AGGREGATING METRIC SCORES

• US 20190018723A1
• Filed: 07/11/2017
• Published: 01/17/2019
• Est. Priority Date: 07/11/2017
• Status: Abandoned Application

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: entIT Software LLC (Open Text Corporation)
• Inventors: Maurer, Ron, Lyan, Marina, Peres, Nurit, Vizer, Fernando, Danichev, Pavel, Tel, Shahar
• Application Number:
  US15/647,049
• Publication Number:
  US 20190018723A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/07 Responding to the occurrence of a fault, e.g. fault tolerance
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: G06F 17/40 Data acquisition and logging for input to computer G06F3/00
• CPC Class Codes: G06F 18/2433 Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
• CPC Class Codes: G06F 18/253 of extracted features
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2218/12 Classification; Matching
• CPC Class Codes: G06F 2218/14 by matching peak patterns
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods

Abstract

In some examples, host IDs associated with the respective source component and a result of a partial calculation of an aggregate metric score may be received from each of a plurality of source components associated with a host of an information technology (IT) system. The partial calculation based on individual metric scores may be associated with the respective source component. The aggregate metric score may be calculated using the partial calculations and the host IDs, the aggregate metric score associated with metric measurements of the source components.

Claims

1. A non-transitory computer-readable storage medium comprising instructions executable by a processor to:

receive, from each of a plurality of source components associated with a host of an information technology (IT) system, host IDs associated with the respective source component and a result of a partial calculation of an aggregate metric score, the partial calculation based on individual metric scores associated with the respective source component; and

calculate the aggregate metric score using the partial calculations and the host IDs, the aggregate metric score associated with metric measurements of the source components.

2. The non-transitory computer-readable storage medium of claim 1 wherein sets of metric data from data streams are to be collected and transformed into compatible time-series datasets.

3. The non-transitory computer-readable storage medium of claim 1 wherein

the source components associated with the host are represented by different host IDs, and

further comprising instructions executable by the processor to, before calculating the aggregate metric score, reconciling the differently represented host IDs into a unified host ID, and

wherein to calculate the aggregate metric score using the host IDs comprises to calculate the aggregate metric score using the unified host ID.

4. The non-transitory computer-readable storage medium of claim 1 wherein the partial calculation is based on contextual information of the IT system defining how to aggregate the individual metric scores into the aggregate metric score.

5. The non-transitory computer-readable storage medium of claim 4 wherein the contextual information defines which of the metric scores are to be aggregated when computing the aggregate metric score.

6. The non-transitory computer-readable storage medium of claim 4 wherein the contextual information defines relevance weights of the metric measurements to be used in the partial calculations.

7. The non-transitory computer-readable storage medium of claim 1 wherein the individual metric scores are individual breach scores and the aggregate metric score is an aggregate breach score, wherein the aggregate breach score represents an anomaly associated with the metric measurements of the source components.

8. The non-transitory computer-readable storage medium of claim 7 further comprising instructions executable by the processor to remediate the anomaly represented by the aggregate breach score.

9. The non-transitory computer-readable storage medium of claim 1 wherein the partial calculation and the calculation of the aggregate metric score involve calculating a weighted sum of individual metric scores, wherein the result of the partial calculation is a partial sum.

10. The non-transitory computer-readable storage medium of claim 1 further comprising instructions executable by the processor to determine whether to filter the calculated aggregate metric score from a set of aggregated metric scores based on whether the calculated aggregate metric score exceeds a threshold.

11. A system comprising:

a processor; and

a memory comprising instructions executable by the processor to;

receive, from each of a plurality of partitions associated with a host of a network, host IDs associated with the respective partition and a result of a partial sum calculation of an aggregate breach score, the partial sum calculation based on individual breach scores associated with the respective partition, the source components associated with the respective host being represented by different host IDs;

reconcile the differently represented host IDs into a unified host ID; and

compute the aggregate breach score using the partial calculations and the unified host ID, the aggregate breach score being a weighted sum and representing an anomaly in metric measurements of the partitions.

12. The system of claim 11 wherein sets of metric data from data streams are to be collected and transformed into compatible time-series datasets.

13. The system of claim 11 wherein the memory comprises instructions executable by the processor to receive user input of contextual information of the IT system defining which of the metric scores are to be aggregated when calculating the aggregate metric score.

14. The system of claim 11 wherein the memory comprises instructions executable by the processor to receive user input of contextual information of the IT system defining relevance weights of the metric measurements to be used in the partial sum calculations.

15. The system of claim 11 wherein the memory comprises instructions executable by the processor to remediate the anomaly represented by the aggregate breach score.

16. The system of claim 11 wherein the memory comprises instructions executable by the processor to determine whether to filter the calculated aggregate breach score from a set of aggregated breach scores based on whether the calculated aggregate breach score exceeds a threshold.

17. A method comprising:

by a processor;

receiving, from each of a plurality of source components associated with a host of a network, host IDs associated with the respective source component and a result of a partial calculation of an aggregate breach score, the partial calculation based on individual breach scores associated with the respective source component and being a map phase of a MapReduce model, the source components associated with the respective host being represented by different host IDs;

reconciling the differently represented host IDs into a unified host ID; and

computing the aggregate breach score using the partial calculations and the unified host ID, the aggregate breach score being a weighted sum and representing an anomaly in metric measurements of the source components, the computation being a reduce phase of a MapReduce model.

18. The method of claim 17 wherein the partial calculation is based on contextual information of the IT system defining which of the metric scores are to be aggregated when computing the aggregate metric score and defining relevance weights of the metric measurements to be used in the partial calculations.

19. The method of claim 17 further comprising determining whether to filter the aggregate breach score from a set of aggregated breach scores based on whether the aggregate breach score exceeds a threshold.

20. The method of claim 17 wherein sets of metric data from data streams are to be collected and transformed into compatible time-series datasets.