Method and system for analyzing and predicting the behavior of systems

• US 20030139905A1
• Filed: 12/19/2002
• Published: 07/24/2003
• Est. Priority Date: 12/19/2001
• Status: Active Grant

• Current Assignee: Metricly, Inc. (Virtana Corp.)
• Original Assignee: Netuitive, Inc. (Virtana Corp.)
• Inventors: Helsper, David, Jannarone, Robert, Rasmussen, Amanda, Huard, Jean-Francois, Homoki, David
• Granted Patent: US 7,280,988 B2
• Time in Patent Office: Days
• US Class Current: 702/182
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 2201/81 Threshold

Abstract

A monitoring system including a baseline model that automatically captures and models normal system behavior, a correlation model that employs multivariate autoregression analysis to detect abnormal system behavior, and an alarm service that weights and scores a variety of alerts to determine an alarm status and implement appropriate response actions. The baseline model decomposes the input variables into a number of components representing relatively predictable behaviors so that the erratic component e(t) may be isolated for further processing. These components include a global trend component, a cyclical component, and a seasonal component. Modeling and continually updating these components separately permits a more accurate identification of the erratic component of the input variable, which typically reflects abnormal patterns when they occur.

Claims

1. A method for analyzing and predicting the behavior of a system, comprising the steps of:

continually receiving measurements defining signatures for a plurality of input variables reflecting the behavior of the system, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial;

computing a time-based baseline mean and variance for a selected input variable based on the historical measurements for the selected input variable;

computing an erratic component for the selected input variable by comparing the measurement for the selected input value for the current time trial to the time-based baseline mean for the selected input variable;

computing an imputed estimate for the selected input variable based on erratic components computed for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables; and

determining an alert status for the imputed estimate based on the imputed estimate and the erratic component for the input variable for the current time trial.

2. The method of claim 1, further comprising the step of updating the time-based baseline mean and variance for the selected input variable based on the measurement received for the selected input value for the current time trial.

3. The method of claim 2, comprising the step of repeating the steps of claims 1 and 2 for multiple input variables.

4. The method of claim 3, further comprising the step of continually repeating the steps of claims 1, 2, and 3 for multiple current time trials.

5. The method of claim 1, wherein the step of determining the alert status for the imputed estimate comprises the steps of:

computing a confidence value associated with the imputed estimate;

computing a threshold value for the imputed estimate based on the confidence value;

computing an imputed estimate alert value reflecting a difference between the imputed estimate and the erratic component for the selected input variable to the threshold value; and

determining an alert status for the imputed estimate by comparing the alert value to the threshold value.

6. The method of claim 5, wherein:

the confidence value comprises a standard error associated with the imputed estimate; and

the threshold value is based on the standard error and a user-defined configuration parameter.

7. The method of claim 2, wherein the step of computing the time-based baseline mean and variance for the selected input variable comprises the steps of:

decomposing the signature for the input variable into components;

computing a mean and variance for each component;

combining the means for the components to obtain the time-based baseline mean; and

combining the variances for the components to obtain the time-based baseline variance.

8. The method of claim 7, wherein the step of decomposing the signature for the input variable into components comprises the steps of:

defining a repeating cycle for the historical measurements;

dividing the cycle into a plurality of contiguous time periods wherein each cycle comprises a similar set of time periods, each time period having a corresponding time index;

computing a global trend component for the selected input variable reflecting measurements received for the selected input variable for temporally contiguous time indices; and

computing a cyclical component for the selected input variable reflecting data accumulated across multiple cycles for each time index.

9. The method of claim 2, wherein the step of updating the time-based baseline mean and variance for the selected input variable comprises the steps of:

computing an updated baseline mean based on a weighted sum comprising the baseline mean for the selected input variable and the measurement for the current time trial for the selected input variable; and

computing an updated baseline variance based on a weighted sum comprising the baseline variance for the selected input variable and the measurement for the current time trial for the selected input variable.

10. The method of claim 7, wherein the step of updating the time-based baseline mean and variance for the selected input variable comprises the steps of:

computing an updated time-based baseline mean by;

computing an updated mean for each component based on a weighted sum comprising the baseline mean for the component and the measurement received for the selected input variable for the current time trial, and

summing the updated means for the components; and

computing an updated time-based baseline variance by;

computing an updated variance for each component based on a weighted sum comprising the baseline variance for the component and the measurement received for the selected input variable for the current time trial, and

summing the updated variances for the components.

11. The method of claim 4, further comprising the steps of:

receiving imputed estimate alerts corresponding to multiple input measurements;

weighting the alerts;

computing an alert score based on the weighted alerts; and

determining whether to activate an alarm condition based on the alert score.

12. A computer storage medium storing computer-executable instruction for performing the method of claim 1.

13. An apparatus configured to perform the method of claim 1.

14. A method for analyzing and predicting the behavior of a system, comprising the steps of:

continually receiving measurements defining signatures for a plurality of input variables reflecting the behavior of the system, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial;

computing a time-based baseline mean and variance for a selected input variable based on the historical measurements for the selected input variable;

computing an erratic component for the selected input variable by comparing the measurement for the selected input value for the current time trial to the baseline mean for the selected input variable;

computing a forecast estimate for the selected input variable based on erratic components computed for other input variables and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables; and

determining an alert status for the forecast estimate.

15. The method of claim 14, further comprising the step of updating the time-based baseline mean and variance for the selected input variable based on the measurement received for the selected input value for the current time trial.

16. The method of claim 15, comprising the step of repeating the steps of claims 14 and 15 for multiple input variables.

17. The method of claim 16, further comprising the step of continually repeating the steps of claims 14, 15, and 16 for multiple future forecasts.

18. The method of claim 17, further comprising the step of continually repeating the steps of claims 14, 15, 16, and 17 for multiple current time trials.

19. The method of claim 15, wherein the step of determining the alert status for the forecast estimate comprises the steps of:

computing a threshold value for the forecast estimate; and

determining an alert status for the forecast estimate by comparing the forecast estimate to the threshold value.

20. The method of claim 19, wherein the threshold value is based on the time-based baseline variance for the selected input variable and a user-defined configuration parameter.

21. The method of claim 15, wherein the step of computing the time-based baseline mean and variance for the selected input variable comprises the steps of:

decomposing the signature for the input variable into components;

computing a mean and variance for each component;

combining the means for the components to obtain the time-based baseline mean; and

combining the variances for the components to obtain the time-based baseline variance.

22. The method of claim 21, wherein the step of decomposing the signature for the input variable into components comprises the steps of:

defining a repeating cycle for the historical measurements;

dividing the cycle into a plurality of contiguous time periods wherein each cycle comprises a similar set of time periods, each time period having a corresponding time index;

computing a global trend component for the selected input variable reflecting measurements received for the selected input variable for temporally contiguous time indices; and

computing a cyclical component for the selected input variable reflecting data accumulated across multiple cycles for each time index.

23. The method of claim 15, wherein the step of updating the time-based baseline mean and variance for the selected input variable comprises the steps of:

computing an updated baseline mean based on a weighted sum comprising the baseline mean for the selected input variable and the measurement for the current time trial for the selected input variable; and

computing an updated baseline variance based on a weighted sum comprising the baseline variance for the selected input variable and the measurement for the current time trial for the selected input variable.

24. The method of claim 21, wherein the step of updating the time-based baseline mean and variance for the selected input variable comprises the steps of:

computing an updated time-based baseline mean by;

computing an updated mean for each component based on a weighted sum comprising the baseline mean for the component and the measurement received for the selected input variable for the current time trial, and

summing the updated means for the components; and

computing an updated time-based baseline variance by;

computing an updated variance for each component based on a weighted sum comprising the baseline variance for the component and the measurement received for the selected input variable for the current time trial, and

summing the updated variances for the components.

25. The method of claim 18, further comprising the steps of:

receiving imputed estimate alerts corresponding to multiple input measurements;

weighting the alerts;

computing an alert score based on the weighted alerts; and

determining whether to activate an alarm condition based on the alert score.

26. A computer storage medium storing computer-executable instruction for performing the method of claim 18.

27. An apparatus configured to perform the method of claim 18.

28. A method for analyzing and predicting the behavior of a system, comprising the steps of:

continually receiving measurements defining signatures for a plurality of input variables reflecting the behavior of the system, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial;

computing a time-based baseline mean and variance for a selected input variable based on the historical measurements for the selected input variable;

computing an erratic component for the selected input variable by comparing the measurement for the selected input value for the current time trial to the baseline mean for the selected input variable;

computing an imputed estimate for the selected input variable based on erratic components computed for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables;

determining an alert status for the imputed estimate based on the imputed estimate and the erratic component for the input variable for the current time trial;

computing a forecast estimate for the selected input variable based on erratic components computed for other input variables and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables; and

determining an alert status for the forecast estimate.

29. The method of claim 28, further comprising the step of updating the time-based baseline mean and variance for the selected input variable based on the measurement received for the selected input value for the current time trial.

30. The method of claim 29, comprising the step of repeating the steps of claims 28 and 28 for multiple input variables.

31. The method of claim 30, further comprising the step of continually repeating the steps of claims 28, 29, and 30 for multiple future forecasts.

32. The method of claim 31, further comprising the step of continually repeating the steps of claims 28, 29, 30, and 31 for multiple current time trials.

33. The method of claim 32, wherein the step of determining the alert status for the imputed estimate comprises the steps of:

computing a confidence value for the imputed estimate;

computing a threshold value for the imputed estimate based on the confidence value;

computing an imputed estimate alert value reflecting a difference between the imputed estimate and the erratic component for the selected input variable to the threshold value for the imputed estimate; and

determining an alert status for the imputed estimate by comparing the alert value to the threshold value for the imputed estimate.

34. The method of claim 33, wherein:

the confidence value for the imputed estimate comprises a standard error associated with the imputed estimate; and

the threshold value for the imputed estimate is based on the standard error and a user-defined configuration parameter.

35. The method of claim 34, wherein the step of determining the alert status for the forecast estimate comprises the steps of:

computing a threshold value for the forecast estimate; and

determining an alert status for the forecast estimate by comparing the forecast estimate to the threshold value.

36. The method of claim 35, wherein the threshold value is based on the time-based baseline variance for the selected input variable and a user-defined configuration parameter.

37. The method of claim 36, wherein the step of computing the time-based baseline mean and variance for the selected input variable comprises the steps of:

decomposing the signature for the input variable into components;

computing a mean and variance for each component;

combining the means for the components to obtain the time-based baseline mean; and

combining the variances for the components to obtain the time-based baseline variance.

38. The method of claim 37, wherein the step of decomposing the signature for the input variable into components comprises the steps of:

defining a repeating cycle for the historical measurements;

dividing the cycle into a plurality of contiguous time periods wherein each cycle comprises a similar set of time periods, each time period having a corresponding time index;

computing a global trend component for the selected input variable reflecting measurements received for the selected input variable for temporally contiguous time indices; and

computing a cyclical component for the selected input variable reflecting data accumulated across multiple cycles for each time index.

39. The method of claim 38, wherein the step of updating the time-based baseline mean and variance for the selected input variable comprises the steps of:

computing an updated baseline mean based on a weighted sum comprising the baseline mean for the selected input variable and the measurement for the current time trial for the selected input variable; and

computing an updated baseline variance based on a weighted sum comprising the baseline variance for the selected input variable and the measurement for the current time trial for the selected input variable.

40. The method of claim 39, wherein the step of updating the time-based baseline mean and variance for the selected input variable comprises the steps of:

computing an updated time-based baseline mean by;

computing an updated mean for each component based on a weighted sum comprising the baseline mean for the component and the measurement received for the selected input variable for the current time trial, and

summing the updated means for the components; and

computing an updated time-based baseline variance by;

computing an updated variance for each component based on a weighted sum comprising the baseline variance for the component and the measurement received for the selected input variable for the current time trial, and

summing the updated variances for the components.

41. The method of claim 40, further comprising the steps of:

receiving imputed estimate and forecast estimate alerts corresponding to multiple input measurements;

weighting the alerts;

computing an alert score based on the weighted alerts; and

determining whether to activate an alarm condition based on the alert score.

42. A computer storage medium storing computer-executable instruction for performing the method of claim 41.

43. An apparatus configured to perform the method of claim 41.