Method and system for analyzing and predicting the performance of computer network using time series measurements
First Claim
1. A method for analyzing and predicting the performance of a computer network, comprising the steps of continually receiving measurements defining signatures for a plurality of input variables reflecting performance of the computer network, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial, and for a selected input variable:
- receiving a current measurement for a current time for an input variable reflective of the performance of the computer network;
defining a signature for the input variable comprising a time series of measurements for the selected input variable including historical measurements for past time trials and the current measurement for the current time trial;
dividing the signature for the selected input variable into multiple iterations of a repeating cycle wherein each iteration comprises a portion of the signature having a similar number of measurements, dividing each iteration into a plurality of similar contiguous time index periods, and computing a cyclical component of the selected input variable reflecting data accumulated for each time index period across multiple iterations of the cycle;
computing an erratic component of the selected input variable by removing at least the cyclical component from the signature;
computing a time-based baseline mean for the erratic component of the selected input variable based on the historical measurements of the selected input variable;
computing an imputed estimate for the erratic component of the selected input variable for the current time trial based on similarly computed erratic components for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables; and
determining and displaying an alert status for the computer network based on the time-based baseline mean for the erratic component of the selected input variable and the imputed estimate of the erratic component of the input variable for the current time trial.
11 Assignments
0 Petitions
Accused Products
Abstract
A monitoring system including a baseline model that automatically captures and models normal system behavior, a correlation model that employs multivariate autoregression analysis to detect abnormal system behavior, and an alarm service that weights and scores a variety of alerts to determine an alarm status and implement appropriate response actions. The baseline model decomposes the input variables into a number of components representing relatively predictable behaviors so that the erratic component e(t) may be isolated for further processing. These components include a global trend component, a cyclical component, and a seasonal component. Modeling and continually updating these components separately permits a more accurate identification of the erratic component of the input variable, which typically reflects abnormal patterns when they occur.
-
Citations
43 Claims
-
1. A method for analyzing and predicting the performance of a computer network, comprising the steps of continually receiving measurements defining signatures for a plurality of input variables reflecting performance of the computer network, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial, and for a selected input variable:
-
receiving a current measurement for a current time for an input variable reflective of the performance of the computer network; defining a signature for the input variable comprising a time series of measurements for the selected input variable including historical measurements for past time trials and the current measurement for the current time trial; dividing the signature for the selected input variable into multiple iterations of a repeating cycle wherein each iteration comprises a portion of the signature having a similar number of measurements, dividing each iteration into a plurality of similar contiguous time index periods, and computing a cyclical component of the selected input variable reflecting data accumulated for each time index period across multiple iterations of the cycle; computing an erratic component of the selected input variable by removing at least the cyclical component from the signature; computing a time-based baseline mean for the erratic component of the selected input variable based on the historical measurements of the selected input variable; computing an imputed estimate for the erratic component of the selected input variable for the current time trial based on similarly computed erratic components for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables; and determining and displaying an alert status for the computer network based on the time-based baseline mean for the erratic component of the selected input variable and the imputed estimate of the erratic component of the input variable for the current time trial. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
-
-
15. A method for analyzing and predicting the performance of a computer network, comprising the steps of continually receiving measurements defining signatures for a plurality of input variables reflecting performance of the computer network, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial, and for a selected input variable:
-
receiving a current measurement for a current time for an input variable reflective of the performance of the computer network; defining a signature for the input variable comprising a time series of measurements for the selected input variable including historical measurements for past time trials and the current measurement for the current time trial; dividing the signature for the selected input variable into multiple iterations of a repeating cycle wherein each iteration comprises a portion of the signature having a similar number of measurements, dividing each iteration into a plurality of similar contiguous time index periods, and computing a cyclical component of the selected input variable reflecting data accumulated for each time index period across multiple iterations of the cycle; computing an erratic component of the selected input variable by removing at least the cyclical component from the signature; computing a time-based baseline mean for the erratic component of the selected input variable based on the historical measurements of the selected input variable; computing a forecast estimate for the erratic component of the selected input variable for the future time trials based on similarly computed erratic components for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables; and determining and displaying an alert status for the computer network based on the time-based baseline mean for the erratic component of the selected input variable and the forecast estimate of the erratic component of the input variable for the current time trial. - View Dependent Claims (16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
-
-
29. A method for analyzing and predicting the performance of a computer network characterized by a time-based signature, comprising the steps of:
-
(a) receiving a current measurement for a current time for an input variable reflective of the performance of the computer network; (b) defining a signature for the input variable comprising a time series of measurements for the selected input variable including historical measurements for past time trials and the current measurement for the current time trial; (c) determining a cyclical component associated with the time-based signature by dividing the signature for the selected input variable into multiple iterations of a repeating cycle wherein each iteration comprises a portion of the signature having a similar number of measurements, dividing each iteration into a plurality of similar contiguous time index periods, and computing a cyclical component of the selected input variable reflecting data accumulated for each time index period across multiple iterations of the cycle; (d) computing an erratic component associated with the signature by removing at least the cyclical component from the signature; (e) computing a forecast estimate of the erratic component based on a plurality of input variables reflected in the signature and a statistical model of the system comprising learned parameters reflecting observed relationships among the input variables; (f) determining and displaying an alert status for the computer network based on an analysis of the erratic component; (g) updating the learned parameters based on the inputs received the current time trial; and (h) repeating steps (a) through (g) for each of a plurality of successive time trials. - View Dependent Claims (30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43)
-
Specification