DETECTING ANOMALOUS STATES OF MACHINES

• US 20170139760A1
• Filed: 11/18/2015
• Published: 05/18/2017
• Est. Priority Date: 11/18/2015
• Status: Active Grant

• Current Assignee: Fair Isaac Corporation
• Original Assignee: Fair Isaac Corporation
• Inventors: Rahman, Shafi Ur, Gupta, Ashish
• Granted Patent: US 10,360,093 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 16/285 Clustering or classification

Abstract

The state of a system is determined in which data sets are generated that include a plurality of data instances representing states of one or more components of a computer system. The data instances generated by one or more data set sources that are configured to output a data instance in response to a trigger associated with the one or more components. The data instances are normalized by the application of one or more rules. The data instances from individual data set sources are separately collated to generate groups of time-specific collated data instances. State types may be assigned to each of the collated data instance groups. Distributions of state-types across the groups may be determined and a list of infrequent state-types may be generated based on the determined distributions of state-types across the groups.

Claims

1. A computer-implemented method for implementation by one or more data processors forming part of at least one computing device to facilitate the detection and avoidance of undesirable system states of a system, the method comprising:

monitoring, by the one or more data processors, states of the system, the system comprising a plurality of components, the states of the system having state types and being translated into data instance groups;

receiving, by the one or more data processors, the data instance groups;

determining, by the one or more data processors, distributions of state types within the data instance groups to identify infrequent state types;

identifying, by the one or more data processors, rare states and rare sequences, where rare sequences include sequences of data instance groups that occur prior to the occurrence of a state having an infrequent state type; and

providing, by the one or more data processors, a notification of the occurrence of a rare sequence on the system.

2. The computer-implemented method of claim 1, wherein the feature vectors are represented as strings.

3. The computer-implemented method of claim 1 wherein the feature vectors represented as numerical values.

4. The computer-implemented method of claim 1, wherein the data instance groups include attribute information associated with the state of the machine.

5. The computer-implemented method of claim 1, wherein translating the identified sequences into feature vectors comprises:

generating machine-state transition features associated with the identified sequences for inclusion in the feature vectors.

6. The computer-implemented method of claim 5, further comprising:

assigning feature scores to the machine-state transition features; and

, combining feature scores of the same feature class.

7. The computer-implemented method of claim 5, further comprising:

generating a graphical illustration or model showing the frequency of occurrence of the identified sequences.

8. The computer-implemented method of claim 6, further comprising:

generating a model showing the frequency of occurrence of the combined feature scores for one or more feature classes.

9. The computer-implemented method of claim 8, wherein the model is a graphical illustration.

10. The computer-implemented method of claim 1, wherein the feature vectors include the starting state of the identified sequence.

11. The computer-implemented method of claim 1, wherein individual feature vectors include the proportion of a state within a sequence of states.

12. The computer-implemented method of claim 1, wherein the feature vectors include an indication of the time for the transition between a first state and a second state of the sequence.

13. The computer-implemented method of claim 1, wherein the feature vectors include an indication of the number of data instance groups required to transition from a first state to a second state.

14. The computer-implemented method of claim 1, where in the data instance groups are generated through a process comprising:

receiving data sets that include a plurality of data instances representing states of one or more components of a system, the data instances being generated by one or more separate data set sources that are configured to output a data instance in response to a trigger associated with the one or more components and having associated time information;

normalizing the data instances of the data sets by applying one or more rules to the data instances; and

,

separately collating the data instances of the data sets from individual data set sources across individual time elements to generate groups of time-element-specific collated data instances.

15. The computer-implemented method of claim 14, wherein normalizing the data instances of the data sets comprises:

determining the relationship between observed states and unobserved states of the system.

16. The computer-implemented method of claim 14, wherein the data instance groups include data instances representative of machine-log-lines.

17. The computer-implemented method of claim 14, wherein the data sets include machine logs and the data instances include machine-log-lines.

18. A system capable of detecting anomalous states of the system, comprising:

at least one programmable processor; and

,

memory storing instructions which, when executed by the at least one programmable processor, implement operations comprising;

monitoring states of a machine comprising a plurality of components, the states of the machine having state types and being translated into data instance groups;

receiving the data instance groups;

determining distributions of state types within the data instance groups to identify infrequent state types;

identifying rare sequences, where rare sequences include sequences of data instance groups that occur prior to the occurrence of a state having an infrequent state type; and

providing a notification of the occurrence of a rare sequence on the machine.