×

Detecting anomalous states of machines

  • US 10,360,093 B2
  • Filed: 11/18/2015
  • Issued: 07/23/2019
  • Est. Priority Date: 11/18/2015
  • Status: Active Grant
First Claim
Patent Images

1. A computer-implemented method for implementation by one or more data processors forming part of at least one computing device to facilitate detection and avoidance of undesirable system states of a system, the method comprising:

  • monitoring, by the one or more data processors, states of the system, the system comprising a plurality of components, the states of the system having state types and determined based on data instances of the plurality of components and/or the system, the data instances comprising machine-log-lines;

    receiving, by the one or more data processors, data instance groups representative of the states of the system, the data instance groups comprising one or more data instances associated with a state of the system and having time information;

    identifying, by the one or more data processors, a representative data instance for each data instance group;

    determining, by the one or more data processors, a sequence of state transitions based on the representative data instances and the time information, wherein each element of the sequence comprises a data instance group identifier and a data instance identifier;

    determining, based on the sequence of state transitions, by the one or more data processors, a distribution of state types within the data instance groups to identify infrequent state types;

    translating, by the one or more data processors, the sequence of state transitions into feature vectors, wherein the feature vectors comprise a first feature vector indicating a starting state of the sequence and a second feature vector indicating a time for the transition between a first state and a second state of the sequence, wherein each feature vector is associated with one or more feature classes;

    calculating, by the one or more data processors, a feature score for each feature vector based on kernel density estimation;

    determining, by the one or more data processors, a feature class score for individual feature classes of the one or more feature classes, the feature class score comprising a sum of feature scores having the same feature class;

    calculating, by the one or more data processors, a sequence anomaly score based on the feature class scores across the sequence of state transitions, the sequence anomaly score indicating a likelihood of a rare state and/or rare sequence;

    identifying, based on sequence anomaly scores, by the one or more data processors, rare states and/or rare sequences, wherein rare sequences include sequences of data instance groups that occur prior to an occurrence of a state having an infrequent state type; and

    providing, by the one or more data processors and in response to identifying the rare states and/or rare sequences, a notification of the occurrence of a rare sequence on the system.

View all claims
  • 1 Assignment
Timeline View
Assignment View
    ×
    ×