Techniques and systems for detecting anomalous operational data
First Claim
1. A computer-implemented method, comprising:
- under the control of one or more computer systems configured with executable instructions,receiving, from a plurality of remote devices connected to the one or more computer systems, sensor data related to operation of the plurality of remote devices;
processing the received sensor data by at least;
buffering the received sensor data for a period of time;
determining, based at least in part on baseline values associated with the received sensor data, an anomaly score that indicates a level of abnormality for the buffered sensor data for the period of time; and
if the anomaly score indicates that the level of abnormality is higher than a determined threshold;
apportioning the buffered data to a volume of a plurality of volumes such that more than one volume of the plurality of volumes individually contains a portion of the buffered data that indicates the level of abnormality; and
alerting an entity associated with the plurality of remote devices that the level of abnormality is higher than the determined threshold.
1 Assignment
0 Petitions
Accused Products
Abstract
A system stores data, such as sensor data or other operational data, on a plurality of storage volumes in a sequence so as to allow for interpolations or other approximations of the data using a subset of the storage volumes in response to a request for information regarding that data. For example, a plurality of devices connect to the system to provide operational data, which is then stored in a specified sequence on a specified set of volumes. In response to a request for operational information regarding some or all of the devices, the system reads at least one of the volumes, and approximates the values of the data over a specified period of time. In some embodiments, the data may be buffered prior to storage, and a jitter analyzer determines whether the incoming data is anomalous relative to a baseline, which may be determined using related data sets.
-
Citations
20 Claims
-
1. A computer-implemented method, comprising:
under the control of one or more computer systems configured with executable instructions, receiving, from a plurality of remote devices connected to the one or more computer systems, sensor data related to operation of the plurality of remote devices; processing the received sensor data by at least; buffering the received sensor data for a period of time; determining, based at least in part on baseline values associated with the received sensor data, an anomaly score that indicates a level of abnormality for the buffered sensor data for the period of time; and if the anomaly score indicates that the level of abnormality is higher than a determined threshold; apportioning the buffered data to a volume of a plurality of volumes such that more than one volume of the plurality of volumes individually contains a portion of the buffered data that indicates the level of abnormality; and alerting an entity associated with the plurality of remote devices that the level of abnormality is higher than the determined threshold. - View Dependent Claims (2, 3, 4)
-
5. A system, comprising:
-
at least one computing device configured to implement one or more services, wherein the one or more services are configured to; receive data related to operation of a plurality of remote devices; process the received data by at least; buffering the received data for a period of time; determining a level of abnormality for the buffered data for the period of time; and if the level of abnormality is outside of a determined range; store at least a portion of the received data and anomaly information in response to the level of abnormality, the stored portion of data associated with the level of abnormality and determined based on the level of abnormality; and alert an entity associated with the plurality of remote devices that the level of abnormality is outside of the determined range. - View Dependent Claims (6, 7, 8, 9, 10, 11, 12)
-
-
13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
-
buffer incoming operational data for a period of time; calculate an anomaly score for the buffered operational data that enumerates a level of abnormality for the incoming operational data over the period of time; and if the anomaly score deviates from a determined range, store at least a subset of the buffered operational data on a sequence of volumes such that at least two volumes in the sequence individually capture information related to an anomaly associated with the anomaly score, the stored subset of the buffered operational data being determined based on the value of the anomaly score. - View Dependent Claims (14, 15, 16, 17, 18, 19, 20)
-
Specification