System and method for trend estimation for application-agnostic statistical fault detection
First Claim
1. A system, comprising:
- one or more memory locations configured to store one or more applications and one or more distributions, wherein each of said one or more applications is comprised of one or more processes and threads;
one or more Central Processing Units operatively connected to said one or more memory locations, configured to execute said one or more applications on a host with a host operating system, configured to generate one or more statistical events for said one or more executing applications and said host operating system, and configured to calculate said one or more distributions for said one or more statistical events;
one or more second memory locations configured to store one or more trend-estimators configured to estimate trends in said statistical events using one or more of a dominant period, a fixed number of events or a dynamic number of events, configured to calculate de-trended statistical event data, and configured to detect trends in the statistical events, wherein said one or more trend-estimators estimate trend using one or more of differencing, a moving average, and a least squares estimate and said trend-estimators are calculated using one or more of a number of elements equal to the dominant period, a period of one-half the dominant period, or a period less than one-half the dominant period; and
a fault detector configured to de-trend the data for said one or more statistical events prior to calculation of said one or more distributions if said one or more trend-estimator indicate trend.
2 Assignments
0 Petitions
Accused Products
Abstract
Trend estimation for application-agnostic statistical fault detection of multi-process applications in environments with data trend includes at least one of: a multi-process application runs on a host. Statistical events are collected and sent to a statistical fault detector. The statistical fault detector creates one or more distributions and compares recent statistical event data to historical statistical event data and uses deviation from historical norm for fault detection. Trend is estimated, and if needed, removed from event data prior to the creation of distributions. Trend is estimated using spectral techniques, filter banks and Maximum Entry Spectral Estimation, and dominant frequencies are estimated and utilized to adapt to the environment.
30 Citations
20 Claims
-
1. A system, comprising:
-
one or more memory locations configured to store one or more applications and one or more distributions, wherein each of said one or more applications is comprised of one or more processes and threads; one or more Central Processing Units operatively connected to said one or more memory locations, configured to execute said one or more applications on a host with a host operating system, configured to generate one or more statistical events for said one or more executing applications and said host operating system, and configured to calculate said one or more distributions for said one or more statistical events; one or more second memory locations configured to store one or more trend-estimators configured to estimate trends in said statistical events using one or more of a dominant period, a fixed number of events or a dynamic number of events, configured to calculate de-trended statistical event data, and configured to detect trends in the statistical events, wherein said one or more trend-estimators estimate trend using one or more of differencing, a moving average, and a least squares estimate and said trend-estimators are calculated using one or more of a number of elements equal to the dominant period, a period of one-half the dominant period, or a period less than one-half the dominant period; and a fault detector configured to de-trend the data for said one or more statistical events prior to calculation of said one or more distributions if said one or more trend-estimator indicate trend. - View Dependent Claims (2, 3, 4, 5)
-
-
6. A system, comprising:
-
one or more memory locations configured to store one or more applications and one or more distributions, wherein each of said one or more applications is comprised of one or more processes and threads; one or more Central Processing Units operatively connected to said one or more memory locations, configured to execute said one or more applications on a host with a host operating system, configured to generate one or more statistical events for said one or more executing applications and said host operating system, and configured to calculate said one or more distributions for said one or more statistical events; one or more second memory locations configured to store one or more trend-estimators configured to estimate trends in said statistical events using one or more of a dominant period, a fixed number of events or a dynamic number of events, configured to calculate de-trended statistical event data, and configured to detect trends in the statistical events, wherein said dominant period is estimated using one or more of Fourier Transformation, Fast Fourier Transformation, Hilbert Transformation, filter bank, division of spectrum into frequency bands, or Maximum Entropy Spectral Estimation (MESE); and a fault detector configured to de-trend the data for said one or more statistical events prior to calculation of said one or more distributions if said one or more trend-estimator indicate trend. - View Dependent Claims (7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20)
-
Specification