Methodology for intelligent pattern detection and anomaly detection in machine to machine communication network

• US 10,237,290 B2
• Filed: 06/26/2012
• Issued: 03/19/2019
• Est. Priority Date: 06/26/2012
• Status: Active Grant

• Current Assignee: Aeris Communications Inc.
• Original Assignee: Aeris Communications Inc.
• Inventors: Balakrishnan, Subramanian, Sharma, Narendra Kumar
• Primary Examiner(s): Bates, Kevin T
• Assistant Examiner(s): Patel, Ronak
• Application Number:
  US13/533,815
• Publication Number:
  US 20130346596A1
• Time in Patent Office: 2,457 Days
• Field of Search: 709224
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

The present invention relates generally to network communications, and more particularly to machine-to-machine (M2M) data communications. The present invention provides for a method, apparatus and computer program product for detecting performance event data across a machine-to-machine (M2M) network indicative of anomalous performance of data and thereafter alerting users of performance issues in real-time or near real-time.

Claims

1. A method for detecting network performance event data for one or more machine-to-machine (M2M) devices across an M2M network indicative of anomalous network performance, comprising:

determining by identification one or more network performance events associated with at least one of the one or more M2M devices to monitor using complex event processing (CEP);

wherein the one or more M2M devices comprise a processor having limited logic, a sensor and a communications adapter in communication with the M2M network;

acquiring data of one or more monitored network performance events, wherein the CEP is configured to acquire data as “

bytes in” and

“

bytes out”

from a data stream that captures the monitored performance event;

comparing the acquired “

bytes in” and

“

bytes out”

of the data stream to identify and capture asymmetry; and

issuing an alert in response to the identified and captured asymmetry.

2. The method of claim 1, wherein the acquiring data further includes identifying one or more event data streams to monitor and identifying data within the one or more event data streams.

3. The method of claim 2, wherein the identifying data within the one or more event streams further includes sourcing information from one or more log files of a server.

4. The method of claim 3, wherein the server is an authentication, authorization and accounting server.

5. The method of claim 2, wherein the identifying data within the one or more event streams further includes capturing identified data for the comparing.

6. The method of claim 3, wherein the comparing further includes comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.

7. The method of claim 6, wherein the comparing further includes comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period and with one or more historical files.

8. The method of claim 7, wherein at least one of the one or more historical files includes a historical alert file associated with the one or more events.

9. The method of claim 6, wherein the issuing an alert further includes associating a predetermined output routing for each of the one or more events.

10. The method of claim 9, wherein the issuing an alert further includes directing an asynchronous alert command to a command interface message queue associated with the predetermined output routing for receipt by one or more receiving devices associated with the predetermined output routing.

11. The method of claim 10, wherein the predetermined output is a dashboard display having predetermined content and being visually configured to provide at least one of one or more real time alerts and one or more near real time alerts.

12. The method of claim 11, wherein the predetermined content is provided in relation to one or more of a classification of an alert, a filter having predetermined characteristics for identifying receipt of an alert, and a receiving location preference.

13. The method of claim 11, wherein the dashboard display comprises at least one or more of an Alerts section displaying near real time alerts from multiple sources and a Device Details section displaying details of events in relation to a device.

14. An apparatus for communicating and issuing alerts in response to network event data exceeding one or more network event thresholds in one or more machine to machine (M2M) devices across an M2M network, comprising:

a device protocol for communicating with a server across an M2M network, a device for communicating with a server system across the network using a communication adapter;

the server system having an application module for

determining by identification one or more network performance events associated with at least one of the one or more M2M devices to monitor using complex event processing (CEP); and

acquiring event data of one or more monitored network performance events associated with at least one of the one or more M2M devices,

wherein the CEP is configured to acquire the event data as “

bytes in” and

“

bytes out”

from a data stream that captures the monitored network performance event, and

wherein the one or more M2M devices comprise a processor having limited logic, a sensor and a communications adapter in communication with the M2M network,

wherein the processor, based on the limited logic, is configured to compare the acquired “

bytes in” and

“

bytes out”

of the data stream to identify and capture asymmetry; and

issue a command in response to the identified and captured asymmetry; and

wherein the communications adaptor transmits an alert to one or more recipients in response to the issued command, wherein the alert includes information in relation the network event.

15. The apparatus of claim 14, wherein the server system is in communication with one or more receiving devices.

16. The apparatus of claim 15, wherein the application module further includes logic to identify one or more event data streams to monitor and identify data within the one or more event data streams.

17. The apparatus of claim 15, wherein the application module further includes logic to capture identified data for the comparing.

18. The apparatus of claim 14, wherein the application module further includes logic to compare the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.

19. The apparatus of claim 18, wherein the application module further includes logic to issue an alert to the one or more receiving devices.

20. The apparatus of claim 19, wherein the logic includes instruction to output a dashboard display having predetermined content and being visually configured to provide at least one of one or more real time alerts and one or more near real time alerts.

21. The apparatus of claim 19, wherein the logic is capable of providing predetermined content in relation to one or more of a classification of an alert, a filter having predetermined characteristics for identifying receipt and processing of an alert.

22. A computer program product stored on a non-transitory computer usable medium, wherein the computer usable medium causes a computer to control an execution of an application to perform a method for detecting network performance event data for one or more machine-to-machine (M2M) devices across an M2M network indicative of anomalous network performance, comprising:

determining by identification one or more network performance events associated with at least one of the one or more M2M devices to monitor using complex event processing (CEP);

wherein the one or more M2M devices comprise a processor having limited logic, a sensor and a communications adapter in communication with the M2M network;

acquiring data of one or more monitored network performance events, wherein the CEP is configured to acquire data as “

bytes in” and

“

bytes out”

from a data stream that captures the monitored network performance event;

comparing the acquired “

bytes in” and

“

bytes out”

of the data stream to identify and capture asymmetry; and

issuing an alert in response to the identified and captured asymmetry.

23. The computer program product of claim 22, further comprising:

identifying one or more event data streams to monitor and identify data within the one or more event data streams;

capturing identified data; and

comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.

24. The computer program product of claim 23, further comprising comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period and with one or more historical files associated with the one or more events.

25. The computer program product of claim 24, wherein the predetermined event characteristic limits and the predetermined period may be dynamically input through a connected receiving device within the M2M network.

26. The computer program product of claim 24, further comprising outputting instructions to display a dashboard having predetermined content and being visually configured to provide at least one of one or more real time alerts and one or more near real time alerts.

27. The computer program product of claim 26, wherein the predetermined content is provided in relation to one or more of a classification of an alert, a filter having predetermined characteristics for identifying receipt and processing of an alert.