strategies Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo
Correlation Strategies • One or more matches • Strength is “sum” of matches • Multiple strategies
Correlation Rulesets Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo
Correlation Rulesets • One link in association graph • Matches • Strategies • Data structures • Corollary: Parsing Rules
Conclusion & Demo Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo
Conclusion - summary • Matches link messages • Strategies compose Correlation • Rulesets map to network
Conclusion - questions • How efficient is matching? • How to match w/o rules? • How to match substrings?
AtroposCut through the tangled web… Thank You For Listening!
