Self-learning integrity management system and related methods

• US 7,467,067 B2
• Filed: 09/27/2006
• Issued: 12/16/2008
• Est. Priority Date: 09/27/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Integrien Corp. (Broadcom, Inc.)
• Inventors: Marvasti, Mazda A.
• Primary Examiner(s): Wachsman; Hal D
• Application Number:
  US11/535,818
• Publication Number:
  US 20080077358A1
• Time in Patent Office: 811 Days
• Field of Search: 702/186, 702/187, 702/185, 702/181
• US Class Current: 702/186
• CPC Class Codes: G06N 20/00 Machine learning

Abstract

An integrity management system predicts abnormalities in complex systems before they occur based upon the prior history of abnormalities within the complex system. A topology of the nodes of a complex system is generated and data is collected from the system based on predetermined metrics. In combination with dynamic thresholding, fingerprints of the relevant nodes within a complex system at various time intervals prior to the occurrence of the abnormality are captured and weighted. The fingerprints can then be applied to real-time data provide alerts of potential abnormality prior to their actual occurrence.

Claims

1. An integrity management system comprising, in combination:

a topology mapping module for mapping a topology of nodes;

a data collector;

an event prediction module that provides at least one heuristic describing a state of the system prior to an event; and

a resolutions module for providing a notice of a potential occurrence of an event prior to the actual occurrence of the event; and

wherein data is collected from the topology of nodes by the data collector and compared to the at least one heuristic to provide a probability that the event will occur; and

wherein if the probability crosses a threshold value, the resolutions module provides the notice.

2. The system of claim 1, wherein the event prediction module further comprises a dynamic thresholding system.

3. The system of claim 2, wherein the dynamic thresholding system identifies variations from normal or expected values in connection with providing a probability that the event will occur.

4. The system of claim 1, wherein the event prediction module comprises a fingerprinting system and wherein the at least one heuristic comprises a fingerprint.

5. The system of claim 1, further comprising a database, the database storing data collected from the data collector.

6. The system of claim 5, wherein the data further comprises:

time series data;

event data; and

fingerprint data.

7. The system of claim 6, wherein the at least one heuristic is compared to at least one of the time series data, event data, and fingerprinting data to produce the probability that the event will occur.

8. The system of claim 1, wherein the notice causes the resolution module to trigger an automated response or invoke an escalation module to effect a human response.

9. The system of claim 1, wherein the event is an abnormality.

10. The system of claim 9, wherein the abnormality is a problem.

11. The system of claim 1, wherein the nodes comprise at least one of computer hardware and computer software.

12. A integrity management system comprising, in combination:

a topology mapping module for mapping a topology of nodes;

a data collector;

an event prediction module that provides at least one heuristic describing a state of the system prior to an event; and

a resolutions module for providing a notice of a potential occurrence of an event prior to the actual occurrence of the event; and

wherein data is collected from the topology of nodes by the data collector and compared to the at least one heuristic to provide a probability that the event will occur; and

wherein if the probability crosses a threshold value, the resolutions module provides the notice.

13. The system of claim 12, wherein the event prediction module further comprises a dynamic thresholding system and wherein the at least one heuristic comprises at least one dynamic threshold.

14. The system of claim 13, wherein the event prediction module comprises a fingerprint generator and wherein the at least one heuristic comprises a fingerprint.

15. The system of claim 12, further comprising a database, the database storing data collected from the data collector.

16. The system of claim 15, wherein the data comprises:

time series data;

event data; and

fingerprint data.

17. A method for detecting abnormalities in nodes by providing an integrity management system that performs steps comprising, in combination:

discovering a plurality of nodes;

constructing a topology of node interconnectedness;

collecting data from the topology;

using historical data to form at least one heuristic describing a state of the system prior to an event;

applying the at least one heuristic to the data, the application of the at least one heuristic outputting a probability that the event will occur; and

at least one of generating an alert prior to the actual occurrence of the event and reducing the probability that the event will occur.

18. The method of claim 17, wherein the at least one heuristic comprises a fingerprint of an event that occurred previously.

19. The method of claim 18, wherein the at least one heuristic further comprises a dynamic thresholding process.

20. The method of claim 17, wherein the at least one heuristic comprises a dynamic thresholding process.

21. The method of claim 17, wherein the data is collected from a plurality of metrics over a time period.

22. The method of claim 17, wherein the data comprises a plurality of events.

23. The method of claim 17, wherein at least a computer is used to apply the at least one heuristic to the data.

24. The method of claim 17, wherein the integrity management system monitors potential variations in information technology systems that indicate an abnormality.

25. The method of claim 24, wherein the information technology systems are at least one of computer hardware and computer software applications.

26. A machine-readable medium having program instructions stored thereon executable by a processing unit for performing the steps of:

discovering a plurality of nodes;

constructing a topology of node interconnectedness;

collecting data from the topology;

using historical data to form at least one heuristic describing a state of the system prior to an event;

applying the at least one heuristic to the data, the application of the at least one heuristic outputting a probability that the event will occur; and

at least one of generating an alert prior to the actual occurrence of the event and reducing the probability that the event will occur.

27. The machine-readable medium of claim 26, wherein the at least one heuristic comprises a fingerprint of an event that occurred previously.

28. The machine-readable medium of claim 27, wherein the at least one heuristic further comprises a dynamic thresholding process.

29. The machine-readable medium of claim 26, further comprising program instructions stored thereon for implementing a dynamic thresholding process for the at least one heuristic.

30. The machine-readable medium of claim 26, further comprising program instructions stored thereon for collecting the data from a plurality of metrics over a time period.

31. The machine-readable medium of claim 26, further comprising program instructions stored thereon for collecting data relating to a plurality of events.

32. The machine-readable medium of claim 26, further comprising program instructions stored thereon for applying the at least one heuristic to the data using a computer.

33. The machine-readable medium of claim 26, further comprising program instructions stored thereon for monitoring potential variations in information technology systems that indicate an abnormality.

34. The machine-readable medium of claim 33, wherein the information technology systems are at least one of computer hardware and computer software applications.