Method and apparatus for system state monitoring using pattern recognition and neural networks

• US 6,327,550 B1
• Filed: 03/05/2001
• Issued: 12/04/2001
• Est. Priority Date: 05/26/1998
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Huddleston, David E., Vinberg, Anders, Cass, Ronald J., Pao, John D., Bayer, Christopher W., Barthram, Phil K.
• Primary Examiner(s): Hoff, Marc S.
• Assistant Examiner(s): Barbee, Manuel L.
• Application Number:
  US09/799,142
• Time in Patent Office: 274 Days
• US Class Current: 702/186
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

Pattern recognition of common modes by neural networks and other techniques are used to monitor and determine or predict the state of networks, computers, software systems, logical networks or other components of an information system, to report actual or predicted states, and to report other state characteristics.

Claims

1. A system to determine and predict the state of at least one component in a networked computer system, comprising:

a learning subsystem comprising components for a first step of collecting of data from an agent during typical operation of such information system and storing such data, and for a second step of analyzing such stored data by pattern recognition techniques to identify common modes of operation of such system or components thereof, and storing such common modes;

a state-labeling subsystem comprising components enabling a human manager to label selected vectors at selected points as good or bad; and

a monitoring subsystem comprising components for receiving data from data collection agents of state information on such information system or any component thereof, for comparing such data to such stored common modes, and for reporting when such information system or any such component thereof is in an unprecedented state.

2. The system of claim 1 further comprising a subsystem for identifying common transitions between modes and determining the percentages of instances of and probabilities of common transition between modes as part of the learning subsystem.

3. The system of claim 2 further comprising:

a system to determine when a system state vector enters a mode that has high probability for a direct or indirect transition to a state labeled as bad in order to predict and give an early warning of entry of such a state.

4. The system of claim 3 further comprising a system to monitor transitions between common modes, in order to report on unprecedented transitions between the common modes.

5. The system of claim 1 further comprising an additional subsystem for including general time and date data in the state vector in order to identify an otherwise common mode occurring at an uncommon point in time.

6. The system of claim 5 wherein said additional subsystem utilizes customized time and date data rather than general time and date data in identifying state patterns.

7. The system of claim 1 further comprising a component for consolidating asynchronous data in both said learning and monitoring subsystems.

8. The system of claim 1 further comprising a system to cooperate with other systems including other information management systems.

9. The system of claim 1 further comprising a subsystem comprising components for determining significant metrics for the purpose of reducing the processing cost of the analysis by discarding insignificant metrics.

10. The system of claim 1 further comprising a subsystem comprising components for identifying and discarding redundant metrics for the purpose of producing meaningful reporting.

11. The system of claim 1 further comprising a subsystem comprising components for identifying standard situations with regard to the location of the current state relative to the identified common patterns for the purpose of producing meaningful reporting.

12. A method for determining and predicting the state of at least one network component in a networked computer system, comprising:

collecting data from an agent during typical operation of the networked computer system;

storing the data;

analyzing the data using pattern recognition techniques to identify common modes of operation of the networked computer system or network component;

storing common mode data representing the common modes of operation;

receiving from a human operator a state label associated with at least one of the common modes of operation, thereby identifying the at least one common mode of operation as good or bad;

receiving state data from the agent during monitored operation of the networked computer system;

comparing the state data to the common mode data; and

reporting when the networked computer system or network component is in an unprecedented state.

13. The method of claim 12, further comprising:

correlating at least one common mode of operation with events or metrics reported by management tools, thereby identifying the at least one common mode of operation as good or bad.

14. The method of claim 12, further comprising:

identifying common transitions between common modes of operation; and

determining likelihoods of common transitions.

15. The method of claim 14, further comprising:

determining when the networked computer system or network component is operating in a common transition having a high likelihood of transitioning to a common mode of operation identified as bad, thereby enabling an early warning of such a state.

16. The method of claim 14, further comprising:

monitoring transitions between common modes of operation;

identifying an unprecedented transition between the common modes of operation.

17. The method of claim 12, wherein the common mode data includes general time and date data in order to identify an otherwise common mode occurring at an uncommon point in time.

18. The method of claim 12, wherein the common mode data includes customized time and date data to enable identification of state patterns.

19. The method of claim 12, wherein the steps of collecting data and receiving state data include consolidating asynchronous data.

20. The method of claim 12, further comprising cooperating with other systems including other information management systems.

21. The method of claim 12, further comprising:

identifying the most significant set of metrics for the system state; and

selectively classifying each state vector in relation to a common mode, in order to generate a meaningful report.

22. The method of claim 12, further comprising:

determining significant metrics, thereby reducing the processing cost of the analysis by discarding insignificant metrics.

23. The method of claim 12, further comprising:

identifying and discarding redundant metrics, thereby producing meaningful reporting.

24. The method of claim 12, further comprising identifying standard situations with regard to the location of the current state relative to the identified common patterns, thereby producing meaningful reporting.

25. The method of claim 12, further comprising specifying the degree of goodness or badness of common modes.