Systems and methods for automated computer support

• US 7,593,936 B2
• Filed: 08/11/2004
• Issued: 09/22/2009
• Est. Priority Date: 08/11/2003
• Status: Active Grant

• Current Assignee: Netskope Incorporated
• Original Assignee: Triumfant Incorporated
• Inventors: Hooks, David Eugene
• Primary Examiner(s): ALAM, SHAHID AL
• Application Number:
  US10/916,956
• Publication Number:
  US 20050038827A1
• Time in Patent Office: 1,868 Days
• Field of Search: 707 1- 10, 707100-1041, 707200-205, 714/37, 715/530
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/1435 using file system or storage system metadata
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 16/7844 using original textual content or text extracted from visual content or transcript of audio data
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/5006 Creating or negotiating SLA contracts, guarantees or penalties
• CPC Class Codes: H04L 43/028 : by filtering
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: Y10S 707/99936 : Pattern matching access
• CPC Class Codes: Y10S 707/99938 : Concurrency, e.g. lock management in shared database

Abstract

Systems and methods for providing automated computer support are described herein. One described method includes receiving a plurality of snapshots from a plurality of computers, storing the plurality of snapshots in a data store, and creating an adaptive reference model based at least in part on the plurality of snapshots. The described method also includes comparing at least one of the plurality of snapshots to the adaptive reference model, and identifying at least one anomaly based on the comparison.

Claims

1. A method of detecting abnormal system states in computers, comprising:

receiving snapshots from a plurality of computers within a population of computers, wherein individual snapshots include data indicating a state of a respective computer;

automatically generating an adaptive reference model comprising a rule set customized to characteristics of the population of computers, the rule set being developed by identifying patterns among the snapshots from the plurality of computers such that the adaptive reference model is indicative of normal states in the computers within the population; and

comparing a snapshot from at least one of the computers to the adaptive reference model to determine whether an anomaly is present in the state of the at least one of the computers.

2. The method of claim 1, further comprising:

comparing the anomaly to a recognition filter to diagnose a trouble condition on the at least one of the computers; and

in the event of a trouble condition, generating an automated response to the trouble condition.

3. The method of claim 2, wherein the automated response is a generic response not specific to a particular asset of the at least one computer, and wherein the method further comprises:

sending the generic response and a set of anomalies found in the snapshot to the at least one computer, the set of anomalies indicating assets of the at least one computer whose states are anomalous; and

applying the generic response to the anomalous assets to correct the trouble condition.

4. The method of claim 3, wherein the generic response includes at least one of:

installing a missing software component, removing an undesirable software component, and restoring an incorrect registry setting.

5. The method of claim 2, wherein the recognition filter comprises a particular pattern of anomalies that indicates the presence of a particular root cause condition or a generic class of conditions.

6. The method of claim 1, further comprising:

comparing a plurality of anomalies associated with a particular snapshot with a recognition filter to diagnose a trouble condition; and

diagnosing a trouble condition on the at least one of the computers in response to at least a subset of the plurality of anomalies matching information in the recognition filter.

7. The method of claim 1, wherein individual snapshots include data associated with at least one of:

system files, application files, a registry entry, a performance counter, a process, a communication port, a hardware configuration, a log file, a running task, services, and network connections.

8. The method of claim 1, further comprising:

inserting rules into the rule set of the adaptive reference model to augment or override rules of the rule set automatically generated from the snapshots.

9. The method of claim 1, wherein the adaptive reference model is generated to include a value layer that determines whether an asset value contained in a snapshot is anomalous.

10. The method of claim 1, wherein the adaptive reference model is generated to include a cluster layer that tracks relationships between assets and identifies an anomaly in response to an asset being unexpectedly absent from or present in a set of assets in a snapshot.

11. The method of claim 1, wherein the adaptive reference model is generated to include a profile layer that identifies anomalies in response to violation of relationships of clusters of assets in a snapshot.

12. A computer readable medium storing instructions, that when executed by a computer, cause the computer to perform functions of:

receiving snapshots from a plurality of computers within a population of computers, wherein individual snapshots include data indicating a state of a respective computer;

automatically generating an adaptive reference model comprising a rule set customized to characteristics of the population of computers, the rule set being developed by identifying patterns among the snapshots from the plurality of computers such that the adaptive reference model is indicative of normal states in the computers within the population; and

comparing a snapshot from at least one of the computers to the adaptive reference model to determine whether an anomaly is present in the state of the at least one of the computers.

13. The computer readable medium of claim 12, further comprising instructions, that when executed, cause the computer to compare the anomaly to a recognition filter to diagnose a trouble condition on the at least one of the computers, and, in the event of a trouble condition, to generate an automated response to the trouble condition.

14. The computer readable medium of claim 13, wherein the automated response is a generic response not specific to a particular asset of the at least one computer, and wherein the computer readable medium further comprises instructions, that when executed, cause the computer to:

send the generic response and a set of anomalies found in the snapshot to the at least one computer, the set of anomalies indicating assets of the at least one computer whose states are anomalous; and

apply the generic response to the anomalous assets to correct the trouble condition.

15. The computer readable medium of claim 14, wherein the generic responses include at least one of:

installing a missing software component, removing an undesirable software component, and restoring an incorrect registry setting.

16. The computer readable medium of claim 13, wherein the recognition filter comprises a particular pattern of anomalies that indicates the presence of a particular root cause condition or a generic class of conditions.

17. The computer readable medium of claim 12, wherein the instructions for comparing the snapshot to the adaptive reference model include instructions for determining whether an asset value contained in a snapshot is anomalous.

18. The computer readable medium of claim 12, wherein the instructions for comparing the snapshot to the adaptive reference model include instructions for tracking relationships between assets and identifying an anomaly in response to an asset being unexpectedly absent from or present in a set of assets in a snapshot.

19. The computer readable medium of claim 12, wherein the instructions for comparing the snapshot to the adaptive reference model include instructions for identifying anomalies in response to violation of relationships of clusters of assets in a snapshot.

20. The computer readable medium of claim 12, wherein the computer readable medium further comprises instructions, that when executed, cause the computer to:

compare a plurality of anomalies associated with a particular snapshot with a recognition filter to diagnose a trouble condition; and

diagnose a trouble condition on the at least one of the computers in response to at least a subset of the plurality of anomalies matching information in the recognition filter.

21. The computer readable medium of claim 12, wherein individual snapshots include data associated with at least one of:

system files, application files, a registry entry, a performance counter, a process, a communication port, a hardware configuration, a log file, a running task, services, and network connections.

22. The computer readable medium of claim 12, wherein the computer readable medium further comprises instructions, that when executed, cause the computer to:

insert rules into the rule set of the adaptive reference model to augment or override rules of the rule set automatically generated from the snapshots.