Self-learning integrity management system and related methods

• US 7,801,703 B2
• Filed: 11/13/2008
• Issued: 09/21/2010
• Est. Priority Date: 09/27/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Integrien Corp. (Broadcom, Inc.)
• Inventors: Marvasti, Mazda A.
• Primary Examiner(s): Wachsman; Hal D
• Application Number:
  US12/270,535
• Publication Number:
  US 20090063390A1
• Time in Patent Office: 677 Days
• Field of Search: 702/186, 702/187, 702/185, 702/181
• US Class Current: 702/186
• CPC Class Codes: G06N 20/00 Machine learning

Abstract

An integrity management system predicts abnormalities in complex systems before they occur based upon the prior history of abnormalities within the complex system. A topology of the nodes of a complex system is generated and data is collected from the system based on predetermined metrics. In combination with dynamic thresholding, fingerprints of the relevant nodes within a complex system at various time intervals prior to the occurrence of the abnormality are captured and weighted. The fingerprints can then be applied to real-time data provide alerts of potential abnormality prior to their actual occurrence.

Claims

1. A method comprising:

in an information technology infrastructure in which at least one metric is monitored, using a computer to;

collect data from the at least one metric and store the data;

transform the data with at least one model from an analytics model library and at least one model library rule and storing the transformed data in a set of historical transformed data;

determine a dynamic threshold that is not static on a time slice by time slice basis by using the set of historical transformed data to generate a value describing a limit of normal functionality for a given time slice of a component in the IT infrastructure that the at least one metric measures; and

modify the dynamic threshold periodically to reflect recent historical transformed data by replacing old data with more recent historical data in the set of historical transformed data.

2. The method of claim l, further comprising comparing incoming metric data against the dynamic threshold for a corresponding time period in which the incoming metric data is collected.

3. The method of claim 2, further comprising triggering an alert state when a trend is observed, wherein the trend comprises the value of the incoming metric data exceeding the dynamic threshold for a predetermined period of time.

4. The method of claim 3, wherein the alert state is also triggered if the value of the incoming metric data exceeds a hard threshold.

5. The method of claim l, further comprising comparing the transformed data to a dynamic threshold existing at about the same time slice in which the data is collected.

6. The method of claim 5, further comprising triggering an alert state when the value of the transformed data exceeds the dynamic threshold for a predetermined period of time.

7. The method of claim 6, wherein the alert state is triggered when the value of the transformed data exceeds a hard threshold.

8. A method comprising:

in an information technology infrastructure in which at least one metric is monitored, using a computer to;

collect data from the at least one metric and storing the data;

transform the data with at least one model from an analytics model library and at least one model library rule and storing the transformed data in a set of historical transformed data;

determine a dynamic threshold that is not static on a time slice by time slice basis by using the set of historical transformed data to generate a value describing a limit of normal functionality for a given time period of a component in the IT infrastructure that the at least one metric measures;

modify the dynamic threshold periodically to reflect recent historical transformed data by replacing old data with more recent historical data in the set of historical transformed data;

comparing incoming metric data against the dynamic threshold for the corresponding time slice in which the incoming metric data is collected; and

triggering an alert state when a trend is observed, wherein the trend comprises the value of the incoming metric data exceeding the dynamic threshold for a predetermined period of time.

9. The method of claim 8, further comprising comparing the transformed data to a dynamic threshold existing at about the same time slice in which the data is collected.

10. The method of claim 8, wherein the alert state is also triggered if the value of the incoming metric data exceeds a hard threshold.

11. A device comprising:

a computer in data communication with an information technology infrastructure, the computer being configured with;

a data collection module that collects metric data and stores the metric data on a storage device from at least one metric in an information technology infrastructure; and

a dynamic threshold generator for creating a dynamic threshold based on a set of historical metric data, comprising;

a model execution engine for analyzing the historical metric data based on at least one analytics model in an analytics model library; and

an analytics model library rule that defines parameters used by the model execution engine to form a transformed metric data set;

wherein the dynamic threshold generated from the dynamic threshold generator is not static from one time slice to another time slice; and

a trend detecting module for detecting a trend, the trend occurring when incoming metric data substantially exceeds the dynamic threshold for predetermined number of time slices;

wherein a resolution module causes an alarm when a trend is detected.

12. The device of claim 11, further comprising a data type determination module.

13. The device of claim 11, wherein new dynamic thresholds are determined at predetermined time intervals.

14. The device of claim 11, further comprising an event prediction module.

15. The device of claim 11, wherein the parameters comprise definitions for applying the analytics models to a data-type and an order in which analytics models should be applied to the set of historical data.