Automatic alert generation

• US 9,860,109 B2
• Filed: 05/07/2014
• Issued: 01/02/2018
• Est. Priority Date: 05/07/2014
• Status: Active Grant

• Current Assignee: GOTO Group Incorporated (LogMeIn, Inc.)
• Original Assignee: GetGo, Inc. (LogMeIn, Inc.)
• Inventors: Koverman, Christopher K., Avrionov, Nikolay, Thapliyal, Ashish V.
• Primary Examiner(s): Hussain, Tauqir
• Assistant Examiner(s): GRIJALVA LOBOS, BORIS D
• Application Number:
  US14/271,678
• Publication Number:
  US 20150326446A1
• Time in Patent Office: 1,336 Days
• CPC Class Codes: H04L 41/048 mobile agents
• CPC Class Codes: H04L 41/0627 by acting on the notification or alarm source
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

Improved techniques of identifying when a device needs of service involve using data analytics to determine conditions when a device administrator of a computerized device is to be sent an alert regarding that device. Along these lines, a device monitoring system receives state data from a device that indicates the device is in a particular state, e.g., running certain applications, using some percentage of the processor and memory capacity, etc. The device monitoring system maps the device state data to a decision of whether or not to send a device administrator an alert concerning the device. The decision itself is a result of applying a model to the state data that is derived from the application of data analytics on historical device state data and administrator login data.

Claims

1. In a device monitoring system, a method of identifying when a device is in need of service, the method comprising:

receiving device state data from the device, the device state data indicating that the device is in a particular state;

inputting the device state data into a model that maps the device state data to a likelihood that a system administrator accesses a modeled device when the modeled device is in the particular state, the model having been generated from a correlation operation between (i) device state data received from a set of devices, and (ii) administrator login data providing instances in time when system administrators accessed the set of devices;

in response to a predetermined likelihood that the system administrator accesses the modeled device when the modeled device is in the particular state, sending a notification that the device is in need of service to a particular system administrator responsible for providing service to the device; and

prior to receiving the device state data from the device;

obtaining the device state data from each of the set of devices;

obtaining the administrator login data from each of the set of devices;

performing the correlation operation to generate the model; and

storing the model, the device state data, and the administrator login data in a database,

wherein receiving the device state data from the device includes assigning the device to a particular class of modeled devices according to a predetermined metric, the device state data of each device of the set of devices including values of a set of state parameters, each of the set of state parameters representing a corresponding feature of that device, the predetermined metric for each class of modeled devices being defined by an aggregate value for each of the set of state parameters,

wherein assigning the device to the particular class of modeled devices includes evaluating a difference between values of parameters of the set of parameters of the device and the aggregate values of the parameters, the device belonging to the set of devices, and each device of the set of devices being a computerized device having memory, processing circuitry, and application software installed on the device, the application software being executed by the processing circuitry, the notification being sent in response to receipt of the device state data,

wherein sending the notification includes sending the notification over an electronic communications network to a communications device associated with the particular system administrator, the notification being configured to initiate (i) a change in the administrator login data, and (ii) a report of the change in the administrator login data to be sent from the device to the device monitoring system, and

wherein the method further comprises;

receiving the report of the change in the administrator login data from the device over the electronic communications network; and

performing a further correlation between the device state data and the change in the administrator login data to affect an improvement in the model.

2. A method as in claim 1, wherein obtaining the device state data from each of the set of devices includes:

installing a software agent on that device, the software agent being configured to (i) collect device state data from that device, and (ii) cause that device to send the collected device state data to the database for storage; and

receiving the collected device state data from that device.

3. A method as in claim 2, wherein obtaining the device state data from each of the set of devices further includes receiving the device state data in response to the software agent observing the change in the administrator login data of that device;

and

wherein obtaining the administrator login data from each of the set of devices includes receiving the change in the administrator login data observed by the software agent installed on that device.

4. A method as in claim 3, where performing the correlation operation includes, upon receiving the change in the administrator login data from that device, forming a transition state from a difference between the device state data received from that device in response to the change in the administrator login data and a previous device state data received from that device, the model generated being based on the transition state.

5. A method as in claim 1, further comprising:

receiving an indication of whether the particular system administrator responsible for providing service to the device accessed the device in response to receiving the notification that the device is in need of service; and

inputting the indication into a machine learning module, the machine learning module being configured to adjust the model based on indications of whether a system administrator responsible for providing service to a device accessed the device in response to receiving the notification that the device is in need of service.

6. A method as in claim 1, wherein performing the correlation operation includes deriving, from the device state data, classes of modeled devices, each class of modeled devices including modeled devices having device states according to a predetermined metric, each class of modeled devices having a common model that maps device state data indicative of a device being in a given state to the likelihood that a system administrator accesses a modeled device when the modeled device is in the given state;

wherein receiving the device state data from the device includes assigning the device to a particular class of modeled devices; and

wherein inputting the device state data into the model includes inputting the device state data into the common model of the particular class of modeled devices.

7. A method as in claim 1, wherein sending the notification that the device is in need of service to the particular system administrator responsible for providing service to the device includes verifying, from the model, whether the particular system administrator is likely to access the device in response to receiving a particular alert.

8. A method as in claim 1, wherein obtaining the device state data from each of the set of devices includes:

receiving, via an electronic communications network, the device state data from a software agent installed on each device of the set of devices, the software agent installed on each device being configured to collect device state data from that device.

9. A method as in claim 8, wherein the method further includes receiving additional device state data and, in response to a likelihood lower than a predetermined threshold that the system administrator accesses the modeled device when the modeled device is in a particular state corresponding to the additional device state data, suppressing the notification that the device is in need of service to the particular system administrator responsible for providing service to the device.

10. A method as in claim 9 wherein the set of state parameters of each device of the set of devices includes at least one state parameter describing an amount of utilization of computational resources of the respective device.

11. In a device monitoring system, a method of identifying when a device is in need of service, the method comprising:

receiving device state data from the device, the device state data indicating that the device is in a particular state;

inputting the device state data into a model that maps the device state data to a likelihood that a system administrator accesses a modeled device when the modeled device is in the particular state, the model having been generated from a correlation operation between (i) device state data received from a set of devices, and (ii) administrator login data providing instances in time when system administrators accessed the set of devices;

in response to a predetermined likelihood that the system administrator accesses the modeled device when the modeled device is in the particular state, sending a notification that the device is in need of service to a particular system administrator responsible for providing service to the device; and

prior to receiving the device state data from the device;

obtaining the device state data from each of the set of devices;

obtaining the administrator login data from each of the set of devices;

performing the correlation operation to generate the model; and

storing the model, the device state data, and the administrator login data in a database,

wherein performing the correlation operation includes deriving, from the device state data, classes of modeled devices, each class of modeled devices including modeled devices having device states according to a predetermined metric, each class of modeled devices having a common model that maps device state data indicative of a device being in a given state to the likelihood that a system administrator accesses a modeled device when the modeled device is in the given state,

wherein receiving the device state data from the device includes assigning the device to a particular class of modeled devices,

wherein inputting the device state data into the model includes inputting the device state data into the common model of the particular class of modeled devices, device state data of each device including values of a set of state parameters, each of the set of state parameters representing a corresponding feature of that device, the predetermined metric for each class of modeled devices being defined by an aggregate value for each of the set of state parameters,

wherein assigning the device to the particular class of modeled devices includes evaluating a difference between values of parameters of the set of parameters of the device and the aggregate values of the parameters, the notification being sent in response to receipt of the device state data,

wherein sending the notification includes sending the notification over an electronic communications network to a communications device associated with the particular system administrator, the notification being configured to initiate (i) a change in the administrator login data, and (ii) a report of the change in the administrator login data to be sent from the device to the device monitoring system, and

wherein the method further comprises;

receiving the report of the change in the administrator login data from the device over the electronic communications network; and

performing a further correlation between the device state data and the change in the administrator login data to affect an improvement in the model.

12. A method as in claim 11, further comprising receiving a selected set of parameters of the set of parameters;

wherein evaluating the difference between the values of the parameters of the set of parameters of the device and the aggregate values of the parameters includes computing a difference between the values of parameters of the selected set of parameters and the aggregate values of the selected set of parameters only.

13. A method as in claim 11, wherein deriving the classes of modeled devices includes, for each class of modeled devices, assigning a mean value of a state parameter of the set of state parameters, the mean value being equal to an average value of the state parameter taken over the devices assigned to that class of modeled devices;

and

wherein inputting the device state data into the model includes evaluating a deviation of the value of the state parameter of the device state data of the device from the mean value of the state parameter for the class to which the device is assigned.

14. A method as in claim 11, wherein sending the notification that the device is in need of service includes sending a solution script to the particular system administrator responsible for providing service to the device, the solution script containing a sequence of steps configured to bring the device from the particular state to a second state, the solution script having been generated from sequences of steps received from the set of devices, each sequence of steps having been taken upon a login by a system administrator of a device that was recorded in the administrator login data of that device.

15. A method as in claim 14, further comprising:

obtaining, from each of the set of devices and prior to sending the notification, a sequence of steps taken by the particular system administrator responsible for providing service to that device, the sequence of steps being taken upon a login by the particular system administrator that was recorded in the administrator login data received from that device; and

generating, from sequences of steps obtained from the set of devices, the solution script configured to bring the device from being in the particular state to being in the second state.

16. A method as in claim 15, wherein generating the solution script includes:

locating devices assigned to a class of modeled devices which exhibit a transition between being in the first state and being in the second state; and

for each device located, identifying steps of the sequences of steps that accomplish the transition.

17. A method as in claim 16, wherein generating the solution script further includes

translating the identified steps into a scripting language compatible with the device;

and

producing a solution script file containing the solution script expressed in the scripting language compatible with the device.

18. A method as in claim 16, wherein identifying the steps includes obtaining a script used in transitioning that device from being in the first state to being in the second state.

19. A method as in claim 11, wherein an application state parameter of the set of state parameters of the device has a value identifying applications running on the device;

and

wherein sending the notification that the device is in need of service includes identifying (i) a first application of the set of applications exhibiting a predetermined behavior, and (ii) a second application of the set of applications causing the predetermined behavior exhibited by the first application.

20. A method as in claim 19, further comprising obtaining, from each of the set of devices and prior to sending the notification, an error log corresponding to each application running on that device, the error log indicating times at which that application exhibited predetermined behavior;

and

wherein identifying the first application of the set of applications exhibiting predetermined behavior includes reading an error log corresponding to the first application received from the device.

21. A method as in claim 20, further comprising performing a pattern detection operation on the error logs received from the set of devices, the pattern detection operation being configured to identify second applications of the set of applications that cause first applications of the set of applications to exhibit predetermined behavior.

22. An electronic apparatus constructed and arranged to identify when a device is in need of service, the apparatus comprising:

a network interface; and

a controller containing memory circuitry and controlling circuitry coupled to the memory circuitry, the controlling circuitry being constructed and arranged to;

receive device state data over the network interface from the device, the device state data indicating that the device is in a particular state;

input the device state data into a model that maps the device state data to a likelihood that a system administrator accesses a modeled device when the modeled device is in the particular state, the model having been generated from a correlation operation between (i) device state data received from a set of devices, and (ii) administrator login data providing instances in time when system administrators accessed the set of devices; and

in response to a predetermined likelihood that the system administrator accesses the modeled device when the modeled device is in the particular state, send, over the network interface, a notification that the device is in need of service to a particular system administrator responsible for providing service to the device,

wherein the controlling circuitry is further constructed and arranged to, prior to receiving the device state data from the device;

obtain the device state data from each of the set of devices;

obtain the administrator login data from each of the set of devices;

perform the correlation operation to generate the model; and

store the model, the device state data, and the administrator login data in a database, and

wherein the controlling circuitry is further constructed and arranged to;

assign the device to a particular class of modeled devices according to a predetermined metric, the device state data of each device of the set of devices including values of a set of state parameters, each of the set of state parameters representing a corresponding feature of that device, the predetermined metric for each class of modeled devices being defined by an aggregate value for each of the set of state parameters; and

evaluate a difference between values of parameters of the set of parameters of the device and the aggregate values of the parameters, the device belonging to the set of devices, and each device of the set of devices being a computerized device having memory, processing circuitry, and application software installed on the device, the application software being executed by the processing circuitry.

23. A computer program product comprising a non-transitory, computer-readable storage medium which stores code, the code including a compiler which when executed by a computer configured to identify when a device is in need of service, causes the computer to:

receive device state data over the network interface from the device, the device state data indicating that the device is in a particular state;

input the device state data into a model that maps the device state data to a likelihood that a system administrator accesses a modeled device when the modeled device is in the particular state, the model having been generated from a correlation operation between (i) device state data received from a set of devices, and (ii) administrator login data providing instances in time when system administrators accessed the set of devices; and

in response to a predetermined likelihood that the system administrator accesses the modeled device when the modeled device is in the particular state, send, over the network interface, a notification that the device is in need of service to a particular system administrator responsible for providing service to the device,

wherein, prior to causing the computer to receive the device state data from the device, the code, when executed by the computer, causes the computer to;

obtain the device state data from each of the set of devices;

obtain the administrator login data from each of the set of devices;

perform the correlation operation to generate the model; and

store the model, the device state data, and the administrator login data in a database, and

wherein the code, when executed by the computer, further causes the computer to;

assign the device to a particular class of modeled devices according to a predetermined metric, the device state data of each device of the set of devices including values of a set of state parameters, each of the set of state parameters representing a corresponding feature of that device, the predetermined metric for each class of modeled devices being defined by an aggregate value for each of the set of state parameters;

evaluate a difference between values of parameters of the set of parameters of the device and the aggregate values of the parameters, the device belonging to the set of devices, and each device of the set of devices being a computerized device having memory, processing circuitry, and application software installed on the device, the application software being executed by the processing circuitry, the notification being sent in response to receipt of the device state data;

send the notification over an electronic communications network to a communications device associated with the particular system administrator, the notification being configured to initiate (i) a change in the administrator login data, and (ii) a report of the change in the administrator login data to be sent from the device to the device monitoring system;

receive, from the device, the report of the change in the administrator login data; and

perform a further correlation between the device state data and the change in the administrator login data to affect an improvement in the model.