Self-Learning Integrity Management System and Related Methods

• US 20080077358A1
• Filed: 09/27/2006
• Published: 03/27/2008
• Est. Priority Date: 09/27/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Integrien Corp. (Broadcom, Inc.)
• Inventors: Marvasti, Mazda A.
• Granted Patent: US 7,467,067 B2
• Time in Patent Office: Days
• US Class Current: 702/187
• CPC Class Codes: G06N 20/00 Machine learning

Abstract

An integrity management system predicts abnormalities in complex systems before they occur based upon the prior history of abnormalities within the complex system. A topology of the nodes of a complex system is generated and data is collected from the system based on predetermined metrics. In combination with dynamic thresholding, fingerprints of the relevant nodes within a complex system at various time intervals prior to the occurrence of the abnormality are captured and weighted. The fingerprints can then be applied to real-time data provide alerts of potential abnormality prior to their actual occurrence.

Claims

1. A integrity management system comprising, in combination:

a topology of nodes;

a data collector;

at least one heuristic generator that provides at least one heuristic; and

an alerter, the alerter providing a notice of an occurrence of a potential event prior to the occurrence of the potential event; and

wherein data is collected by the data collector and compared to the at least one heuristic to provide a probability of a potential event; and

wherein if the probability crosses a threshold value, the alerter provides the notice.

2. The system of claim 1, wherein the at least one heuristic generator further comprises a dynamic thresholding system.

3. The system of claim 1, wherein the dynamic thresholding system identifies variations from normal or expected values in connection with providing a probability of a potential event.

4. The system of claim 1, wherein the at least one heuristic generator comprises a fingerprint generator and wherein the at least one heuristic comprises at least a fingerprint.

5. The system of claim 1, further comprising a database, the database storing data collected from the data collector.

6. The system of claim 5, wherein the data further comprises:

time series data;

event data; and

fingerprint data.

7. The system of claim 6, wherein the at least one heuristic is compared to at least one of the time series data, event data, and fingerprinting data to produce the probability of the potential event.

8. The system of claim 1, wherein the notice of the potential event is transmitted to a resolution system, the resolution system triggering at least one of an automated response to the event and a human intervention system.

9. The system of claim 1, wherein the potential event is an abnormality.

10. The system of claim 9, wherein the abnormality is a problem.

11. The system of claim 1, wherein the nodes comprise at least one of computer hardware and computer software.

12. A integrity management system comprising, in combination:

a computer;

a topology of nodes;

a data collector;

at least one heuristic generator that provides at least one heuristic; and

an alerter, the alerter providing a notice of a potential event prior to the occurrence of the potential event; and

wherein data is collected by the data collector and compared to the at least one heuristic to provide a probability of a potential event using the computer; and

wherein if the probability crosses a threshold value, the alerter provides the notice.

13. The system of claim 12, wherein the at least one heuristic generator further comprises a dynamic thresholding system and wherein the at least one heuristic comprises at least one dynamic threshold.

14. The system of claim 12, wherein the at least one heuristic generator comprises a fingerprint generator and wherein the at least one heuristic comprises at least a fingerprint.

15. The system of claim 12, further comprising a database, the database storing data collected from the data collector.

16. The system of claim 15, wherein the data comprises:

time series data;

event data; and

fingerprint data.

17. A dynamic thresholding system comprising, in combination:

at least one dynamically determined threshold associated with a metric, the dynamically determined threshold being changed at set intervals based on the metric'"'"'s observed data for a historical time period; and

a subsystem for detecting trend states, the trend state occurring when any dynamically determined threshold is exceeded continuously for a time period;

wherein when the subsystem detects a trend, an alert state is activated.

18. The dynamic thresholding system of claim 17, wherein a fingerprint is captured when the dynamic thresholding system observes a trend.

19. The dynamic thresholding system of claim 17, further comprising at least one hard threshold.

20. A method for detecting abnormalities in nodes by providing an integrity management system that performs steps comprising, in combination:

discovering a plurality of nodes;

constructing a topology of node interconnectedness;

collecting data;

using historical data to form at least one heuristic;

applying the at least one heuristic to the data, the application of the at least one heuristic outputting a probability of a potential event occurring prior to the actual occurrence of the event; and

at least one of generating an alert prior to the occurrence of the event and ameliorating the potential event.

21. The method of claim 20, wherein the at least one heuristic comprises a fingerprint of an event that occurred previously.

22. The method of claim 21, wherein the at least one heuristic further comprises a dynamic thresholding process.

23. The method of claim 20, wherein the at least one heuristic comprises a dynamic thresholding process.

24. The method of claim 20, wherein the data is collected from a plurality of metrics over a time period.

25. The method of claim 20, wherein the data comprises a plurality of events.

26. The method of claim 20, wherein at least a computer is used to apply the at least one heuristic to the data.

27. The method of claim 20, wherein the integrity management system monitors potential variations in information technology systems that indicate an abnormality.

28. The method of claim 27, wherein the information technology systems are at least one of computer hardware and computer software applications.

29. The method of claim 27, wherein the method is applied to at least a set of systems selected from the of the group consisting of traffic systems, weather systems, sports systems, biological systems, medical diagnosis systems, ecosystems, gaming systems, electricity grids and delivery systems, utility provision systems, crowd modeling systems, manufacturing systems, business systems and business models, mass transit scheduling systems, complex machines, human interactions and dating, musical systems, sales systems, inventory systems, acoustical systems, and environmental systems.

30. A machine-readable medium having program instructions stored thereon executable by a processing unit for performing the steps of:

discovering a plurality of nodes;

constructing a topology of node interconnectedness;

collecting data;

using historical data to form at least one heuristic;

applying the at least one heuristic to the data, the application of the at least one heuristic outputting a probability of a potential event occurring prior to the actual occurrence of the event; and

at least one of generating an alert prior to the occurrence of the event and ameliorating the potential event.

31. The machine-readable medium of claim 30, wherein the at least one heuristic comprises a fingerprint of an event that occurred previously.

32. The machine-readable medium of claim 31, wherein the at least one heuristic further comprises a dynamic thresholding process.

33. The machine-readable medium of claim 30, further comprising program instructions stored thereon for implementing a dynamic thresholding process for the at least one heuristic.

34. The machine-readable medium of claim 30, further comprising program instructions stored thereon for collecting the data from a plurality of metrics over a time period.

35. The machine-readable medium of claim 30, further comprising program instructions stored thereon for collecting data relating to a plurality of events.

36. The machine-readable medium of claim 30, further comprising program instructions stored thereon for applying the at least one heuristic to the data using a computer.

37. The machine-readable medium of claim 30, further comprising program instructions stored thereon for monitoring potential variations in information technology systems that indicate an abnormality.

38. The machine-readable medium of claim 37, wherein the information technology systems are at least one of computer hardware and computer software applications.

39. The machine-readable medium of claim 37, wherein the method is applied to at least a set of systems selected from the of the group consisting of traffic systems, weather systems, sports systems, biological systems, medical diagnosis systems, ecosystems, gaming systems, electricity grids and delivery systems, utility provision systems, crowd modeling systems, manufacturing systems, business systems and business models, mass transit scheduling systems, complex machines, human interactions and dating, musical systems, sales systems, inventory systems, acoustical systems, and environmental systems.