Method and system for anomaly detection and presentation

• US 9,178,754 B2
• Filed: 08/13/2010
• Issued: 11/03/2015
• Est. Priority Date: 08/13/2010
• Status: Active Grant

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Vaidya, Sachin M., Satish, Venkeepuram R.
• Primary Examiner(s): Pesin, Boris
• Assistant Examiner(s): HUERTAS TORRES, AYESHA E
• Application Number:
  US12/856,157
• Publication Number:
  US 20120042255A1
• Time in Patent Office: 1,908 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 41/508 based on type of value added network service under agreement

Abstract

A system and method for anomaly detection and presentation. The method of anomaly detection and presentation comprises receiving information for a plurality of traits from a plurality of servers. A first server has fewer of the plurality of traits than a second server. A first trait is on fewer of the plurality of servers than a second trait. The plurality of servers is rendered in a graphical display wherein the first server is positioned to one side of the second server based on respective numbers of traits had by the first and second servers. The first trait is rendered in the graphical display to one side of the second trait based on respective numbers of systems having the first and second traits. A table may be displayed in a cell in response to a user request. Anomalous traits may be displayed in an anomaly table.

Claims

1. A method of anomaly identification, said method comprising:

collecting, using at least one computer processor, one or more installation logs;

analyzing the one or more installation logs to identify a plurality of installations from a plurality of servers;

displaying representations of said plurality of servers on a two dimensional grid, wherein said plurality of servers are sorted along a first dimension wherein a server with fewer of said plurality of installations is automatically displayed toward one side of said first dimension compared to a second server having more of said plurality of installations;

displaying representations of said plurality of installations on said two dimensional grid, wherein said plurality of installations is sorted along a second dimension wherein a first installation which is on fewer of said plurality of servers is automatically displayed toward one side of said second dimension compared to a second installation which is on more of said plurality of servers;

visually grouping said plurality of servers within said two dimensional grid according to business groups and arranged within each group of the business groups based on compliance metrics; and

displaying a matrix of cells corresponding to intersections of said plurality of servers and said plurality of installations.

2. The method of claim 1 further comprising visually grouping representations of said plurality of servers into a plurality of groups.

3. The method of claim 1 further comprising color-coding said matrix of cells to represent said plurality of installations.

4. The method of claim 1 further comprising, in response to user interaction with said grid, displaying additional information within a cell in said matrix of cells.

5. The method of claim 4 wherein said displaying additional information comprises displaying at least one of system status, package status, links to object pages, install links, and uninstall links related to a user selected cell.

6. The method of claim 1 wherein said plurality of installations comprises at least one of a plurality of packages, a plurality of patches, and a plurality of programs.

7. The method of claim 1 further comprising:

identifying an anomalous system;

displaying said anomalous system in an entry in a table wherein said entry also comprises information for resolving said anomalous system.

8. The method of claim 2, further comprising:

receiving information of a change in at least one of the plurality of servers;

updating said two dimensional grid to reflect the change by updating at least one of;

an order of servers within a group of said plurality of groups wherein the order represents a sorted display of the servers within the group according to a number of installations, an order of the plurality of groups within said grid based on a number of anomalies within at least one of group of pluralities of groups, and an identified number of installations for particular software package

9. A method of characteristic presentation, said method comprising:

receiving one or more installation logs;

analyzing the one or more installation logs to identify a plurality of traits from a plurality of servers, wherein a first server of said plurality of servers has fewer of said plurality of traits than a second server of said plurality of servers, wherein a first trait of said plurality of traits is on fewer of said plurality of servers than a second trait of said plurality of traits, wherein said plurality of traits comprises at least one of software packages, health checks, compliance metrics, programs, and patches;

rendering, using at least one computer processor, a graphical display wherein said first server is positioned to one side of said second server along a first dimension based on respective numbers of traits had by said first and second servers;

rendering within said graphical display said first trait to one side second trait along a second dimension based on respective numbers of systems having said first and second traits;

visually grouping said plurality of servers within said graphical display according to business groups and arranged within each group of the business groups based on compliance metrics; and

rendering within said graphical display an array of cells corresponding to intersections of said plurality of servers and said plurality of traits.

10. The method of claim 9 further comprising visually grouping said plurality of servers according to clusters, or user defined custom groupings.

11. The method of claim 9 further comprising at least one of:

within said array of cells, color-coding an installed trait a first color;

within said array of cells, color-coding a trait that is not installed a second color; and

within said array of cells, color-coding a version mismatched trait a third color.

12. The method of claim 9 further comprising automatically displaying a table illustrating only severs of said plurality of servers which have anomalies, in response to a user request.

13. The method of claim 12 wherein said displaying said table comprises displaying at least one of health checks, compliance metrics, system status, package status, links to object pages, install links, and uninstall links.

14. The method of claim 9 further comprising:

identifying an anomalous trait; and

displaying said anomalous trait in an entry of a table wherein said entry further comprises resolution of said anomalous trait.

15. A system comprising:

a processor; and

memory coupled to the processor, wherein said memory comprises instructions that when executed cause said system to perform a method of anomaly identification, said method comprising;

collecting one or more installation logs;

analyzing the one or more installation logs to identify a plurality of installations from a plurality of servers;

displaying representations of said plurality of servers on a two dimensional grid, wherein said plurality of servers are sorted along a first dimension according to a respective amount of installations on each server;

displaying representations of said plurality of installations on said two dimensional grid, wherein said plurality of installations are sorted along a second dimension according to a respective amount of servers having each installation;

visually grouping said plurality of installation within said two dimensional grid according to business groups and arranged within each group of the business groups based on compliance metrics; and

displaying a plurality of cells corresponding to intersections of said plurality of servers and said plurality of installations.

16. The system of claim 15 wherein said method further comprises color-coding said plurality of cells to represent said information for said plurality of installations.

17. The system of claim 15 wherein said method further comprises, in response to user interaction with said grid, displaying additional information within a selected cell in said grid.

18. The system of claim 15 wherein said plurality of installations comprises at least one of a plurality of packages, a plurality of patches, and a plurality of programs.

19. The system of claim 15 wherein said method further comprises:

identifying an anomalous system; and

displaying said anomalous system in an entry in a table wherein said entry also comprises information for resolving said anomalous system.