Method and apparatus for historical analysis analytics

• US 9,336,259 B1
• Filed: 08/08/2013
• Issued: 05/10/2016
• Est. Priority Date: 08/08/2013
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Kane, John P.
• Primary Examiner(s): Coby, Frantz
• Application Number:
  US13/962,497
• Time in Patent Office: 1,006 Days
• Field of Search: 707/770, 707/802, 707/803, 707/673, 707/679, 707/691, 714/57, 714/48, 714/37, 706/15, 706/46, 706/48, 706/24, 705/22
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/1471 involving logging of persistent data for recovery
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/256 in federated or virtual databases
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP

Abstract

A computer-implemented method is disclosed in which multiple disparate data sources having a different schemas are gathered, and relationships between the data sources are determined. A blended data set is created from the multiple data sources based on the determined relationships. A current behavior of a computing system is determined, with the current behavior being indicative of an anomaly. From the blended data set, historical behaviors of the same computing system or a similar computing system are determined. The current behavior is correlated to the historical behaviors to obtain a correlation, and a response to the anomaly is determined based on the correlation. A complementary computing device and computer program product are also disclosed.

Claims

1. A computer-implemented method comprising:

gathering data from multiple disparate data sources that have different schemas;

determining relationships between the data gathered from the multiple data sources;

creating a blended data set from the data gathered from the multiple data sources based on the determined relationships;

determining a current behavior of a computing system, the current behavior being indicative of an anomaly, said determining a current behavior comprising determining that performance data for the computing system which relates to performance of a plurality of computer-implemented transactions does not conform with a performance profile for the computing system;

determining, from the blended data set, historical behaviors of the same computing system or a similar computing system;

correlating the current behavior to the historical behaviors to obtain a correlation; and

determining, based on the correlation, a response to the anomaly and a confidence indicator indicating an estimated likelihood that the response to the anomaly will resolve the anomaly, wherein the response comprises one of;

a recommendation to rollback a detected change to a component of the computing system that has been altered during an observation period during which the computing system was configured to implement the transactions;

a recommendation to implement a new change to a component of the computing system; and

a recommendation that no components of the computing system need to be changed; and

presenting the response along with its determined confidence indicator to a user.

2. The computer-implemented method of claim 1, wherein gathering data from multiple data sources having different schemas comprises:

receiving the data from a plurality of gatherers, each gatherer being in communication with one or more of the data sources.

3. The computer-implemented method of claim 1, wherein determining a current behavior of the computing system that is indicative of an anomaly further comprises:

determining components included in the computing system; and

determining if a configuration of any of the components of the computing system has changed over an observation period during which the computing system was configured to implement the transactions.

4. The computer-implemented method of claim 3, wherein if the configuration of any of the components is determined to have been changed over the observation period the method further comprises:

determining if the changes were intentional; and

determining who made the changes.

5. The computer-implemented method of claim 1, wherein the recommendation that no components of the computing system need to be changed is only determined as the response if the occurrence of the performance data not conforming with the performance profile is determined to be permissible based on the data in one or more of the data sources.

6. A computing device comprising:

an interface circuit configured to receive data from a plurality of gatherers, each gatherer being in communication with one or more of a plurality of data sources, wherein the data sources are disparate and have different schemas; and

a controller circuit configured to;

gather the data received from the plurality of data sources;

determine relationships between the data sources;

create a blended data set from the multiple data sources based on the determined relationships;

determine that a current behavior of a computing system is indicative of an anomaly by determining that performance data for the computing system which relates to performance of a plurality of computer-implemented transactions does not conform with a performance profile for the computing system;

determine, from the blended data set, historical behaviors of the same computing system or a similar computing system;

correlate the current behavior to the historical behaviors to obtain a correlation; and

determine, based on the correlation, a response to the anomaly and a confidence indicator that represents an estimated likelihood that the response to the anomaly will resolve the anomaly, wherein the controller circuit is configured to determine the response as comprising one of;

a recommendation to rollback a detected change to a component of the computing system that has been altered during an observation period during which the computing system was configured to implement the transactions;

a recommendation to implement a new change to a component of the computing system; and

a recommendation that no components of the computing system need to be changed; and

present the response along with its associated confidence indicator to a user.

7. The computing device of claim 6, wherein to determine a current behavior of the computing system that is indicative of an anomaly, the controller circuit is configured to:

determine components included in the computing system; and

determine if a configuration of any of the components of the computing system has changed over an observation period during which the computing system was configured to implement the transactions.

8. The computing device of claim 7, wherein the controller circuit is configured to, if the configuration of any of the components is determined to have been changed over the observation period:

determine if the changes were intentional; and

determine who made the changes.

9. The computing device of claim 6, wherein the recommendation that no components of the computing system need to be changed is only determined as the response if the occurrence of the performance data not conforming with the performance profile is determined to be permissible based on data in one or more of the data sources.

10. A computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to gather data from multiple disparate data sources that have different schemas;

computer readable program code configured to determine relationships between the data sources;

computer readable program code configured to create a blended data set from the multiple data sources based on the determined relationships;

computer readable program code configured to determine that a current behavior of a computing system is indicative of an anomaly by determining that performance data for the computing system relating to performance of a plurality of computer-implemented transactions does not conform with a performance profile for the computing system;

computer readable program code configured to determine, from the blended data set, historical behaviors of the same computing system or a similar computing system;

computer readable program code configured to correlate the current behavior to the historical behaviors to obtain a correlation; and

computer readable program code configured to determine, based on the correlation, a response to the anomaly and a confidence indicator indicating an estimated likelihood that the response to the anomaly will resolve the anomaly, wherein the response comprises one of;

a recommendation to rollback a detected change to a component of the computing system that has been altered during an observation period during which the computing system was configured to implement the transactions;

a recommendation to implement a new change to a component of the computing system; and

a recommendation that no components of the computing system need to be changed; and

computer readable program code configured to present the response along with its associated confidence indicator to a user.

11. The computer program product of claim 10, wherein the computer readable program code configured to gather the data from the multiple data sources that have different schemas comprises:

computer readable program code configured to receive the data from a plurality of gatherers, each gatherer being in communication with one or more of the data sources.

12. The computer program product of claim 10, wherein the computer readable program code configured to determine a current behavior of the computing system that is indicative of an anomaly comprises:

computer readable program code configured to determine components included in the computing system; and

computer readable program code configured to determine if a configuration of any of the components of the computing system has changed over an observation period during which the computing system was configured to implement the transactions.

13. The computer program product of claim 12, wherein the computer readable program code further comprises:

computer readable program code configured to determine if any changes made to the configuration of any of the components over the observation period were intentional; and

computer readable program code configured to determine who made the changes.

14. The computer program product of claim 10, wherein the recommendation that no components of the computing system need to be changed is only determined as the response if the occurrence of the performance data not conforming with the performance profile is determined to be permissible based on data in one or more of the data sources.