Self-Organizing Monitoring Agents for Hierarchical Event Correlation

Bin Zhang¹, Ehab Al-Shaer¹

¹DePaul University, United States

Abstract. Hierarchical event correlation is very important for distributed monitoring network and distributed system operations. In many large-scale distributed monitoring environments such as monitions senor networks for data aggregation, battlefield compact operations, and security events, an efficient hierarchical monitoring agent architecture must be constructed to facilitate event reporting and correlation utilizing the spacial relation between events and agents with minimum delay and cost in the network. However, due to the significant agent communication and management overhead in organzine agents in distributed monitoring, many of the existing approaching become inefficient or hard to deploy. In this paper, we propose a topology-aware hierarchical agent architecture construction technique that minimizes the monitoring cost while consid- ering the underlying network topology and agent capabilities. The agent architecture construction is performed in a purely decentralized fashion based on the agents' local knowledge with minimal communication and no central node support.