Identifying anomalies in original metrics of a system

• US 9,003,076 B2
• Filed: 05/29/2013
• Issued: 04/07/2015
• Est. Priority Date: 05/29/2013
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Biem, Alain E.
• Primary Examiner(s): Unelus, Ernest
• Application Number:
  US13/904,556
• Publication Number:
  US 20140359363A1
• Time in Patent Office: 678 Days
• Field of Search: 348/247, 375/240.27, 714/16
• US Class Current: 710/18
• CPC Class Codes: G06F 11/3024 where the computing system component is a central processing unit [CPU]
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: H04N 25/60 Noise processing, e.g. detecting, correcting, reducing or removing noise
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

An anomalous component within a processing system is identified. One or more transformed metrics of a processing system being monitored are analyzed, and an anomaly in the processing system is detected. Based on detecting the anomaly, at least one transformed metric is inversely transformed to obtain at least one suspect original metric. Using the at least one suspect original metric, the anomalous component is identified.

Claims

1. A method of facilitating identification of an anomalous component within a processing system, said method comprising:

transforming, by a processor, one or more original metrics of a processing system being monitored to obtain one or more transformed metrics, wherein the transforming uses a selected mathematical transformation function, the selected mathematical transformation function comprising a Discrete Cosine Transform, a Discrete Wavelet Transform, a multi-dimensional to multi-dimensional mapping or a statistically-estimated transform;

analyzing, by the processor, the one or more transformed metrics of the processing system being monitored, wherein the analyzing detects an anomaly in the processing system;

based on detecting the anomaly in analyzing the one or more transformed metrics, inversely transforming at least one transformed metric of the one or more transformed metrics to obtain at least one original metric of the one or more original metrics, the inversely transforming using a mathematical transformation function to transform the at least one transformed metric back to the at least one original metric, and the at least one original metric being at least one suspect original metric; and

using the at least one suspect original metric to identify the anomalous component.

2. The method of claim 1, wherein the analyzing identifies at least one suspect transformed metric associated with the anomaly, and wherein the inversely transforming inversely transforms the at least one suspect transformed metric to obtain the at least one suspect original metric.

3. The method of claim 1, wherein the using comprising comparing an estimate of at least one non-anomalous original metric with the at least one suspect original metric to identify the anomalous component.

4. The method of claim 3, wherein the comparing comprises determining for a suspect original metric of the at least one suspect original metric an absolute difference between a first value representing the suspect original metric and a second value representing a non-anomalous original metric corresponding to the suspect original metric.

5. The method of claim 4, wherein the non-anomalous metric comprises at least one of a means or variance of an original metric prior to transformation.

6. The method of claim 3, wherein the comparing provides at least one diagnostic score, and wherein the method further comprises:

ranking the at least one suspect original metric based on the at least one diagnostic score to provide at least one ranked suspect original metric; and

selecting from the at least one ranked suspect original metric, a suspect original metric indicating the anomaly.

7. The method of claim 6, wherein the selecting chooses a ranked suspect original metric with a highest score in the ranking.

8. The method of claim 3, wherein the comparing comprises for a suspect original metric of the at least one suspect original metric:

subtracting a first value representing an average of a non-anomalous metric prior to transformation that corresponds to the suspect original metric from a second value representing the suspect original metric to obtain a first result;

squaring the first result to obtain a second result; and

dividing the second result by a third value representing a variance of the non-anomalous metric prior to transformation to obtain a diagnostic score for the suspect original metric.

9. The method of claim 8, further comprising comparing the diagnostic score for the suspect original metric with one or more other diagnostic scores for one or more other suspect original metrics to determine an anomalous suspect original metric.

10. The method of claim 9, further comprising using the anomalous suspect original metric to identify the anomalous component.

11. A computer program product for facilitating identification of an anomalous component within a processing system, said computer program product comprising:

a non-transitory computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

transforming one or more original metrics of a processing system being monitored to obtain one or more transformed metrics, wherein the transforming uses a selected mathematical transformation function, the selected mathematical transformation function comprising a Discrete Cosine Transform, a Discrete Wavelet Transform, a multi-dimensional to multi-dimensional mapping or a statistically-estimated transform;

analyzing the one or more transformed metrics of the processing system being monitored, wherein the analyzing detects an anomaly in the processing system;

based on detecting the anomaly in analyzing the one or more transformed metrics, inversely transforming at least one transformed metric of the one or more transformed metrics to obtain at least one original metric of the one or more original metrics, the inversely transforming using a mathematical transformation function to transform the at least one transformed metric back to the at least one original metric, and the at least one original metric being at least one suspect original metric; and

using the at least one suspect original metric to identify the anomalous component.

12. The computer program product of claim 11, wherein the using comprising comparing an estimate of at least one non-anomalous original metric with the at least one suspect original metric to identify the anomalous component.

13. The computer program product of claim 12, wherein the comparing comprises determining for a suspect original metric of the at least one suspect original metric an absolute difference between a first value representing the suspect original metric and a second value representing a non-anomalous original metric corresponding to the suspect original metric.

14. The computer program product of claim 12, wherein the comparing provides at least one diagnostic score, and wherein the method further comprises:

ranking the at least one suspect original metric based on the at least one diagnostic score to provide at least one ranked suspect original metric; and

selecting from the at least one ranked suspect original metric, a suspect original metric indicating the anomaly.

15. The computer program product of claim 12, wherein the comparing comprises for a suspect original metric of the at least one suspect original metric:

subtracting a first value representing an average of a non-anomalous original metric prior to transformation that corresponds to the suspect original metric from a second value representing the suspect original metric to obtain a first result;

squaring the first result to obtain a second result; and

dividing the second result by a third value representing a variance of the non-anomalous original metric prior to transformation to obtain a diagnostic score for the suspect original metric.

16. A computer system for facilitating identification of an anomalous component within a processing system, said computer system comprising:

a memory; and

a processor in communications with the memory, wherein the computer system is configured to perform a method, said method comprising;

transforming one or more original metrics of a processing system being monitored to obtain one or more transformed metrics, wherein the transforming uses a selected mathematical transformation function, the selected mathematical transformation function comprising a Discrete Cosine Transform, a Discrete Wavelet Transform, a multi-dimensional to multi-dimensional mapping or a statistically-estimated transform;

analyzing the one or more transformed metrics of the processing system being monitored, wherein the analyzing detects an anomaly in the processing system;

based on detecting the anomaly in analyzing the one or more transformed metrics, inversely transforming at least one transformed metric of the one or more transformed metrics to obtain at least one original metric of the one or more original metrics, the inversely transforming using a mathematical transformation function to transform the at least one transformed metric back to the at least one original metric, and the at least one original metric being at least one suspect original metric; and

using the at least one suspect original metric to identify the anomalous component.

17. The computer system of claim 16, wherein the using comprising comparing an estimate of at least one non-anomalous original metric with the at least one suspect original metric to identify the anomalous component, and wherein the comparing comprises determining for a suspect original metric of the at least one suspect original metric an absolute difference between a first value representing the suspect original metric and a second value representing a non-anomalous original metric corresponding to the suspect original metric.

18. The computer system of claim 16, wherein the using comprising comparing an estimate of at least one non-anomalous original metric with the at least one suspect original metric to identify the anomalous component, and wherein the comparing provides at least one diagnostic score, and wherein the method further comprises:

ranking the at least one suspect original metric based on the at least one diagnostic score to provide at least one ranked suspect original metric; and

selecting from the at least one ranked suspect original metric, a suspect original metric indicating the anomaly.

19. The computer system of claim 16, wherein the using comprising comparing an estimate of at least one non-anomalous original metric with the at least one suspect original metric to identify the anomalous component, and wherein the comparing comprises for a suspect original metric of the at least one suspect original metric:

subtracting a first value representing an average of a non-anomalous original metric prior to transformation that corresponds to the suspect original metric from a second value representing the suspect original metric to obtain a first result;

squaring the first result to obtain a second result; and

dividing the second result by a third value representing a variance of the non-anomalous original metric prior to transformation to obtain a diagnostic score for the suspect original metric.