Visualization of behavior clustering of computer applications

• US 9,870,294 B2
• Filed: 01/13/2015
• Issued: 01/16/2018
• Est. Priority Date: 01/23/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Seto, Tetsuo
• Primary Examiner(s): Lau, Tung
• Application Number:
  US14/596,151
• Publication Number:
  US 20150205693A1
• Time in Patent Office: 1,099 Days
• Field of Search: None
• CPC Class Codes: G06F 11/3065 Monitoring arrangements determined by the means or processing involved in reporting the monitored data error or fault reporting or logging G06F11/0766
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Dimensionality reduction, such as principal component analysis, may be performed against a time series of performance observations for a computer application. A visual representation of the results may be displayed in one, two, or three dimensions, and often show clusters of operational behavior. The representation may be animated to show a sequence of observations and how the behavior of an application may change from one cluster of operation to another. The representation may be further applied to show both a historical view of the observations and new observations. The time series may contain performance and operational data, as well as metadata observed from a computer application.

Claims

1. A method performed at a computer system comprising one or more processors, for displaying one or more dimensionally transformed datasets, the method comprising:

generating, at the computer system, a dimensionality reduction transformation function representing a first time series, including at least;

receiving, at the computer system, the first time series collected from tracing a computer application at a first time, the first time series comprising performance data for a plurality of functions of the computer application observed while tracing the computer application at the first time;

processing, at the computer system, the first time series data into one or more time series vectors; and

creating, at the computer system, a dimensionality reduction transformation function by identifying one or more principal components within the one or more time series vectors;

receiving, at the computer system, a second time series collected from tracing the computer application at a second time;

applying, at the computer system, the dimensionality reduction transformation function to the first time series and the second time series to generate a transformed dataset comprising at least the identified principal components of the first time series and the second time series; and

causing the transformed dataset to be displayed at a display of the computer system.

2. The method of claim 1, the performance observations comprising resource utilization for each of the plurality of functions.

3. The method of claim 2, the resource utilization being at least one of a group composed of:

memory utilization;

processor utilization; and

network utilization.

4. The method of claim 1, the transformed dataset being displayed in two dimensions.

5. The method of claim 1, the transformed dataset being displayed in three dimensions.

6. The method of claim 1, the transformed dataset being displayed using animation showing a sequence of the observations in the transformed dataset.

7. The method of claim 6, the transformed dataset being displayed at least within a timeframe sufficient for an event prediction to occur prior to the occurrence of the predicted event.

8. The method of claim 1, at least some of the functions being part of a library of functions.

9. The method of claim 1 further comprising:

receiving a predicted observation, the predicted observation being predicted based on the second time series;

applying the dimensionality reduction transformation to generate a transformed predicated observation; and

causing the transformed predicted observation to be displayed.

18. The method of claim 1, wherein the one or more principal components are chosen from observations of the computer application'"'"'s performance comprising:

individual application functions, application programming interface calls, library components, network calls, memory operations, processing time, memory latency, memory consumption, and peripheral operations.

19. The method of claim 1, wherein the one or more principal components comprises one or more selection from either of a first group of observations comprising individual application functions, application programming interface calls, library components, network calls, and memory operations,

or from a second group of observations comprising processing time, memory latency, memory consumption, and peripheral operations.

20. The method of claim 19, wherein the one or more principal components comprises at least one selection from each of the first group of observations and the second group of observations.

10. A system comprising:

at least one computer processor;

a dimensionality reduction analyzer, executing on the at least one computer processor, that is configured to;

generate a dimensionality reduction transformation function representing a first time series, including at least;

receiving the first time series collected from tracing a computer application at a first time, the first time series comprising performance data for a plurality of functions of the computer application at the first time;

processing the first time series data into one or more time series vectors; and

creating a dimensionality reduction transformation function by identifying one or more principal components within the one or more time series vectors; and

a display engine that;

receives a second time series collected from tracing the computer application at a second time;

applies the dimensionality reduction transformation function to the first time series and the second time series to generate a transformed dataset comprising at least the identified principal components of the first time series and the second time series; and

causes the transformed dataset to be displayed at a display of the computer system.

11. The system of claim 10, the performance observations comprising resource utilization for each of the plurality of functions.

12. The system of claim 11, the resource utilization being at least one of a group composed of:

memory utilization;

processor utilization; and

network utilization.

13. The system of claim 10, the transformed dataset being displayed in two dimensions.

14. The system of claim 10, the transformed dataset being displayed in three dimensions.

15. The system of claim 10, the transformed dataset being displayed using animation showing a sequence of the observations in the transformed dataset.

16. The system of claim 15, the transformed dataset being displayed at least within a timeframe sufficient for an event prediction to occur prior to the occurrence of the predicted event.

17. The system of claim 10, at least some of the functions being part of a library of functions.