Behavior clustering analysis and alerting system for computer applications
First Claim
Patent Images
1. A method performed on at least one computer processor, said method comprising:
- generating a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application;
applying said dimensionality reduction transformation to a previously observed time series to generate transformed historical data;
receiving a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset;
comparing said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset; and
generating an alert based on said anomalous observation, said alert triggering said at least one computer processor to cause a corrective action to be taken to correct said anomalous observation.
2 Assignments
0 Petitions
Accused Products
Abstract
Dimensionality reduction, such as principal component analysis, may be used at least in part to generate a model of time series observations of a computer application. The model may be applied to current and predicted observations. Outliers may be identified from current or predicted observations by analyzing those observations against the model, and statistically relevant outliers may generate alerts or corrective or other action to be taken. The outliers may be analyzed by searching for similar outliers that may have been previously observed, and predicting any future events based on similar observations of the past.
17 Citations
18 Claims
-
1. A method performed on at least one computer processor, said method comprising:
-
generating a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application; applying said dimensionality reduction transformation to a previously observed time series to generate transformed historical data; receiving a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset; comparing said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset; and generating an alert based on said anomalous observation, said alert triggering said at least one computer processor to cause a corrective action to be taken to correct said anomalous observation. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A system comprising:
-
a processor; a memory; and an analyzer operating on said processor and said memory, said analyzer that; receives a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application; applies said dimensionality reduction transformation to a previously observed time series to generate transformed historical data; receives a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset; compares said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset; and generates an alert based on said anomalous observation, said alert triggering said system to cause a corrective action to be taken to correct said anomalous observation. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. One or more hardware storage devices having stored thereon instructions that are executable by at least one processor to perform at least the following:
-
receive a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application; apply said dimensionality reduction transformation to a previously observed time series to generate transformed historical data; receive a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset; compare said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset; and generate an alert based on said anomalous observation, said alert triggering said at least one processor to cause a corrective action to be taken to correct said anomalous observation. - View Dependent Claims (14, 15, 16, 17, 18)
-
Specification