Identifying deviations in data

• US 10,560,469 B2
• Filed: 01/24/2014
• Issued: 02/11/2020
• Est. Priority Date: 01/24/2014
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Owhadi, Eric
• Primary Examiner(s): Jhaveri, Jayesh M
• Application Number:
  US15/112,758
• Publication Number:
  US 20160352767A1
• Time in Patent Office: 2,209 Days
• CPC Class Codes: G06F 16/2456 Join operations
• CPC Class Codes: G06F 17/16 Matrix or vector computation , e.g. matrix-matrix or matrix-vector multiplication, matrix factorization matrix transposition G06F7/78
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: G06F 18/2433 Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

In an example, metrics that cause a deviation in data may be identified by collecting the data for selected metrics stored in a plurality of tables. A metric vector is constructed based on the data for the selected metrics. A probability density may be calculated for the metric vector that indicates a deviation value for the metric vector relative to other metric vectors. Moreover, an outlier metric from the metric vector that causes the deviation value for the metric vector may be identified.

Claims

1. A method implemented in operation control information technology environment, to identify metrics that cause a deviation in data, comprising:

collecting, by a processor, the data for selected metrics stored in a plurality of tables, wherein the data includes operational data fetched from one or more system components comprising servers, network components or storage components;

constructing a metric vector based on the data for the selected metrics,

wherein the selected metrics include a percent of memory used by a server, a percent of a computer processing unit (CPU) used by the server, or an input/output utilization of the server monitored over a period of time;

calculating a probability density for the metric vector that indicates a deviation value for the metric vector relative to other metric vectors,

wherein the calculating of the probability density for the metric vector includes implementing a Multivariate Gaussian Distribution algorithm; and

identifying an outlier metric from the metric vector that causes the deviation value for the metric vector, wherein the identifying of the outlier metric includes;

selecting a maximum outlier product from the multiplication of (x−

μ

)^TΣ

<sup>−

1</sup> and (x−

μ

), where x is the metric vector, μ

is a mean distribution vector, and Σ

is a covariance matrix, and

determining the outlier metric based on the maximum outlier product; and

detecting anomaly associated with the one or more system components based on the outlier metric.

2. The method of claim 1, wherein the determining of the outlier metric includes comparing a first metric from the maximum outlier product that is equal to (x−

μ

)^TΣ

<sup>−

1</sup> to a second metric from the maximum outlier product that is equal to (x−

μ

).

3. The method of claim 2, wherein the second metric is identified as the outlier metric that solely causes the deviation value responsive to the second metric being greater than the first metric, and the second metric is identified as correlating with another metric to cause the deviation value responsive to the second metric being less than the first metric.

4. The method of claim 3, wherein identifying the another metric includes:

calculating C_i,j=Σ

_i,j√

{square root over (Σ

_i,iΣ

_j,j)} to determine the another metric, where C is a correlation matrix representing the degree of correlation between the second metric i and the another metric j;

computing the maximum value of |C_i,j|; and

reporting the another metric j and a direct or inverse correlation between the second metric i and the another metric j represented by a sign of C_i,j.

5. The method of claim 1, wherein the constructing of the metric vector includes:

normalizing the data for the selected metrics within designated time boundaries; and

creating a pivot for each node of the selected metrics,

wherein the normalizing of the data for the selected metrics and the creating of the pivot for each node of the selected metrics are implemented by an in-memory join syntax.

6. The method of claim 1, including triggering an alert responsive to the calculated probability density value reaching a predetermined threshold.

7. The method of claim 1, including generating a report, wherein the report includes a column for the calculated probability density and a column for the identified outlier metric.

8. A system for operation control information technology environment, to identify metrics that cause a deviation in data, comprising:

a processor and a memory;

a data collector engine stored in a memory, executed by the processor, to collect the data for selected metrics stored in a plurality of tables, wherein the data includes operational data fetched from one or more system components comprising servers, network components or storage components;

a vector generating engine, stored in the memory, to construct a metric vector based on the data for the selected metrics, wherein the selected metrics include a percent of memory used by a server, a percent of a computer processing unit (CPU) used by the server, or an input/output utilization of the server monitored over a period of time;

a probability engine, stored in the memory, to calculate a probability density for the metric vector using a Multivariate Gaussian Distribution algorithm, wherein the probability density indicates a deviation value for the metric vector relative to other metric vectors; and

an outlier engine, stored in the memory, to identify an outlier metric from the metric vector that causes the deviation value for the metric vector, wherein the identifying of the outlier metric includes;

selecting a maximum outlier product from the multiplication of (x−

μ

)^TΣ

<sup>−

1</sup> and (x−

μ

), where x is the metric vector, μ

is a mean distribution vector, and Σ

is a covariance matrix, and

determining the outlier metric based on the maximum outlier product; and

detecting anomaly associated with the one or more system components based on the outlier metric.

9. The system of claim 8, wherein to determine the outlier metric the outlier engine is to:

compare a first metric from the maximum outlier product that is equal to (x−

μ

)^TΣ

<sup>−

1</sup> to a second metric from the maximum outlier product that is equal to (x−

μ

);

in response to the second metric being greater than the first metric, identify the second as the outlier metric that solely causes the deviation value; and

in response to the second metric being less than the first metric, identify the second metric as correlating with another metric to cause the deviation value.

10. The system of claim 9, wherein to identify the another metric, the outlier engine is to:

calculate C_i,j=Σ

_i,j/√

{square root over (Σ

_i,iΣ

_j,j)} to determine the another metric, where C is a correlation matrix representing the degree of correlation between the second metric i and the another metric j;

compute the maximum value of |C_i,j|; and

report the another metric j and a direct or inverse correlation between the second metric i and the another metric j represented by a sign of C_i,j.

11. The system of claim 8, wherein to construct a metric vector, the vector generating engine is to:

normalize the data for the selected metrics within designated time boundaries; and

create a pivot for each node of the selected metrics,

wherein the normalizing of the data for the selected metrics and the creating of the pivot for each node of the selected metrics are implemented by an in-memory join syntax.

12. A non-transitory computer readable medium including machine readable instructions executable by a processor in operation control information technology environment, to:

collect data for selected metrics stored in a plurality of tables, wherein the data includes operational data fetched from one or more system components comprising servers, network components or storage components;

construct a metric vector based on the data for the selected metrics, wherein the selected metrics include a percent of memory used by a server, a percent of a computer processing unit (CPU) used by the server, or an input/output utilization of the server monitored over a period of time;

calculate a probability density for the metric vector using a Multivariate Gaussian Distribution algorithm, wherein the probability density indicates a deviation value for the metric vector relative to other metric vectors; and

identify an outlier metric from the metric vector that causes the deviation value for the metric vector, wherein the identifying of the outlier metric includes;

selecting a maximum outlier product from the multiplication of (x−

μ

)^TΣ

<sup>−

1</sup> and (x−

μ

), where x is the metric vector, μ

is a mean distribution vector, and Σ

is a covariance matrix, and

determining the outlier metric based on the maximum outlier product; and

detecting anomaly associated with the one or more system components based on the outlier metric.