AUTOMATIC ALERT GENERATION

• US 20150326446A1
• Filed: 05/07/2014
• Published: 11/12/2015
• Est. Priority Date: 05/07/2014
• Status: Active Grant

• Current Assignee: GOTO Group Incorporated (LogMeIn, Inc.)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Thapliyal, Ashish V., Koverman, Christopher K., Avrionov, Nikolay
• Granted Patent: US 9,860,109 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/048 mobile agents
• CPC Class Codes: H04L 41/0627 by acting on the notification or alarm source
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

Improved techniques of identifying when a device needs of service involve using data analytics to determine conditions when a device administrator of a computerized device is to be sent an alert regarding that device. Along these lines, a device monitoring system receives state data from a device that indicates the device is in a particular state, e.g., running certain applications, using some percentage of the processor and memory capacity, etc. The device monitoring system maps the device state data to a decision of whether or not to send a device administrator an alert concerning the device. The decision itself is a result of applying a model to the state data that is derived from the application of data analytics on historical device state data and administrator login data.

Claims

1. In a device monitoring system, a method of identifying when a device is in need of service, the method comprising:

receiving device state data from the device, the device state data indicating that the device is in a particular state;

inputting the device state data into a model that maps the device state data to a likelihood that a typical system administrator accesses a modeled device when the modeled device is in the particular state, the model having been generated from a correlation operation between (i) device state data received from a set of devices, and (ii) administrator login data providing instances in time when system administrators accessed the set of devices; and

in response to a sufficiently high likelihood that the typical system administrator accesses the modeled device when the modeled device is in the particular state, sending a notification that the device is in need of service to a system administrator responsible for providing service to the device.

2. A method as in claim 1, further comprising, prior to receiving the device state data from the device:

obtaining the device state data from each of the set of devices;

obtaining the administrator login data from each of the set of devices;

performing the correlation operation to generate the model; and

storing the model, the device state data, and the administrator login data in a database.

3. A method as in claim 2, wherein obtaining the device state data from each of the set of devices includes:

installing a software agent on that device, the software agent being configured to (i) collect device state data from that device, and (ii) cause that device to send the collected device state data to the database for storage; and

receiving the collected device state data from that device.

4. A method as in claim 3, wherein obtaining the device state data from each of the set of devices further includes receiving the device state data in response to the software agent observing a change in the administrator login data of that device;

and

wherein obtaining the administrator login data from each of the set of devices includes receiving the change in the administrator login data observed by the software agent installed on that device.

5. A method as in claim 4, where performing the correlation operation includes, upon receiving the change in the administrator login data from that device, forming a transition state from a difference between the device state data received from that device in response to the change in the administrator login data and a previous device state data received from that device, the model generated being based on the transition state.

6. A method as in claim 2, further comprising:

receiving an indication of whether the system administrator responsible for providing service to the device accessed the device in response to receiving the notification that the device is in need of service; and

inputting the indication into a machine learning module, the machine learning module being configured to adjust the model based on indications of whether a system administrator responsible for providing service to a device accessed the device in response to receiving the notification that the device is in need of service.

7. A method as in claim 2, wherein performing the correlation operation includes deriving, from the device state data, classes of similar modeled devices, each class of similar modeled devices including modeled devices having similar device states according to a similarity metric, each class of similar modeled devices having a common model that maps device state data indicative of a device being in a given state to the likelihood that a typical system administrator accesses a modeled device when the modeled device is in the given state;

wherein receiving the device state data from the device includes assigning the device to a particular class of similar modeled devices; and

wherein inputting the device state data into the model includes inputting the device state data into the common model of the particular class of similar modeled devices.

8. A method as in claim 7, wherein device state data of each device includes values of a set of state parameters, each of the set of state parameters representing a corresponding feature of that device;

wherein the similarity metric for each class of similar modeled devices is defined by an aggregate value for each of the set of state parameters; and

wherein assigning the device to the particular class of similar modeled devices includes evaluating a difference between values of parameters of the set of parameters of the device and the aggregate values of the parameters.

9. A method as in claim 8, further comprising receiving a selected set of parameters of the set of parameters;

wherein evaluating the difference between the values of the parameters of the set of parameters of the device and the aggregate values of the parameters includes computing a difference between the values of parameters of the selected set of parameters and the aggregate values of the selected set of parameters only.

10. A method as in claim 8, wherein deriving the classes of similar modeled devices includes, for each class of similar modeled devices, assigning a mean value of a state parameter of the set of state parameters, the mean value being equal to an average value of the state parameter taken over the devices assigned to that class of similar modeled devices;

and

wherein inputting the device state data into the model includes evaluating a deviation of the value of the state parameter of the device state data of the device from the mean value of the state parameter for the class to which the device is assigned.

11. A method as in claim 8, wherein sending the notification that the device is in need of service includes sending a solution script to the system administrator responsible for providing service to the device, the solution script containing a sequence of steps configured to being the device from the particular state to a second state, the solution script having been generated from sequences of steps received from the set of devices, each sequence of steps having been taken upon a login by a system administrator of a device that was recorded in the administrator login data of that device.

12. A method as in claim 11, further comprising:

obtaining, from each of the set of devices and prior to sending the notification, a sequence of steps taken by a system administrator responsible for providing service to that device, the sequence of steps being taken upon a login by the system administrator that was recorded in the administrator login data received from that device; and

generating, from sequences of steps obtained from the set of devices, the solution script configured to bring the device from being in the particular state to being in the second state.

13. A method as in claim 12, wherein generating the solution script includes:

locating devices assigned to a class of similar modeled devices which exhibit a transition between being in the first state and being in the second state; and

for each device located, identifying steps of the sequences of steps that accomplish the transition.

14. A method as in claim 13, wherein generating the solution script further includes

translating the identified steps into a scripting language compatible with the device;

and

producing a solution script file containing the solution script expressed in the scripting language compatible with the device.

15. A method as in claim 13, wherein identifying the steps includes obtaining a script used in transitioning that device from being in the first state to being in the second state.

16. A method as in claim 8, wherein an application state parameter of the set of state parameters of the device has a value identifying applications running on the device;

and

wherein sending the notification that the device is in need of service includes identifying (i) a first application of the set of applications exhibiting anomalous behavior, and (ii) a second application of the set of applications causing the anomalous behavior exhibited by the first application.

17. A method as in claim 16, further comprising obtaining, from each of the set of devices and prior to sending the notification, an error log corresponding to each application running on that device, the error log indicating times at which that application exhibited anomalous behavior;

and

wherein identifying the first application of the set of applications exhibiting anomalous behavior includes reading an error log corresponding to the first application received from the device.

18. A method as in claim 17, further comprising performing a pattern detection operation on the error logs received from the set of devices, the pattern detection operation being configured to identify second applications of the set of applications that cause first applications of the set of applications to exhibit anomalous behavior.

19. A method as in claim 1, wherein the model is further generated from another correlation operation between (i) the device state data, (ii) the administrator login data, and (iii) administrator alert data indicating whether a system administrator responsible for providing service to a device accessed the device in response to receiving an alert;

and

wherein sending the notification that the device is in need of service to the system administrator responsible for providing service to the device includes verifying, from the model, whether the system administrator is likely to access the device in response to receiving the alert.

20. An electronic apparatus constructed and arranged to identify when a device is in need of service, the apparatus comprising:

a network interface; and

a controller containing memory circuitry and controlling circuitry coupled to the memory circuitry, the controlling circuitry being constructed and arranged to;

receive device state data over the network interface from the device, the device state data indicating that the device is in a particular state;

input the device state data into a model that maps the device state data to a likelihood that a typical system administrator accesses a modeled device when the modeled device is in the particular state, the model having been generated from a correlation operation between (i) device state data received from a set of devices, and (ii) administrator login data providing instances in time when system administrators accessed the set of devices; and

in response to a sufficiently high likelihood that the typical system administrator accesses the modeled device when the modeled device is in the particular state, send, over the network interface, a notification that the device is in need of service to a system administrator responsible for providing service to the device.

21. A computer program product comprising a non-transitory, computer-readable storage medium which stores code, the code including a compiler which when executed by a computer configured to identify when a device is in need of service, causes the computer to:

receive device state data over the network interface from the device, the device state data indicating that the device is in a particular state;

input the device state data into a model that maps the device state data to a likelihood that a typical system administrator accesses a modeled device when the modeled device is in the particular state, the model having been generated from a correlation operation between (i) device state data received from a set of devices, and (ii) administrator login data providing instances in time when system administrators accessed the set of devices; and

in response to a sufficiently high likelihood that the typical system administrator accesses the modeled device when the modeled device is in the particular state, send, over the network interface, a notification that the device is in need of service to a system administrator responsible for providing service to the device.