SYSTEM AND METHOD FOR DETECTING PERFORMANCE ANOMALIES IN A COMPUTING SYSTEM

• US 20080270077A1
• Filed: 04/30/2007
• Published: 10/30/2008
• Est. Priority Date: 04/30/2007
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Cohen, Ira, Ozonat, Mehmet Kivanc, Symons, Julie A.
• Granted Patent: US 7,577,550 B2
• Time in Patent Office: Days
• US Class Current: 702/186
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/87 Monitoring of transactions

Abstract

A method comprises receiving, by learning logic, historical metrics of a computing system being monitored. The learning logic determines, from the received historical metrics, forms of sub-functions that are included in an equation, wherein each sub-function represents a dependency between two components linked in a hierarchical structure representing the computing system being monitored. State determination logic receives metric values of the computing system being monitored, and determines states that minimize the equation composed of the sub-functions over the received metric values. Finally, anomalous behavior of the computing system may be detected based on the determined states.

Claims

1. A method comprising:

receiving, by learning logic, historical metrics of a computing system being monitored;

determining, by the learning logic, from the received historical metrics, forms of sub-functions that are included in an equation, wherein each sub-function represents a dependency between two components linked in a hierarchical structure representing the computing system being monitored;

receiving, by state determination logic, metric values of the computing system being monitored;

determining, by state determination logic, states that minimize the equation composed of the sub-functions over the received metric values; and

detecting anomalous behavior of the computing system based on the determined states.

2. The method of claim 1 comprising:

determining, by the learning logic, said forms of said sub-functions that minimize the description length of said equation over the received historical metrics.

3. The method of claim 2 comprising:

selecting, by the learning logic, sub-functions d and h such that the description length represented by said equation is minimized over the received historical metrics;

wherein sub-function d_i is a cost function associated with a component i in a base layer of the hierarchical structure representing the computing system being monitored; and

wherein sub-function h_k,i is a function associated with each component i of each intermediate layer k of the hierarchical structure representing the computing system, where said function h_k,i is based on the state of the corresponding component i and the state of the component to which said corresponding component i is connected in a successive layer k+1 of the hierarchical structure.

4. The method of claim 3 further comprising:

selecting, by the state determination logic, arguments of sub-functions h and d that minimize said description length for the received metric values.

5. The method of claim 1 wherein said equation comprises:

$\mathrm{DL}=\underset{k=1}{\overset{K}{\sum <br><br>}}<br><br><br><br>\underset{i=1}{\overset{n_k}{\sum <br><br>}}<br><br><br><br>h_{k,i}<br><br>\left(s_k,s_{k+1}\right)+\underset{j=1}{\overset{n_1}{\sum <br><br>}}<br><br><br><br>d_j<br><br>\left(m_j,s_1\right);<br><br>$

wherein DL is description length;

wherein the hierarchical structure comprises K layers, with a number, n₁, of components in layer 1 that is equal to a number of metrics observed for the computing system; and

a number, n_k, of components in layer K is equal to one;

and a number, n_k, of components in layer k, where 1<

k<

K, is equal to the number of components in layer k;

wherein each component, i, in layer 1 is associated with a function of form d_i(m_i,s), where m_i is an observed value of metric i and s is a state variable; and

wherein each component, i, in each layer k is associated with a function of form h_k,i(s,t), where s is a state of the component and i is a state of the component to which it is connected in layer k+1.

6. The method of claim 5 wherein each component in layer k, where 1<

k<

K, is connected to;

(i) one or more components in layer k−

1; and

(ii) one and only one component in layer k+1.

7. The method of claim 5 wherein function d_i is a cost function whose value is high when a corresponding metric indicates abnormal behavior and is low when the corresponding metric indicates normal behavior.

8. The method of claim 1 comprising:

determining, by the state determination logic, said states that minimize a description length for the received metric values.

9. A method comprising:

receiving, by learning logic, historical metrics of a computing system being monitored;

determining, by the learning logic, a corresponding function for determining a state of at least one component of the computing system;

receiving, by state determination logic, at least one measured metric of the computing system being monitored; and

determining, by the state determination logic, a state of the at least one component of the computing system based on the determined corresponding function for determining the state.

10. The method of claim 9 wherein said determining said corresponding function comprises:

determining, by said learning logic, forms of sub-functions that are included in a given equation, wherein each sub-function represents a dependency between two components linked in hierarchical structure representing the computing system.

11. The method of claim 10 wherein said determining said state comprises:

determining, by the state determination logic, said state that minimizes the equation composed of the sub-functions over the received at least one measured metric.

12. The method of claim 11 wherein said equation comprises:

$\mathrm{DL}=\underset{k=1}{\overset{K}{\sum <br><br>}}<br><br><br><br>\underset{i=1}{\overset{n_k}{\sum <br><br>}}<br><br><br><br>h_{k,i}<br><br>\left(s_k,s_{k+1}\right)+\underset{j=1}{\overset{n_1}{\sum <br><br>}}<br><br><br><br>d_j<br><br>\left(m_j,s_1\right);<br><br>$

wherein DL is description length;

wherein the hierarchical structure comprises K layers, with a number, n₁, of components in layer 1 that is equal to a number of metrics observed for the computing system; and

a number, n_k, of components in layer K is equal to one;

and a number, n_k, of components in layer k, where 1<

k<

K, is equal to the number of components in layer k;

wherein each component, i, in layer 1 is associated with a function of form d_i(m_i,s), where m_i is an observed value of metric i and s is a state variable; and

wherein each component, i, in each layer k is associated with a function of form h_k,i(s,t), where s is a state of the component and t is a state of the component to which it is connected in layer k+1.

13. The method of claim 9 further comprising:

detecting anomalous behavior of the computing system based on the determined state.

14. A system comprising:

a hierarchical model representing at least a portion of a computing system;

learning logic operable to receive historical metrics of the computing system, and determine a corresponding function for determining a state of each component of the hierarchical model; and

state determination logic operable to receive at least one measured metric of the computing system, and determine a state of each component of the hierarchical model based on the determined corresponding function for determining the state.

15. The system of claim 14 wherein said corresponding function determined by said learning logic comprises forms of sub-functions that are included in a given equation, wherein each sub-function represents a dependency between two components linked in the hierarchical model.

16. The system of claim 15 wherein the state determination logic is operable to determine said states that minimize the given equation composed of the sub-functions over the received at least one measured metric.

17. The system of claim 16 wherein said given equation comprises:

$\mathrm{DL}=\underset{k=1}{\overset{K}{\sum <br><br>}}<br><br><br><br>\underset{i=1}{\overset{n_k}{\sum <br><br>}}<br><br><br><br>h_{k,i}<br><br>\left(s_k,s_{k+1}\right)+\underset{j=1}{\overset{n_1}{\sum <br><br>}}<br><br><br><br>d_j<br><br>\left(m_j,s_1\right);<br><br>$

wherein DL is description length;

wherein the hierarchical model comprises K layers, with a number, n₁, of components in layer 1 that is equal to a number of metrics observed for the at least a portion of the computing system; and

a number, n_k, of components in layer K is equal to one; and

a number, n_k, of components in layer k, where 1<

k<

K, is equal to the number of components in layer k;

wherein each component, i, in layer 1 is associated with a function of form d_i(m_i,s), where m_i, is an observed value of metric i and s is a state variable; and

wherein each component, i, in each layer k is associated with a function of form h_k,i(s,t), where S is a state of the component and t is a state of the component to which it is connected in layer k+1.

18. The system of claim 14 wherein said hierarchical model represents a distributed application implemented on the computing system.

19. The system of claim 14 wherein said hierarchical model comprises:

a base layer that corresponds to components of the at least a portion of the computing system for which metrics are observed;

one or more intermediate layers that correspond to system components that are dependent on one or more of the components of the base layer; and

an apex layer that corresponds to the at least a portion of the computing system for which metrics are observed, which is dependent on the components of the preceding layers.

20. The system of claim 14 wherein said learning logic and said state determination logic comprise computer-executable software code stored to computer-readable medium which, when executed by a computer, causes the computer to perform their respective operations.