Organizing network performance metrics into historical anomaly dependency data

• US 9,632,858 B2
• Filed: 05/13/2014
• Issued: 04/25/2017
• Est. Priority Date: 07/28/2013
• Status: Active Grant

• Current Assignee: Lightbend, Inc.
• Original Assignee: OpsClarity, Inc. (Lightbend, Inc.)
• Inventors: Sasturkar, Amit, Ngai, Alan
• Primary Examiner(s): McCarthy, Christopher
• Application Number:
  US14/276,846
• Publication Number:
  US 20150033086A1
• Time in Patent Office: 1,078 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation

Abstract

The technology disclosed relates to organizing network performance metrics into historical anomaly dependency data. In particular, it relates to calculating cascading failure relationships between correlated anomalies detected in a network. It also relates to illustrating to a network administrator causes of system failure by laying out the graph to show a progression over time of the cascading failures and identify root causes of the cascading failures. It also relates to ranking anomalies and anomaly clusters in the network based on attributes of the resources exhibiting anomalous performances and attributes of the anomalous performances. It further relates to depicting evolution of resource failures across a network by visually coding impacted resources and adjusting the visual coding over time and allowing replay over time to visualize propagation of anomalous performances among the impacted resource.

Claims

1. A method of ranking anomalies in an anomaly cluster, the method including:

assembling performance data for a multiplicity of metrics across a multiplicity of resources on a network and automatically setting criteria based on the performance data over time that qualifies a subset of the performance data as anomalous instance data, wherein the anomalous instance data are grouped in a cluster of operation anomalies that are interrelated as cascading failures traced over active network communication paths among resources, wherein the communication paths propagate anomalous performances;

constructing a map that graphically depicts propagation of the anomalous performances along the active network communication paths as edges between nodes representing the resources; and

calculating impact rankings for the nodes based at least on attributes of the resources exhibiting anomalous performances.

2. The method of claim 1, wherein resource attributes include predetermined importance values assigned to the resources exhibiting anomalous performances.

3. The method of claim 1, wherein resource attributes include visibility of the resources exhibiting anomalous performances.

4. The method of claim 1, wherein resource attributes include conditions of service level agreements violated by anomalous performances of the resources.

5. The method of claim 1, wherein resource attributes include redundant availabilities of the resources exhibiting anomalous performances.

6. The method of claim 1, further including:

receiving human feedback from one or more users on the calculated impact rankings for the nodes representing anomalous instance data for the resources; and

further calculating new impact rankings for the nodes based on the received human feedback.

7. The method of claim 1, further including calculating impact rankings for the nodes based on human inspection and evaluation of detected anomalies.

8. A method of ranking anomalies in an anomaly cluster, the method including:

assembling performance data for a multiplicity of metrics across a multiplicity of resources on a network and automatically setting criteria based on the performance data over time that qualifies a subset of the performance data as anomalous instance data, wherein the anomalous instance data are grouped in a cluster of operation anomalies that are interrelated as cascading failures traced over active network communication paths among resources, wherein the communication paths propagate anomalous performances;

constructing a map that graphically depicts propagation of the anomalous performances along the active network communication paths as edges between nodes representing the resources; and

calculating impact rankings for the nodes based at least on attributes of the anomalous performances.

9. The method of claim 8, wherein anomaly performance attributes specify severities of the anomalous performance.

10. The method of claim 9, wherein the severities of the anomalous performances are calculated based on number of standard deviations from a mean value of corresponding performance metrics.

11. The method of claim 9, wherein the severities of the anomalous performances are calculated based on number of additional resources impacted or likely to be impacted by the anomalous performances of the resources.

12. The method of claim 9, wherein the severities of the anomalous performances are calculated based on number of previous anomalous performances that caused the anomalous performances exhibited by the resources.

13. The method of claim 9, wherein the severities of the anomalous performances are calculated based on impact rankings of previous anomalous performances that caused the anomalous performances exhibited by the resources.

14. The method of claim 8, wherein anomaly performance attributes include predetermined confidence values assigned to the anomalous performances.

15. The method of claim 14, wherein the confidence values specify a likelihood of the anomalous performances impacting the resources.

16. The method of claim 8, wherein anomaly performance attributes include duration of the anomalous performances.

17. The method of claim 8, wherein anomaly performance attributes identify metrics for which the anomaly instance data is assembled.

18. The method of claim 8, further including:

receiving human feedback from one or more users on the calculated impact rankings for the nodes representing anomalous instance data for the resources; and

further calculating new impact rankings for the nodes based on the received human feedback.

19. The method of claim 8, further including calculating impact rankings for the nodes based on human inspection and evaluation of detected anomalies.

20. A method of ranking anomaly clusters, the method including:

assembling performance data for a multiplicity of metrics across a multiplicity of resources on a network and automatically setting criteria based on the performance data over time that qualifies a subset of the performance data as anomalous instance data;

grouping the anomalous instance data into an anomaly cluster including anomaly nodes that represent detected anomalies that compromise respective resources and probability weighted directed edges connecting correlated anomaly nodes, wherein the probability weighted directed edges express strength of a correlation between the correlated anomaly nodes that are connected by the edges;

scoring importance of the anomaly cluster by calculating anomaly node importance values of anomaly nodes in the cluster, propagating the anomaly node importance values to terminal nodes in the anomaly cluster and aggregating the propagated anomaly values of the terminal nodes; and

repeating the scoring for a plurality of anomaly clusters and reporting at least relative scoring of the anomaly clusters for further processing.

21. The method of claim 20, wherein reporting at least relative scoring of the anomaly clusters further includes identifying a number of service level agreements violated by the anomalies.

22. The method of claim 20, wherein reporting at least relative scoring of the anomaly clusters further includes specifying a count of detected anomalies in an anomaly cluster that compromised the respective resources.

23. The method of claim 22, further including, responsive to selection of an anomaly count in a cluster, identifying the detected anomalies along with the compromised respective resources.

24. The method of claim 20, wherein reporting at least relative scoring of the anomaly clusters further includes specifying a count of resources compromised by the anomalies.

25. The method of claim 24, further including, responsive to selection of a resource count in a cluster, identifying resources compromised by the anomalies in the anomaly cluster.

26. The method of claim 20, wherein reporting at least relative scoring of the anomaly clusters further includes calculating a rating of urgency of the anomaly clusters responsive to the calculated anomaly node importance of anomaly nodes in the cluster.

27. The method of claim 20, further including visually coding the anomaly clusters, responsive to the calculated anomaly node importance of anomaly nodes in the cluster, to indicate severity of respective anomaly clusters.

28. A method of depicting evolution of resource failures across a network, the method including:

constructing a resource connectivity graph with resource instances indicated grouped within resource blocks, wherein the resource blocks are connected to represent an active communication network path among the resources;

visually coding record instances in resource blocks and resource blocks to indicate impaired performance due to anomalies occurred at the resource instances; and

adjusting the visual coding over time and allowing replay over time to visualize propagation of anomalous performances among the resource blocks.

29. The method of claim 28, further including allowing pausing at a point in time to visualize anomalous performances at the paused point in time.

30. The method of claim 29, further including providing a drill-down access to anomalous performances at the paused point in time, wherein the drill-down access identifies at least a timeline of anomalous performances showing how anomalous performances spread in time among the impaired resources.

31. The method of claim 28, further including allowing forward playing to a point in time in future to visualize potential anomalous performances at the forwarded point in time.

32. The method of claim 28, further including allowing reverse playing to a point in time in past to visualize anomalous performances at the reversed point in time.