BEHAVIOR CLUSTERING ANALYSIS AND ALERTING SYSTEM FOR COMPUTER APPLICATIONS

• US 20150205692A1
• Filed: 01/13/2015
• Published: 07/23/2015
• Est. Priority Date: 01/23/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Concurix Corporation
• Inventors: SETO, Tetsuo
• Granted Patent: US 9,921,937 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis

Abstract

Dimensionality reduction, such as principal component analysis, may be used at least in part to generate a model of time series observations of a computer application. The model may be applied to current and predicted observations. Outliers may be identified from current or predicted observations by analyzing those observations against the model, and statistically relevant outliers may generate alerts or corrective or other action to be taken. The outliers may be analyzed by searching for similar outliers that may have been previously observed, and predicting any future events based on similar observations of the past.

Claims

1. A method performed on at least one computer processor, said method comprising:

generating a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application;

applying said dimensionality reduction transformation to a previously observed time series to generate transformed historical data;

receiving a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset;

comparing said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset.

2. The method of claim 1 further comprising:

performing a cluster analysis on said transformed historical data to generate cluster definitions within said transformed historical data.

3. The method of claim 2, said comparing said transformed current time series dataset comprising determining that a first observation in said transformed current time series dataset is an outlier with respect to said cluster definitions.

4. The method of claim 1 further comprising generating an alert based on said anomalous observation.

5. The method of claim 1 further comprising:

determining a predicted time series observation;

generating a predicted transformed observation by applying said dimensionality reduction transformation to said predicted time series observation; and

comparing said predicted transformed observation to said transformed historical data to identify a predicted outlier.

6. The method of claim 5 further comprising generating an alert based on said predicted transformed observation.

7. The method of claim 5, said predicted time series observation being made by analyzing time series having at least one similar time series segment.

8. A system comprising:

a processor;

a memory;

an analyzer operating on said processor and said memory, said analyzer that;

receives a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application;

applies said dimensionality reduction transformation to a previously observed time series to generate transformed historical data;

receives a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset;

compares said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset.

9. The system of claim 8, said analyzer that further:

receives cluster definitions within said transformed historical data.

10. The system of claim 9, said analyzer that further:

determines that said transformed current time series dataset comprising determining that a first observation in said transformed current time series dataset is an outlier with respect to said cluster definitions.

11. The system of claim 8 further comprising generating an alert based on said anomalous observation.

12. The system of claim 8, said analysis engine that further:

determines a predicted time series observation;

generates a predicted transformed observation by applying said dimensionality reduction transformation to said predicted time series observation; and

compares said predicted transformed observation to said transformed historical data to identify a predicted outlier.

13. The system of claim 12 further comprising generating an alert based on said predicted transformed observation.

14. The system of claim 12, said predicted time series observation being made by analyzing time series having at least one similar time series segment.