Systems and methods for adaptive profiling, fault detection, and alert generation in a changing environment which is measurable by at least two different measures of state

• US 6,073,089 A
• Filed: 10/22/1997
• Issued: 06/06/2000
• Est. Priority Date: 10/22/1997
• Status: Expired due to Term

• Current Assignee: Vivint Incorporated (NRG Energy, Inc.)
• Original Assignee: Intellinet (Intellinet Technologies Incorporated)
• Inventors: Ryan, Thomas A., Baker, Michelle
• Primary Examiner(s): SHAH, KAMINI S
• Application Number:
  US08/956,227
• Time in Patent Office: 958 Days
• Field of Search: 702/163-185, 702/45, 702/130, 371/25.1, 371/25.2, 73/117.3, 73/116, 714/25
• US Class Current: 702/185
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/2252 using fault dictionaries
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods

Abstract

Systems and methods for detecting changes, and in particular faults, in a changing environment include constructing a profile of the environment using observations made during no fault conditions. A range of values for one or more "trusted" variables are identified as values indicative of a no fault condition. Data is also collected (only at times when the trusted variable(s) indicate(s) no fault) for other variables which may be indicative of a fault condition. Statistical profiles are established for each of these other variables. The environment is continuously monitored and the normal profile, as well as the thresholds/ranges, are preferably continuously updated during normal conditions, as indicated by the trusted variable(s). When, during monitoring of the environment, the trusted variable(s) exhibit value(s) outside the normal range, a possible fault condition is indicated and the present values of the other variables are examined to determine whether or not any of these variables exhibit values outside the normal profiled thresholds/ranges. Depending on which of these variables exhibits an abnormal value, a diagnosis of the fault may be possible. A method for determining the accuracy of trusted and fault variables is also disclosed.

Claims

1. A method for detecting a first state of an environment which is measurable by at least two different measures of state, said method comprising:

a) identifying a first measure of the state of the environment, the first measure being capable of indicating that the environment is not in the first state;

b) identifying a second measure of the state of the environment, the second measure being capable of indicating that the environment is in the first state;

c) building a profile over time of values of the second measure using samples taken only when values of the first measure indicates that the environment is not in the first state; and

d) monitoring the environment over time to determine whether values of the second measure deviate from the profile.

2. A method according to claim 1, wherein:

said step of monitoring includes sampling values of the first measure over time and determining whether a value of the second measure deviates from the profile only after first determining that a sampled value of the first measure does not indicate that the environment is not in the first state.

3. A method according to claim 2, wherein:

the second measure includes a plurality of second measures,

said step of building includes building a profile over time of values of each of the plurality of second measures, and

said step of determining includes determining whether any of the values of the plurality of second measures deviates from the profile.

4. A method according to claim 3, wherein:

said step of determining includes determining which of the plurality of second measures has a value which deviates from the profile.

5. A method according to claim 1, wherein:

said step of building is continuously performed while performing said step of monitoring.

6. A method according to claim 1, wherein:

the environment is a communications network,

the first state is a fault in the network, and

the first measure i s a high level of network traffic which indicates that there is no fault in the network.

7. A method according to claim 1, wherein:

said steps of identifying the first and second measures includes statistically sampling potential first and second measures and determining whether the potential second measure exhibits a pattern of low variance over a range of the potential first measure.

8. A method according to claim 1, wherein:

the first measure includes a plurality of first measures.

9. A system for detecting a first state of an environment which is measurable by at least two different measures of state, said system comprising:

a) database means for storing a value range of a first measure of the state of the environment, said value range of the first measure being indicative that the environment is not in the first state, and said database means for storing a profile of values of a second measure, said values of the second measure having been sampled only when values of the first measure indicate that the environment is not in the first state;

b) monitoring means for repeatedly sampling values of the second measure;

c) comparator means for comparing sampled values of the second measure to said profile of values of the second measure to determine whether a sampled value of the second measure deviates from said profile of values of the second measure.

10. A system according to claim 9, wherein:

said monitoring means includes means for repeatedly sampling values of the second measure,

said comparator means includes means for comparing sampled values of the first measure to said value range of the first measure to determine whether a sampled value of the first measure deviates from said value range of the first measure, and wherein

said comparator means compares sampled values of the second measure to said profile of values of the second measure only after first determining that a sampled value of the first measure deviates from said value range of the first measure.

11. A system according to claim 9, wherein:

the second measure includes a plurality of second measures,

said database means includes means for storing a profile of values of each second measure, said values of each second measure having been sampled only when values of the first measure indicate that the environment is not in the first state, and

said comparator means includes means for comparing sampled values of each second measure to said profile of values of each respective second measure to determine whether a sampled value of a second measure deviates from said profile of values of the respective second measure.

12. A system according to claim 11, wherein:

said comparator means includes means for determining which of said plurality of second measures has a value which deviates from said profile of values of the respective second measure.

13. A system according to claim 9, further comprising:

d) updating means for updating said profile of values in said database means only when values of the first measure indicate that the environment is not in the first state.

14. A system according to claim 9, wherein:

the environment is a communications network,

the first state is a fault in the network, and

said first measure is a high level of network traffic which indicates that there is no fault in the network.

15. A system according to claim 9, wherein:

said first and second measures are statistically related in that said second measure exhibits a pattern of low variance over a range of said first measure.

16. A system according to claim 9, wherein:

said first measure includes a plurality of first measures.

17. A system for detecting faults in a communications network, said system comprising:

a) database means for storing a value range of a network traffic volume within which range the likelihood of a fault in the network is low, and said database means for storing a profile of values of a measure of the network which is capable of indicating a fault, said values of the measure having been sampled only when network traffic volume was within said value range;

b) monitoring means for repeatedly sampling values of the measure;

c) comparator means coupled to said database means and to said monitoring means for comparing sampled values of the measure to said profile of values of the measure to determine whether a sampled value of the measure deviates from said profile of values of the measure.

18. A system according to claim 17, further comprising:

d) alert generation means coupled to said comparator means for indicating when a sampled value of the measure deviates from said profile of values of the measure.

19. A system according to claim 17, further comprising:

e) updater means coupled to said comparator means, said monitoring means and said database means for updating said profile of values when a sampled value of the measure does not deviate from said profile of values of the measure.

20. A system according to claim 19, wherein:

said updater means continuously updates said profile over time when sampled values of the measure does not deviate from said profile of values of the measure.