Machine discovery of aberrant operating states
First Claim
1. A system comprising:
- a plurality of network devices associated with a cloud platform, each network device of the plurality of network devices configured to generate a respective data stream that includes a current value of a performance metric in real-time;
a decision system in communication with the plurality of network devices, the decision system comprising;
a processor;
a non-transitory computer readable medium comprising instructions executable by the processor to;
obtain, via the plurality of network devices, one or more data streams, each of the one or more data streams comprising real-time time-series data indicative of a network activity generated by a respective network device;
build a historic model of historic data for a data stream of the one or more data streams;
generate a windowed data stream, wherein the data stream includes a series of data points in time, wherein the windowed data stream is a list of fixed length data comprising historic values of the data stream;
add a new data point indicative of the current value of the data stream to the windowed data stream, wherein each new data point causes an ejection of a corresponding historic data point of the window;
determine one or more phase offsets for the windowed data stream, wherein the series of data points of the windowed data stream is shifted by the phase offset;
determine a phase weight for each respective phase offset of the one or more phase offsets;
determine, in real-time, a predicted value of the data stream at a future time, based on the historic model and based, at least in part, on the one or more phase offsets as weighted by a respective phase weight;
determine a variation between the predicted value and the current value of the data stream at the future time;
determine whether an anomaly has occurred based on whether the variation exceeds a threshold variation, wherein the threshold variation is determined as a function of the historic model; and
update the historic model based on the determination of whether the anomaly has occurred.
1 Assignment
0 Petitions
Accused Products
Abstract
Novel tools and techniques for the machine discovery of aberrant states are provided. A system includes a plurality of network devices, and a decision system in communication with the plurality of network devices. Each of the plurality of network devices may be configured to generate a respective data stream. The decision system may include a processor and a non-transitory computer readable medium including instructions executable by the processor to obtain, via the plurality of network devices, one or more data streams. The decision system may build a historic model of a data stream, and determine a predicted value of the data stream at a future time, based on the historic model. The decision system may be configured to determine whether an anomaly has occurred based on a variation between a current value of the data stream and the predicted value of the data stream.
-
Citations
14 Claims
-
1. A system comprising:
-
a plurality of network devices associated with a cloud platform, each network device of the plurality of network devices configured to generate a respective data stream that includes a current value of a performance metric in real-time; a decision system in communication with the plurality of network devices, the decision system comprising; a processor; a non-transitory computer readable medium comprising instructions executable by the processor to; obtain, via the plurality of network devices, one or more data streams, each of the one or more data streams comprising real-time time-series data indicative of a network activity generated by a respective network device; build a historic model of historic data for a data stream of the one or more data streams; generate a windowed data stream, wherein the data stream includes a series of data points in time, wherein the windowed data stream is a list of fixed length data comprising historic values of the data stream; add a new data point indicative of the current value of the data stream to the windowed data stream, wherein each new data point causes an ejection of a corresponding historic data point of the window; determine one or more phase offsets for the windowed data stream, wherein the series of data points of the windowed data stream is shifted by the phase offset; determine a phase weight for each respective phase offset of the one or more phase offsets; determine, in real-time, a predicted value of the data stream at a future time, based on the historic model and based, at least in part, on the one or more phase offsets as weighted by a respective phase weight; determine a variation between the predicted value and the current value of the data stream at the future time; determine whether an anomaly has occurred based on whether the variation exceeds a threshold variation, wherein the threshold variation is determined as a function of the historic model; and update the historic model based on the determination of whether the anomaly has occurred. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. An apparatus comprising:
-
a processor; a non-transitory computer readable medium comprising instructions executable by the processor to; obtain, via a plurality of network devices, one or more data streams, each of the one or more data streams comprising real-time time-series data indicative of a network activity generated by a respective network device; build a historic model of historic data for a data stream of the one or more data streams; generate a windowed data stream, wherein the data stream includes a series of data points in time, wherein the windowed data stream is a list of fixed length data comprising historic values of the data stream; add a new data point indicative of the current value of the data stream to the windowed data stream, wherein each new data point causes an ejection of a corresponding historic data point of the window; determine one or more phase offsets for the windowed data stream, wherein the series of data points of the windowed data stream is shifted by the phase offset; determine a phase weight for each respective phase offset of the one or more phase offsets; determine, in real-time, a predicted value of the data stream at a future time, based on the historic model and based, at least in part, on the one or more phase offsets as weighted by a respective phase weight; determine a variation between the predicted value and the current value of the data stream at the future time; determine whether an anomaly has occurred based on whether the variation exceeds a threshold variation, wherein the threshold variation is determined as a function of the historic model; and update the historic model based on the determination of whether the anomaly has occurred. - View Dependent Claims (11, 12, 13, 14)
-
Specification