Systems and methods for automated computer support

• US 20050038827A1
• Filed: 08/11/2004
• Published: 02/17/2005
• Est. Priority Date: 08/11/2003
• Status: Active Grant

• Current Assignee: Netskope Incorporated
• Original Assignee: Triumfant Incorporated
• Inventors: Hooks, David Eugene
• Granted Patent: US 7,593,936 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/1435 using file system or storage system metadata
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 16/7844 using original textual content or text extracted from visual content or transcript of audio data
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/5006 Creating or negotiating SLA contracts, guarantees or penalties
• CPC Class Codes: H04L 43/028 : by filtering
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: Y10S 707/99936 : Pattern matching access
• CPC Class Codes: Y10S 707/99938 : Concurrency, e.g. lock management in shared database

Abstract

Systems and methods for providing automated computer support are described herein. One described method comprises receiving a plurality of snapshots from a plurality of computers, storing the plurality of snapshots in a data store, and creating an adaptive reference model based at least in part on the plurality of snapshots. The described method further comprises comparing at least one of the plurality of snapshots to the adaptive reference model, and identifying at least one anomaly based on the comparison.

Claims

1. A method comprising:

receiving a plurality of snapshots from a plurality of computers;

storing the plurality of snapshots in a data store;

creating an adaptive reference model based at least in part on the plurality of snapshots;

comparing at least one of the plurality of snapshots to the adaptive reference model; and

identifying at least one anomaly based on the comparison.

2. The method of claim 1, further comprising matching the at least one anomaly to at least one recognition filter to diagnose a condition on at least one of the plurality of computers.

3. The method of claim 2, further comprising responding to the condition.

4. The method of claim 3, wherein responding to the condition comprises at least one of:

generating a notification;

submitting a trouble ticket to a problem management system;

requesting permission to take an action; and

removing the condition from at least one of the plurality of computers.

5. The method of claim 4, wherein removing the condition comprises causing a repair program to be executed on the at least one of the plurality of computers affected by the condition.

6. The method of claim 2, further comprising:

determining which of the plurality of computers are affected by the condition; and

causing a response to the condition to be executed on behalf of each of the plurality of computers affected by the condition.

7. The method of claim 2, wherein diagnosing the condition comprises identifying a root cause of the at least one anomaly.

8. The method of claim 2, wherein the at least one recognition filter comprises at least one of:

an asset name associated with the condition;

an asset value associated with the condition;

a combination of asset name and asset value associated with the condition;

a maximum threshold associated with an asset value and with the condition; and

a minimum threshold associated with an asset value and with the condition.

9. The method of claim 8, wherein the at least one recognition filter further comprises a wildcard.

10. The method of claim 8, wherein the at least one recognition filter comprises a control flag for determining whether to include the asset name and the asset value in the adaptive reference model.

11. The method of claim 2, wherein the at least one recognition filter comprises a textual description of the condition.

12. The method of claim 2, wherein the at least one recognition filter further comprises a severity indicator associated with the condition.

13. The method of claim 2, wherein the at least one recognition filter further comprises:

a recognition filter identifier;

a creator name; and

an update date-time.

14. The method of claim 2, wherein the at least one recognition filter is associated with a link to an automated response for the condition.

15. The method of claim 2, wherein the condition comprises a condition class.

16. The method of claim 2, wherein matching the at least one anomaly to the at least one recognition filter comprises identifying an asset name associated with the at least one anomaly that is present in a plurality of recognition filters.

17. The method of claim 2, wherein the at least one recognition filter comprise a plurality of recognition filters and wherein matching the at least one anomaly to the at least one recognition filter comprises identifying an asset value in the at least one anomaly that matches an asset value in the plurality of recognition filters.

18. The method of claim 2, further comprising determining a quality of a match between the at least one recognition filter and the at least one anomaly.

19. The method of claim 1, wherein each of the plurality of snapshots comprises a plurality of assets associated with one of the plurality of computers.

20. The method of claim 19, wherein each of the plurality of assets comprises an asset name and an asset value.

21. The method of claim 19, wherein each of the plurality of assets is associated with an asset type.

22. The method of claim 21, wherein the asset type comprises one of a file, a registry key, a performance measure, a service, a hardware component, a running process, a log, and a communication port.

23. The method of claim 1, wherein the at least one anomaly comprises at least one of the following:

an asset name that is unexpectedly present;

an asset name that is unexpectedly absent;

a string asset value that is unknown for an asset name associated with the string asset value;

a numerical asset value that is less than a minimum threshold or more than a maximum threshold for an asset name associated with the numerical asset value.

24. The method of claim 1, wherein comparing at least one of the plurality of snapshots to the adaptive reference model comprises:

generating a result; and

providing the result to a user.

25. The method of claim 1, wherein each of the plurality of snapshots comprises a plurality of pairs of asset names and asset values, and wherein comparing the at least one of the plurality of snapshots to the adaptive reference model comprises:

comparing each asset name to the adaptive reference model to identify an unexpectedly present asset name;

comparing each asset name to the adaptive reference model to identify an unexpectedly absent asset name; and

comparing each asset value to the adaptive reference model to identify an unknown or unusual asset value.

26. The method of claim 25, wherein comparing the at least one of the plurality of snapshots to the adaptive reference model further comprises determining whether an asset value falls below a minimum threshold or exceeds a maximum threshold.

27. The method of claim 25, wherein comparing the at least one of the plurality of snapshots to the adaptive reference model further comprises determining whether all of the asset names in the at least one of the plurality of snapshots exist within the adaptive reference model and are consistent with a plurality of high probability relationships among asset names.

28. The method of claim 25, wherein comparing the at least one of the plurality of snapshots to the adaptive reference model further comprises determining a confidence level associated with an analysis scope measure and a diagnostic accuracy measure.

29. The method of claim 1, wherein the plurality of snapshots comprises:

a base snapshot associated with one of the plurality of computers, the base snapshot comprising a plurality of asset names and asset values that represent the state of the one of the plurality of computers at a particular point in time; and

a delta snapshot associated with the one of the plurality of computers, the delta snapshot comprising a plurality of asset names and asset values that have changed since the base snapshot was created.

30. The method of claim 1, wherein the plurality of snapshots are created by a software agent that resides on each of plurality of computers.

31. The method of claim 30, further comprising collecting asset information for one of the plurality of snapshots according to at least one of:

a predetermined schedule and an occurrence of a predetermined event.

32. The method of claim 1, further comprising:

identifying a first occurrence of an asset name or asset value in one of the plurality of snapshots;

generating an identifier associated with the first occurrence of the asset name or asset value;

associating the identifier with the first occurrence of the asset name or asset value;

identifying a second occurrence of the asset name or asset value in the plurality of asset/value pairs; and

associating the identifier with the second occurrence of the asset name or asset value.

33. A computer-readable medium on which is encoded program code, the program code comprising:

program code for receiving a plurality of snapshots from a plurality of computers;

program code for storing the plurality of snapshots in a data store;

program code for creating an adaptive reference model based at least in part on the plurality of snapshots;

program code for comparing at least one of the plurality of snapshots to the adaptive reference model; and

program code for identifying at least one anomaly based on the comparison.

34. The computer-readable medium of claim 33, further comprising program code for matching the at least one anomaly to at least one recognition filter to diagnose a condition on at least one of the plurality of computers.

35. The computer-readable medium of claim 34, further comprising program code for responding to the condition.

36. The computer-readable medium of claim 35, wherein program code for responding to the condition comprises at least one of:

program code for generating a notification;

program code for submitting a trouble ticket to a problem management system;

program code for requesting permission to take an action; and

program code for removing the condition from at least one of the plurality of computers.

37. The computer-readable medium of claim 36, wherein program code for removing the condition comprises program code for causing a repair program to be executed on the at least one of the plurality of computers affected by the condition.

38. The computer-readable medium of claim 34, further comprising:

program code for determining which of the plurality of computers are affected by the condition; and

program code for causing a response to the condition to be executed on behalf of each of the plurality of computers affected by the condition.

39. The computer-readable medium of claim 34, wherein program code for diagnosing the condition comprises program code for identifying a root cause of the at least one anomaly.

40. The computer-readable medium of claim 34, wherein program code for matching the at least one anomaly to the at least one recognition filter comprises program code for identifying an asset name associated with the at least one anomaly that is present in a plurality of recognition filters.

41. The computer-readable medium of claim 34, wherein the at least one recognition filter comprise a plurality of recognition filters and wherein program code for matching the at least one anomaly to the at least one recognition filter comprises program code for identifying an asset value in the at least one anomaly that matches an asset value in the plurality of recognition filters.

42. The computer-readable medium of claim 34, further comprising program code for determining a quality of a match between the at least one recognition filter and the at least one anomaly.

43. The computer-readable medium of claim 33, wherein program code for comparing at least one of the plurality of snapshots to the adaptive reference model comprises:

program code for generating a result; and

program code for providing the result to a user.

44. The computer-readable medium of claim 33, wherein each of the plurality of snapshots comprises a plurality of pairs of asset names and asset values, and wherein program code for comparing the at least one of the plurality of snapshots to the adaptive reference model comprises:

program code for comparing each asset name to the adaptive reference model to identify an unexpectedly present asset name;

program code for comparing each asset name to the adaptive reference model to identify an unexpectedly absent asset name; and

program code for comparing each asset value to the adaptive reference model to identify an unknown or unusual asset value.

45. The computer-readable medium of claim 44, wherein program code for comparing the at least one of the plurality of snapshots to the adaptive reference model further comprises program code for determining whether an asset value falls below a minimum threshold or exceeds a maximum threshold.

46. The computer-readable medium of claim 44, wherein program code for comparing the at least one of the plurality of snapshots to the adaptive reference model further comprises program code for determining whether all of the asset names in the at least one of the plurality of snapshots exist within the adaptive reference model and are consistent with a plurality of high probability relationships among asset names.

47. The computer-readable medium of claim 44, wherein program code for comparing the at least one of the plurality of snapshots to the adaptive reference model further comprises program code for determining a confidence level associated with an analysis scope measure and a diagnostic accuracy measure.

48. The computer-readable medium of claim 33, wherein the plurality of snapshots are created by a software agent that resides on each of plurality of computers.

49. The computer-readable medium of claim 48, further comprising program code for collecting asset information for one of the plurality of snapshots according to at least one of:

a predetermined schedule and an occurrence of a predetermined event.

50. The computer-readable medium of claim 33, further comprising:

program code for identifying a first occurrence of an asset name or asset value in one of the plurality of snapshots;

program code for generating an identifier associated with the first occurrence of the asset name or asset value;

program code for associating the identifier with the first occurrence of the asset name or asset value;

program code for identifying a second occurrence of the asset name or asset value in the plurality of asset/value pairs; and

program code for associating the identifier with the second occurrence of the asset name or asset value.