Device, system, and method of data monitoring, collection and analysis

• US 20060229931A1
• Filed: 05/16/2005
• Published: 10/12/2006
• Est. Priority Date: 04/07/2005
• Status: Active Grant

• Current Assignee: Mara-Ison Connective Limited
• Original Assignee: Olista Ltd. (Altruist Educational Services Pvt Ltd.)
• Inventors: Dayagi, Yoram, Haleva, Avraham, Mashal, Sharon, Fligler, Ariel
• Granted Patent: US 7,689,455 B2
• Time in Patent Office: Days
• US Class Current: 705/10
• CPC Class Codes: G06Q 10/0639 Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising

Abstract

A device, system and method for data monitoring, collection and analysis. A method may include creating one or more context insight records representing an indication of a behavior of a service based on raw footprint data related to use of said service by a population of users, and analyzing said one or more context insight records to detect a dynamically defined anomaly of said service.

Claims

1. A method comprising:

creating one or more context insight records representing an indication of a behavior of a service based on raw footprint data related to use of said service by a population of users; and

analyzing said one or more context insight records to detect a dynamically defined anomaly of said service.

2. The method of claim 1, further comprising:

inserting into said one or more context insight records a tag indicating a mapping of an item of said raw footprint data to a related behavior of said service.

3. The method of claim 1, further comprising:

dynamically generating a population description and a test to indicate a logical or functional property of said based on said one or more context insight records.

4. The method of claim 1, further comprising:

dynamically generating a population description and a test to indicate a quality-of-service associated with said population said one or more context insight records.

5. The method of claim 1, wherein analyzing comprises:

generating a first generation of candidate anomalies;

generating a consecutive generation of candidate anomalies by modifying, adding or deleting one or more candidate anomalies of said first generation; and

repeating generating consecutive generations of candidate anomalies until a convergence condition holds true.

6. The method of claim 5, wherein generating the second generation comprises:

activating a dimension of said one or more context insight records to modify said first generation into said second generation.

7. The method of claim 5, further comprising:

calculating a fitness parameter indicating a support level for said at least one candidate anomaly in said one or more context insight records based on an anomaly test.

8. The method of claim 5, wherein modifying comprises:

discarding a candidate anomaly based on an exclusion rule.

9. The method of claim 5, further comprising:

associating between a first candidate anomaly having a first property and a second candidate anomaly having a second property, based on a relation between the first property and the second property.

10. The method of claim 5, further comprising:

grouping a plurality of candidate anomalies into a cluster based on a common property of said plurality of anomalies.

11. The method of claim 5, further comprising:

creating a criteria dimension representing a common characteristic of at least one of said candidate anomalies.

12. The method of claim 5, further comprising:

creating a segmenting dimension to divide a group of candidate anomalies into a plurality of sub-groups based on a segmenting characteristic.

13. The method of claim 12, further comprising:

creating a testing dimension representing a criterion for testing at least one of said sub-groups; and

testing at least one of said sub-groups using said testing dimension.

14. The method of claim 1, further comprising:

monitoring changes in said anomaly over time; and

determining a trend of said anomaly based on said changes.

15. The method of claim 1, further comprising:

after detecting said anomaly, waiting a time period and checking whether said anomaly persists.

16. The method of claim 1, further comprising:

collecting said raw footprint data from said population of users of said service.

17. The method of claim 1, further comprising:

splitting a population associated with said anomaly into a plurality of groups; and

researching said anomaly by evaluating a first group of said plurality of groups in relation to a second group of said plurality of groups.

18. An apparatus comprising:

an analyzer to create one or more context insight records representing an indication of a behavior of a service based on raw footprint data related to use of said service by a population of users, and to analyze said one or more context insight records to detect a dynamically defined anomaly of said service.

19. The apparatus of claim 18, wherein said analyzer is to insert into said one or more context insight records a tag indicating a mapping of an item of said raw footprint data to a related behavior of said service.

20. The apparatus of claim 18, wherein said analyzer is to dynamically generate a population description and a test to indicate a logical or functional property of said based on said one or more context insight records.

21. The apparatus of claim 18, wherein said analyzer is to dynamically generate a population description and a test to indicate a quality-of-service associated with said population said one or more context insight records.

22. The apparatus of claim 18, wherein said analyzer is to generate a first generation of candidate anomalies, to generate a consecutive generation of candidate anomalies by modifying, adding or deleting one or more candidate anomalies of said first generation, and to repeat generating consecutive generations of candidate anomalies until a convergence condition holds true.

23. The apparatus of claim 22, wherein said analyzer is to activate a dimension of said one or more context insight records to modify said first generation into said second generation.

24. The apparatus of claim 22, wherein said analyzer is to calculate a fitness parameter indicating a support level for said at least one candidate anomaly in said one or more context insight records based on an anomaly test.

25. The apparatus of claim 22, wherein said analyzer is to discard a candidate anomaly based on an exclusion rule.

26. The apparatus of claim 22, wherein said analyzer is to associate between a first candidate anomaly having a first property and a second candidate anomaly having a second property, based on a relation between the first property and the second property.

27. The apparatus of claim 22, wherein said analyzer is to group a plurality of candidate anomalies into a cluster based on a common property of said plurality of anomalies.

28. The apparatus of claim 22, wherein said analyzer is to create a criteria dimension representing a common characteristic of at least one of said candidate anomalies.

29. The apparatus of claim 22, wherein said analyzer is to create a segmenting dimension to divide a group of candidate anomalies into a plurality of sub-groups based on a segmenting characteristic.

30. The apparatus of claim 29, wherein said analyzer is to create a testing dimension representing a criterion for testing at least one of said sub-groups, and to test at least one of said sub-groups using said testing dimension.

31. The apparatus of claim 18, wherein said analyzer is to monitor changes in said anomaly over time, and to determine a trend of said anomaly based on said changes.

32. The apparatus of claim 18, wherein said analyzer is to wait a time period after detecting said anomaly, and to check whether said anomaly persists.

33. The apparatus of claim 18, comprising a collector to collect said raw footprint data from said population of users of said service.

34. The apparatus of claim 18, wherein said analyzer is to split a population associated with said anomaly into a plurality of groups, and to research said anomaly by evaluating a first group of said plurality of groups in relation to a second group of said plurality of groups.

35. A machine-readable medium having stored thereon a set of instructions that, if executed by a machine, cause the machine to perform a method comprising:

creating one or more context insight records representing an indication of a behavior of a service based on raw footprint data related to use of said service by a population of users; and

analyzing said one or more context insight record to detect a dynamically defined anomaly of said service.

36. The machine-readable medium of claim 35, wherein the instructions result in:

inserting into said one or more context insight records a tag indicating a mapping of an item of said raw footprint data to a related behavior of said service.

37. The machine-readable medium of claim 35, wherein the instructions result in:

dynamically generating a population description and a test to indicate a logical or functional property of said based on said one or more context insight records.

38. The machine-readable medium of claim 35, wherein the instructions result in:

dynamically generating a population description and a test to indicate a quality-of-service associated with said population said one or more context insight records.

39. The machine-readable medium of claim 35, wherein the instructions result in:

generating a first generation of candidate anomalies;

generating a consecutive generation of candidate anomalies by modifying, adding or deleting one or more candidate anomalies of said first generation; and

repeating generating consecutive generations of candidate anomalies until a convergence condition holds true.