METHODOLOGY FOR INTELLIGENT PATTERN DETECTION AND ANOMALY DETECTION IN MACHINE TO MACHINE COMMUNICATION NETWORK

• US 20130346596A1
• Filed: 06/26/2012
• Published: 12/26/2013
• Est. Priority Date: 06/26/2012
• Status: Active Grant

• Current Assignee: Aeris Communications Inc.
• Original Assignee: Aeris Communications Inc.
• Inventors: BALAKRISHNAN, Subramanian, SHARMA, Narendra Kumar
• Granted Patent: US 10,237,290 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

The present invention relates generally to network communications, and more particularly to machine-to-machine (M2M) data communications. The present invention provides for a method, apparatus and computer program product for detecting performance event data across a machine-to-machine (M2M) network indicative of anomalous performance of data and thereafter alerting users of performance issues in real-time or near real-time.

Claims

1. A method for detecting performance event data across a machine-to-machine (M2M) network indicative of anomalous performance, comprising:

determining by identification one or more performance events to monitor;

acquiring data of one or more monitored performance events;

comparing the acquired data with one or more predetermined event characteristic limits over a predetermined period in real-time or near real-time; and

issuing an alert in response to compared acquired data exceeding the one or more predetermined event characteristic limits.

2. The method of claim 1, wherein the acquiring data further includes identifying one or more event data streams to monitor and indentifying data within the one or more event data streams.

3. The method of claim 2, wherein the identifying data within the one or more event streams further includes sourcing information from one or more log files of a server.

4. The method of claim 3, wherein the server is an authentication, authorization and accounting server.

5. The method of claim 2, wherein the identifying data within the one or more event streams further includes capturing identified data for the comparing.

6. The method of claim 3, wherein the comparing further includes comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.

7. The method of claim 6, wherein the comparing further includes comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period and with one or more historical files.

8. The method of claim 7, wherein at least one of the one or more historical files includes a historical alert file associated with the one or more events.

9. The method of claim 6, wherein the issuing an alert further includes associating a predetermined output routing for each of the one or more events.

10. The method of claim 9, wherein the issuing an alert further includes directing an asynchronous alert command to a command interface message queue associated with the predetermined output routing for receipt by one or more receiving devices associated with the predetermined output routing.

11. The method of claim 10, wherein the predetermined output is a dashboard display having predetermined content and being visually configured to provide at least one of one or more real time alerts and one or more near real time alerts.

12. The method of claim 11, wherein the predetermined content is provided in relation to one or more of a classification of an alert, a filter having predetermined characteristics for identifying receipt of an alert, and a receiving location preference.

13. The method of claim 11, wherein the dashboard display comprises at least one or more of an Alerts section displaying near real time alerts from multiple sources and a Device Details section displaying details of events in relation to a device.

14. An apparatus for communicating and issuing alerts in response to event data exceeding one or more event thresholds in a machine-to-machine (M2M) network, comprising:

a device protocol capable of communications with a server across a M2M network,

a device capable of communicating with a server system across the network using a communication adapter;

the server system having an application module for acquiring event data of one or more events, comparing acquired event data with one or more predetermined event characteristic limits over a predetermined period in real-time or near real-time; and

issuing a command in response to compared acquired data exceeding the one or more predetermined event characteristic limits; and

a notification means for issuing an alert to one or more recipients in response to the issued command, wherein the alert includes information in relation the event.

15. The apparatus of claim 14, wherein the server is in communication with one or more receiving devices.

16. The apparatus of claim 15, wherein the application module further includes logic to identify one or more event data streams to monitor and indentify data within the one or more event data streams.

17. The apparatus of claim 15, wherein the application module further includes logic to capture identified data for the comparing.

18. The apparatus of claim 14, wherein the application module further includes logic to compare the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.

19. The apparatus of claim 18, wherein the application module further includes logic to issue an alert to the one or more receiving devices.

20. The apparatus of claim 19, wherein the logic includes instruction to output a dashboard display having predetermined content and being visually configured to provide at least one of one or more real time alerts and one or more near real time alerts.

21. The apparatus of claim 19, wherein the logic is capable of providing predetermined content in relation to one or more of a classification of an alert, a filter having predetermined characteristics for identifying receipt and processing of an alert.

22. A computer program product stored on a computer usable medium, comprising:

computer readable program means for causing a computer to control an execution of an application to perform a method for detecting performance event data across a machine-to-machine (M2M) network indicative of anomalous performance, comprising;

determining by identification one or more performance events to monitor;

acquiring data of one or more monitored performance events;

comparing the acquired data with one or more predetermined event characteristic limits over a predetermined period in real-time or near real-time; and

issuing an alert in response to compared acquired data exceeding the one or more predetermined event characteristic limits.

23. The program product of claim 22, further comprising:

identifying one or more event data streams to monitor and identify data within the one or more event data streams;

capturing identified data; and

comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.

24. The program product of claim 23, further comprising comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period and with one or more historical files associated with the one or more events.

25. The program product of claim 24, wherein the predetermined event characteristic limits and the predetermined period may be dynamically input through a connected receiving device within the M2M network.

26. The program product of claim 24, further comprising outputting instructions to display a dashboard having predetermined content and being visually configured to provide at least one of one or more real time alerts and one or more near real time alerts.

27. The program product of claim 26, wherein the predetermined content is provided in relation to one or more of a classification of an alert, a filter having predetermined characteristics for identifying receipt and processing of an alert.