Defining and monitoring business rhythms associated with performance of web-enabled business processes

• US 7,783,745 B1
• Filed: 01/20/2006
• Issued: 08/24/2010
• Est. Priority Date: 06/27/2005
• Status: Active Grant

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Incorporated (Entrust Corp.)
• Inventors: Raha, Amitava K., Bhargava, Sunil
• Primary Examiner(s): Chan, Wing F.
• Assistant Examiner(s): Miah, Razu A
• Application Number:
  US11/336,019
• Time in Patent Office: 1,677 Days
• Field of Search: 709201-203, 709223-229, 707/205, 707/104, 707/3, 713/187, 714/37
• US Class Current: 709/224
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

Monitoring the operational performance of a network-based business service involves defining and detecting significant variances in activities associated with performance of the service. A business service is characterized by corresponding business rhythms, which are derived from patterns of metric values for business activities that are part of business processes corresponding to the business service. Each business rhythm is characterized as a set of statistics about the corresponding metric(s) classified for a period of time or over a group of multiple periods of time, statistically compressed, and persistently stored. For purposes of real-time monitoring of the operational performance of the business service, significant variances in the normal behavior of the business service are automatically detected by comparing real-time metric data with corresponding historical metric data, in view of associated threshold values.

Claims

1. A method for monitoring a business service, the method comprising the steps of:

analyzing historical data for a first set of metrics, wherein each metric of said first set of metrics corresponds to one or more activities related to the performance of the business service;

based on said historical data, selecting a second set of metrics from the first set of metrics, wherein each metric in the second set of metrics is selected from the first set of metrics because historical data for the metric exhibits one or more repeating patterns; and

from the second set of metrics, selecting one or more metrics to be one or more business rhythm metrics;

wherein said one or more business rhythm metrics are metrics that characterize normal behavior of an aspect of the business service;

wherein selecting the one or more business rhythm metrics comprises;

a) ranking each particular metric of the second set of metrics based on statistical characteristics of the one or more repeating patterns for the particular metric; and

b) selecting the one or more business rhythm metrics based on the ranking;

monitoring the one or more business rhythm metrics for variances in the normal behavior of the aspect of the business service, as represented by the one or more repeating patterns exhibited by the one or more business rhythm metrics;

in response to detecting a variance in the normal behavior of the aspect of the business service, as evidenced by values obtained for the one or more business rhythm metrics during the monitoring, triggering an action;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, said monitoring comprising:

extracting values for the business rhythm metrics from network traffic associated with said one or more activities.

3. The method of claim 1, further comprising the step of:

in response to identifying a particular business rhythm metric, storing data indicating a business rhythm for the particular business rhythm metrics, said data representing each particular pattern of the one or more repeating patterns for the particular business rhythm metric;

wherein, for each particular pattern, said data indicating each particular pattern includes data indicating (a) a set of time ranges in which the particular pattern occurs, and (b) one or more sets of statistical parameters representative of the historical data for the particular business rhythm metric for said set of time ranges.

4. The method of claim 3, further comprising the step of:

storing boundary values in association with each of the one or more sets of statistical parameters; and

wherein monitoring the one or more business rhythm metrics comprises;

monitoring real-time or near real-time values for the business rhythm metric,

detecting a particular value, from the real-time or near real-time values, that is outside of the boundary values; and

in response to detecting the particular value, triggering the action, wherein the action is associated with the boundary values.

5. The method of claim 1, wherein the one or more business rhythm metrics include a compound metric that is a ratio of metrics.

6. The method of claim 1, further comprising the steps of:

partitioning the historical data for a business rhythm metric into temporal fragments;

representing each fragment as a set of statistical parameters; and

storing each set of statistical parameters in a data repository.

7. The method of claim 6, further comprising the steps of:

comparing a first set of statistical parameters that represents a first fragment with one or more second sets of statistical parameters that represent one or more respective second fragments; and

based on the step of comparing, identifying a relationship between behavior characterized by the first fragment and behavior characterized by a second fragment.

8. The method of claim 7, wherein the first fragment is a fragment of a first metric and the second fragment is a fragment of the same first metric.

9. The method of claim 7, wherein the first fragment is a fragment of a first metric and the second fragment is a fragment of a second metric that is a different metric than the first metric.

10. The method of claim 7, further comprising the steps of:

storing, in a data repository, an association between the first fragment and the second fragment that characterizes the relationship as normal behavior of an aspect of the business service.

11. The method of claim 1, further comprising gathering said historical data, wherein gathering said historical data comprises:

monitoring metric values over multiple time ranges to determine, for each of the multiple time ranges, a set of metric values; and

generating compressed representations of the metric values for each of the multiple time ranges, wherein each of said compressed representation comprises statistical data representative of the set of metric values for the time range associated with the compressed representation;

wherein analyzing said historical data comprises analyzing said compressed representations in place of metric values.

12. A method for monitoring a business service, the method comprising the steps of:

accessing historical data for a business activity metric, said historical data being partitioned into multiple data sets based on time ranges;

for each data set of the multiple data sets, determining a statistical distribution of the data set;

classifying at least a portion of the multiple data sets into groups of similarity, wherein, for each respective group of similarity, data sets are classified into the group of similarity because they have similar statistical distributions; and

based on said classifying, storing business rhythm data representing a business rhythm for the business activity metric;

for each group of similarity, storing data that indicates the statistical distributions of the data in the group'"'"'s data set;

monitoring the business activity metric for deviations from the business rhythm as indicated by said business rhythm data;

in response to detecting a deviation from the business rhythm, triggering an action;

monitoring real-time or near real-time data for said business activity metric for a particular time range;

classifying said data for said particular time range into a first group of similarity of said groups of similarity;

determining that the first group is not the same as a second group to which a data set for a corresponding similar time range was classified, as indicated by said business rhythm data;

in response to said step of determining, identifying a variance in the normal operational behavior of the business service;

wherein the method is performed by one or more computing devices.

13. The method of claim 12, further comprising the step of:

determining the time ranges based on a dispersion of the historical data over a period of time.

14. The method of claim 12, further comprising the step of:

comparing real-time or near real-time values for said business activity metric for a particular time range with corresponding historical data for a corresponding similar time range, to automatically detect a variance in the normal operational behavior of the business activity for that particular time range.

15. The method of claim 12,

wherein the step of accessing includes accessing historical data associated with a particular user;

and

wherein the step of classifying at least a portion of the data sets includes classifying the historical data associated with the particular user into groups of similarity for the particular user.

16. The method of claim 12,

wherein the step of accessing includes accessing historical data associated with an aggregation of users;

and

wherein the step of classifying at least a portion of the data sets includes classifying the historical data associated with the aggregation of users into groups of similarity for the aggregation of users.

17. The method of claim 12, wherein each of said multiple data sets is a compressed data set, each compressed data set comprising statistical data derived from a corresponding larger set of metric values observed during a time range corresponding to the compressed data set.

18. The method of claim 12, wherein the business rhythm data comprises, for each data set that is classified into a group of similarity, a group identifier identifying the group of similarity into which the data set was classified.

19. One or more non-transitory storage media storing instructions which, when executed by one ore more computing devices, cause performance of:

analyzing historical data for a first set of metrics, wherein each metric of said first set of metrics corresponds to one or more activities related to the performance of a business service;

based on said historical data, selecting a second set of metrics from the first set of metrics, wherein each metric in the second set of metrics is selected from the first set of metrics because historical data for the metric exhibits one or more repeating patterns; and

from the second set of metrics, selecting one or more metrics to be one or more business rhythm metrics;

wherein said one or more business rhythm metrics are metrics that characterize normal behavior of an aspect of the business service;

wherein selecting the one or more business rhythm metrics comprises;

a) ranking each particular metric of the second set of metrics based on statistical characteristics of the one or more repeating patterns for the particular metric; and

b) selecting the one or more business rhythm metrics based on the ranking;

monitoring the one or more business rhythm metrics for variances in the normal behavior of the aspect of the business service, as represented by the one or more repeating patterns exhibited by the one or more business rhythm metrics;

in response to detecting a variance in the normal behavior of the aspect of the business service, as evidenced by values obtained for the one or more business rhythm metrics during the monitoring, triggering an action.

20. The one or more non-transitory storage media of claim 19, wherein the instructions, when executed by the one or more computing devices, further cause performance of:

extracting values for the business rhythm metrics from network traffic associated with said one or more activities.

21. The one or more non-transitory storage media of claim 19, wherein the instructions which when executed by the one or more computing devices, further cause performance of:

in response to identifying a particular business rhythm metric, storing data indicating a business rhythm for the particular business rhythm metrics, said data representing each particular pattern of the one or more repeating patterns for the particular business rhythm metric;

wherein, for each particular pattern, said data indicating each particular pattern includes data indicating (a) a set of time ranges in which the particular pattern occurs, and (b) one or more sets of statistical parameters representative of the historical data for the particular business rhythm metric for said set of time ranges.

22. The one or more non-transitory storage media of claim 21, wherein the instructions which when executed by the one or more computing devices, further cause performance of:

storing boundary values in association with each of the one or more sets of statistical parameters; and

wherein monitoring the one or more business rhythm metrics comprises;

monitoring real-time or near real-time values for the business rhythm metric, detecting a particular value, from the real-time or near real-time values, that is outside of the boundary values; and

in response to detecting the particular value, triggering the action, wherein the action is associated with the boundary values.

23. The one or more non-transitory storage media of claim 19, wherein the one or more business rhythm metrics include a compound metric that is a ratio of metrics.

24. The one or more non-transitory storage media of claim 19, wherein the instructions, when executed by the one or more computing devices, further cause performance of:

partitioning the historical data for a business rhythm metric into temporal fragments;

representing each fragment as a set of statistical parameters; and

storing each set of statistical parameters in a data repository.

25. The one or more non-transitory storage media of claim 24, wherein the instructions, when executed by the one or more computing devices, further cause performance of:

comparing a first set of statistical parameters that represents a first fragment with one or more second sets of statistical parameters that represent one or more respective second fragments; and

based on the step of comparing, identifying a relationship between behavior characterized by the first fragment and behavior characterized by a second fragment.

26. The one or more non-transitory storage media of claim 25, wherein the first fragment is a fragment of a first metric and the second fragment is a fragment of the same first metric.

27. The one or more non-transitory storage media of claim 25, wherein the first fragment is a fragment of a first metric and the second fragment is a fragment of a second metric that is a different metric than the first metric.

28. The one or more non-transitory storage media of claim 25, wherein the instructions, when executed by the one or more computing devices, further cause performance of:

storing, in a data repository, an association between the first fragment and the second fragment that characterizes the relationship as normal behavior of an aspect of the business service.

29. The one or more non-transitory storage media of claim 19, wherein the instructions, when executed by the one or more computing devices, further cause performance of gathering said historical data, wherein gathering said historical data comprises:

monitoring metric values over multiple time ranges to determine, for each of the multiple time ranges, a set of metric values; and

generating compressed representations of the metric values for each of the multiple time ranges, wherein each of said compressed representation comprises statistical data representative of the set of metric values for the time range associated with the compressed representation;

wherein analyzing said historical data comprises analyzing said compressed representations in place of metric values.

30. One or more storage non-transitory media storing instructions, when executed by one or more computing devices, cause performance of:

accessing historical data for a business activity metric, said historical data being partitioned into multiple data sets based on time ranges;

for each data set of the multiple data sets, determining a statistical distribution of the data set;

classifying at least a portion of the multiple data sets into groups of similarity, wherein, for each respective group of similarity, data sets are classified into the group of similarity because they have similar statistical distributions; and

based on said classifying, storing business rhythm data representing a business rhythm for the business activity metric;

for each group of similarity, storing data that indicates the statistical distributions of the data in the group'"'"'s data set;

monitoring the business activity metric for deviations from the business rhythm as indicated by said business rhythm data;

in response to detecting a deviation from the business rhythm, triggering an action;

monitoring real-time or near real-time data for said business activity metric for a particular time range;

classifying said data for said particular time range into a first group of similarity of said groups of similarity;

determining that the first group is not the same as a second group to which a data set for a corresponding similar time range was classified, as indicated by said business rhythm data;

in response to said step of determining, identifying a variance in the normal operational behavior of the business service.

31. The one or more non-transitory storage media of claim 30, wherein the instructions, when executed by the one or more computing devices, further cause performance of:

determining the time ranges based on a dispersion of the historical data over a period of time.

32. The one or more non-transitory storage media of claim 30, wherein the instructions, when executed by the one or more computing devices, further cause performance of:

comparing real-time or near real-time values for said business activity metric for a particular time range with corresponding historical data for a corresponding similar time range, to automatically detect a variance in the normal operational behavior of the business activity for that particular time ranges.

33. The one or more non-transitory storage media of claim 30, wherein said accessing includes accessing historical data associated with a particular user;

and

wherein said classifying at least a portion of the data sets includes classifying the historical data associated with the particular user into groups of similarity for the particular user.

34. The one or more non-transitory storage media of claim 30 wherein said accessing includes accessing historical data associated with an aggregation of users;

and

wherein said classifying at least a portion of the data sets includes classifying the historical data associated with the aggregation of users into groups of similarity for the aggregation of users.

35. The one or more non-transitory storage media of claim 30, wherein each of said multiple data sets is a compressed data set, each compressed data set comprising statistical data derived from a corresponding larger set of metric values observed during a time range corresponding to the compressed data set.

36. The one or more non-transitory storage media of claim 30, wherein the business rhythm data comprises, for each data set that is classified into a group of similarity, a group identifier identifying the group of similarity into which the data set was classified.