Self-learning integrity management system and related methods

• US 8,060,342 B2
• Filed: 08/16/2010
• Issued: 11/15/2011
• Est. Priority Date: 09/27/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Integrien Corp. (Broadcom, Inc.)
• Inventors: Marvasti, Mazda A.
• Primary Examiner(s): WACHSMAN, HAL D
• Application Number:
  US12/857,369
• Publication Number:
  US 20100318487A1
• Time in Patent Office: 456 Days
• Field of Search: 702/186, 702/181, 702/187, 702/185
• US Class Current: 702/186
• CPC Class Codes: G06N 20/00 Machine learning

Abstract

An integrity management system predicts abnormalities in complex systems before they occur based upon the prior history of abnormalities within the complex system. A topology of the nodes of a complex system is generated and data is collected from the system based on predetermined metrics. In combination with dynamic thresholding, fingerprints of the relevant nodes within a complex system at various time intervals prior to the occurrence of the abnormality are captured and weighted. The fingerprints can then be applied to real-time data to provide alerts of potential abnormality prior to their actual occurrence.

Claims

1. A dynamic thresholding system comprising, in combination:

a computer in data communication with an information technology infrastructure, the computer having;

a data collection module that collects metric data and stores the metric data on a storage device from at least one metric in the information technology infrastructure; and

a dynamic threshold generator for creating a dynamic threshold based on a set of historical metric data, comprising;

a model execution engine for analyzing the historical metric data based on at least one analytics model in an analytics model library;

an analytics model library rule that defines parameters used by the model execution engine to form a transformed metric data set; and

a trend detecting module for detecting a trend, the trend occurring when incoming metric data substantially exceeds the dynamic threshold for a predetermined number of time slices;

wherein the dynamic threshold generated from the dynamic threshold generator is not static from one time slice to another time slice; and

wherein a resolution module causes an alarm when a trend is detected.

2. The system of claim 1, further comprising a data type determination module.

3. The system of claim 1, wherein new dynamic thresholds are determined at predetermined time intervals.

4. The system of claim 1, further comprising an event prediction module.

5. The system of claim 1, further comprising a resolution module.

6. The system of claim 1, wherein the parameters comprise definitions for applying the analytics models to a data-type and an order in which analytics models should be applied to the set of historical data.

7. A non-transitory machine-readable medium having instructions stored thereon executable by a processing unit comprising:

using a computer to;

collect data from at least one metric in an information technology infrastructure and store the data;

transform the data with at least one model from an analytics model library and at least one model library rule and storing the transformed data in a set of historical transformed data;

determine a dynamic threshold for the at least one metric on a time slice by time slice basis by using the set of historical transformed data to generate a value describing a limit of normal functionality for each time slice; and

modify the dynamic threshold periodically to reflect recent historical transformed data by replacing old data with more recent historical data in the set of historical transformed data.

8. The non-transitory machine-readable medium of claim 7, further comprising comparing the data collected from the at least one metric to a dynamic threshold existing at about the same time period in which the data collected from the at least one metric is collected.

9. The non-transitory machine-readable medium of claim 7, further comprising comparing the transformed data to a dynamic threshold corresponding to the same time period in which the data collected from the at least one metric used to transform the transformed data was is collected.

10. The non-transitory machine-readable medium of claim 9, further comprising triggering an alert state when the value of the transformed data exceeds the dynamic threshold for a predetermined period of time.

11. The non-transitory machine-readable medium of claim 10, wherein the alert state is triggered when the value of the incoming metric data exceeds a hard threshold.

12. The non-transitory machine-readable medium of claim 7, further comprising determining the type of the data collected from the at least one metric.

13. The non-transitory machine-readable medium of claim 7, further comprising triggering an alert state when the value of the data collected from the at least one metric exceeds the dynamic threshold for a predetermined period of time.

14. The non-transitory machine-readable medium of claim 13, wherein the alert state is triggered when the value of the data collected from the at least one metric exceeds a hard threshold.

15. A non-transitory machine-readable medium having instructions stored thereon executable by a processing unit comprising:

using a computer to;

collect data from at least one metric in an information technology infrastructure and store the data;

transform the data with at least one model from an analytics model library and at least one model library rule and storing the transformed data in a set of historical transformed data;

determine a dynamic threshold for the at least one metric on a time slice by time slice basis by using the set of historical transformed data to generate a value describing a limit of normal functionality for each time slice;

modify the dynamic threshold periodically to reflect recent historical transformed data by replacing old data with more recent historical data in the set of historical transformed data;

comparing incoming metric data against the dynamic threshold for the corresponding time slice in which the incoming metric data is collected; and

triggering an alert state when a trend is observed, wherein the trend comprises the value of the incoming metric data exceeding the dynamic threshold for a predetermined period of time.

16. The non-transitory machine-readable medium of claim 15, further comprising comparing the transformed data to a dynamic threshold existing at about the same time slice in which the data collected from the at least one metric was collected.

17. The non-transitory machine-readable medium of claim 15, wherein the alert state is also triggered if the value of the incoming metric data exceeds a hard threshold.