Product agnostic pattern detection and management

• US 10,389,612 B1
• Filed: 01/25/2017
• Issued: 08/20/2019
• Est. Priority Date: 01/25/2017
• Status: Expired due to Fees

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Komendera, Szymon
• Primary Examiner(s): Vostal, Ondrej C
• Application Number:
  US15/415,459
• Time in Patent Office: 937 Days
• Field of Search: 709224
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 67/01 Protocols

Abstract

Systems and methods corresponding to a network monitoring and capacity service for a set of computing devices are provided. The network monitoring and capacity planning service collects individual operation information to determine one or more usage patterns for a set of operations information. Additionally, the network monitoring and capacity service can generate information related to compliance or deviation from the determined usage patterns.

Claims

1. A computer-implemented method comprising:

obtaining, by a network monitoring service for a defined period of time, a first set of operations information, the operations information related to one or more services;

in response to an expiration of the defined period of time, identifying, by the network monitoring service, one or more initial usage patterns based at least in part on the first set of operations information;

transmitting, by the network monitoring service, the identified one or more initial usage patterns to a computing device;

obtaining, by the network monitoring service from the computing device, information related to the transmitted initial usage patterns;

updating, by the network monitoring service, at least one of the one or more initial usage patterns based at least in part on the information related to the transmitted initial usage patterns to generate updated usage patterns;

obtaining, by the network monitoring service, a second set of operations information, the second set of operations information related to the one or more services;

determining, by the network monitoring service, compliance information corresponding to the second set of operations information based at least in part on the updated usage patterns;

generating, by the network monitoring service, notification information corresponding to the determined compliance information corresponding to the second set of operations information; and

transmitting, by the network monitoring service, the notification information.

2. The computer-implemented method as recited in claim 1, wherein identifying one or more initial usage patterns based at least in part on the first set of operations information includes automatically identifying the one or more initial usage patterns corresponding to identified non-random operations information.

3. The computer-implemented method as recited in claim 1 further comprising updating the updated usage patterns based at least in part on the second set of operations information.

4. The computer-implemented method as recited in claim 1, wherein obtaining information related to the transmitted initial usage patterns includes obtaining a confirmation that a usage pattern corresponds to an expected set of operations information for the defined period of time.

5. The computer-implemented method as recited in claim 1, wherein obtaining information related to the transmitted initial usage patterns includes obtaining a confirmation that a usage pattern corresponds to a lack of operations information for the defined period of time.

6. A system comprising:

one or more computing devices including a processor and a memory, the one or more computing devices configured to execute computer-readable instructions to implement a network monitoring service operable to;

obtain for a defined period of time, a first set of operations information related to providing one or more services on behalf of an identified customer;

identify, in response to an expiration of the defined period of time, at least one initial usage pattern based at least in part on the first set of operations information;

obtain a second set of operations information related to providing the one or more services on behalf of the identified customer;

determine a correlation between the second set of operations information and the at least one initial usage pattern identified based at least in part on the first set of operations information; and

generate notification information, the notification information corresponding to the correlation between the second set of operations information and the at least one initial usage pattern.

7. The system as recited in claim 6, wherein the network monitoring service identifies the at least one initial usage pattern based at least in part on non-random operations information values.

8. The system as recited in claim 6, wherein the network monitoring service identifies the at least one initial usage pattern based at least in part on a statistical analysis of the first set of operations information.

9. The system as recited in claim 6, wherein the network monitoring service updates the at least one initial usage pattern based at least in part on the second set of operations information.

10. The system as recited in claim 6, wherein to determine the correlation between the second set of operation information and the at least one initial usage pattern, the network monitoring service identifies operations information in compliance with the at least one initial usage pattern.

11. The system as recited in claim 6, wherein to determine the correlation between the second set of operation information and the at least one initial usage pattern, the network monitoring service identifies operations information deviating with the at least one initial usage pattern.

12. The system as recited in claim 6, wherein to determine the correlation between the second set of operations information and the at least one initial usage pattern, the network monitoring services identifies a lack of expected operations information based at least in part on the at least one initial usage pattern.

13. The system as recited in claim 6, wherein the network monitoring service obtains information related to the at least one initial usage pattern and updates the at least one initial usage pattern based at least in part on the information related to the at least one initial usage pattern.

14. A non-transitory computer-readable medium comprising computer-executable instructions that when executed by a computing device comprising at least one processor and a memory cause the computing device to:

obtain, for a determined period of time, a first set of operations information related to providing one or more services on behalf of an identified customer;

determine, in response to an expiration of the determined period of time, at least one initial usage pattern from the first set of operations information;

obtain a second set of operations information related to providing the one or more services on behalf of the identified customer;

characterize the second set of operations information based at least in part on the at least one initial usage pattern identified from the first set of operations information; and

generate notification information corresponding to the characterized second set of operations information based at least in part on the at least one initial usage pattern.

15. The non-transitory computer-readable medium as recited in claim 14, wherein characterizing the second set of operations information to the at least one usage pattern includes characterizing operations information as one of compliant with the at least one initial usage pattern or deviating from the at least one initial usage pattern.

16. The non-transitory computer-readable medium as recited in claim 14, wherein the instructions further cause the computing device to

transmit the at least one initial usage pattern to another computing device;

obtain, from the other computing device, information related to the at least one initial usage pattern; and

update the at least one initial usage pattern based at least in part on the information related to the transmitted initial usage pattern to generate an updated usage pattern.

17. The non-transitory computer-readable medium as recited in claim 14, wherein the operations information includes at least one of file system information, networking interface information, or computing device resource information.

18. The non-transitory computer-readable medium as recited in claim 14, wherein the at least one usage pattern is based at least in part on non-random operations information values.

19. A computer-implemented method comprising:

obtaining, for a determined period of time, a set of operations information related to providing a service on behalf of an identified customer;

determining, in response to an expiration of the determined period of time, an initial usage pattern corresponding to the set of operations information;

transmitting the initial usage pattern to a computing device;

receiving, from the computing device, usage pattern configuration information;

updating the initial usage pattern based at least in part on the usage pattern configuration information to generate an updated usage pattern;

obtaining, a second set of operations information, the second set of operations information to providing a service on behalf of an identified customer;

determining compliance information corresponding to the second set of operations information based at least in part on the updated usage patterns; and

implementing corrective measures based on the determined compliance information.

20. The computer-implemented method as recited in claim 19, wherein the usage pattern configuration information includes a confirmation that the initial usage pattern is valid.

21. The computer-implemented method as recited in claim 19 further comprising initiating display of a graphical interface on the computing device to enable a user to input the usage pattern configuration information.

22. The computer-implemented method as recited in claim 19 wherein the corrective measures comprise configuring at least one service to operate in a different configuration or mode.