Method and system for analyzing and predicting the performance of computer network using time series measurements

• US 7,280,988 B2
• Filed: 12/19/2002
• Issued: 10/09/2007
• Est. Priority Date: 12/19/2001
• Status: Expired due to Fees

• Current Assignee: Metricly, Inc. (Virtana Corp.)
• Original Assignee: Netuitive, Inc. (Virtana Corp.)
• Inventors: Helsper, David, Jannarone, Robert, Rasmussen, Amanda, Huard, Jean-Francois, Homoki, David
• Primary Examiner(s): Vincent; David
• Assistant Examiner(s): Tran; Mai T.
• Application Number:
  US10/324,641
• Publication Number:
  US 20030139905A1
• Time in Patent Office: 1,755 Days
• Field of Search: 706/26, 706/22, 706/21, 709/24, 702/182, 702/186
• US Class Current: 706/26
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 2201/81 Threshold

Abstract

A monitoring system including a baseline model that automatically captures and models normal system behavior, a correlation model that employs multivariate autoregression analysis to detect abnormal system behavior, and an alarm service that weights and scores a variety of alerts to determine an alarm status and implement appropriate response actions. The baseline model decomposes the input variables into a number of components representing relatively predictable behaviors so that the erratic component e(t) may be isolated for further processing. These components include a global trend component, a cyclical component, and a seasonal component. Modeling and continually updating these components separately permits a more accurate identification of the erratic component of the input variable, which typically reflects abnormal patterns when they occur.

Claims

1. A method for analyzing and predicting the performance of a computer network, comprising the steps of continually receiving measurements defining signatures for a plurality of input variables reflecting performance of the computer network, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial, and for a selected input variable:

receiving a current measurement for a current time for an input variable reflective of the performance of the computer network;

defining a signature for the input variable comprising a time series of measurements for the selected input variable including historical measurements for past time trials and the current measurement for the current time trial;

dividing the signature for the selected input variable into multiple iterations of a repeating cycle wherein each iteration comprises a portion of the signature having a similar number of measurements, dividing each iteration into a plurality of similar contiguous time index periods, and computing a cyclical component of the selected input variable reflecting data accumulated for each time index period across multiple iterations of the cycle;

computing an erratic component of the selected input variable by removing at least the cyclical component from the signature;

computing a time-based baseline mean for the erratic component of the selected input variable based on the historical measurements of the selected input variable;

computing an imputed estimate for the erratic component of the selected input variable for the current time trial based on similarly computed erratic components for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables; and

determining and displaying an alert status for the computer network based on the time-based baseline mean for the erratic component of the selected input variable and the imputed estimate of the erratic component of the input variable for the current time trial.

2. The method of claim 1, further comprising the step of updating the learned parameters and the time-based baseline mean for the selected input variable based on the measurement received for the selected input value for the current time trial.

3. The method of claim 2, further comprising the step of repeating the steps of claim 2 for the other input variables.

4. The method of claim 3, further comprising the step of continually repeating the steps of claim 3 for multiple time trials.

5. The method of claim 1, wherein the step of determining the alert status for the computer network comprises the step of comparing a confidence value associated with the imputed estimate to a threshold value.

6. The method of claim 5, wherein:

the confidence value comprises a standard error associated with the imputed estimate; and

the threshold value is based on a standard error of the erratic component and a user-defined configuration parameter.

7. The method of claim 1, wherein the step of computing the erratic component of the selected input variable further comprises the step of removing a seasonal component from the signature of the selected input variable.

8. The method of claim 1, wherein the step of computing the erratic component of the selected input variable further comprises the step of removing a global trend from the signature of the selected input variable.

9. The method of claim 2, wherein the step of updating the time-based baseline mean for the selected input variable comprises the step of:

computing an updated baseline mean based on a weighted sum comprising the baseline mean for the selected input variable and the measurement for the current time trial for the selected input variable.

10. The method of claim 2, wherein the step of updating the time-based baseline mean for the selected input variable comprises the steps of:

computing an updated time-based baseline mean for the cyclical component;

computing an updated time-based baseline mean for the erratic component; and

summing the time-based baseline means for the cyclical and the erratic components.

11. The method of claim 4, further comprising the steps of:

receiving imputed estimate alerts corresponding to multiple input measurements;

weighting the alerts;

computing an alert score based on the weighted alerts; and

determining whether to activate an alarm condition based on the alert score.

12. A computer storage medium storing computer-executable instruction for performing the method of claim 1.

13. An apparatus configured to perform the method of claim 1.

14. The method of claim 1, further comprising the step of computing a forecast estimate for the erratic component of the selected input variable for the future time trials based on similarly computed erratic components for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables;

and

wherein the step of determining the alert status for the computer network takes into consideration the forecast estimate of the erratic component.

15. A method for analyzing and predicting the performance of a computer network, comprising the steps of continually receiving measurements defining signatures for a plurality of input variables reflecting performance of the computer network, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial, and for a selected input variable:

receiving a current measurement for a current time for an input variable reflective of the performance of the computer network;

defining a signature for the input variable comprising a time series of measurements for the selected input variable including historical measurements for past time trials and the current measurement for the current time trial;

dividing the signature for the selected input variable into multiple iterations of a repeating cycle wherein each iteration comprises a portion of the signature having a similar number of measurements, dividing each iteration into a plurality of similar contiguous time index periods, and computing a cyclical component of the selected input variable reflecting data accumulated for each time index period across multiple iterations of the cycle;

computing an erratic component of the selected input variable by removing at least the cyclical component from the signature;

computing a time-based baseline mean for the erratic component of the selected input variable based on the historical measurements of the selected input variable;

computing a forecast estimate for the erratic component of the selected input variable for the future time trials based on similarly computed erratic components for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables; and

determining and displaying an alert status for the computer network based on the time-based baseline mean for the erratic component of the selected input variable and the forecast estimate of the erratic component of the input variable for the current time trial.

16. The method of claim 15, further comprising the step of updating the learned parameters and the time-based baseline mean for the selected input variable based on the measurement received for the selected input value for the current time trial.

17. The method of claim 16, further comprising the step of repeating the steps of claim 16 for the other input variables.

18. The method of claim 17, further comprising the step of continually repeating the steps of claim 17 for multiple time trials.

19. The method of claim 18, further comprising the step of continually repeating the steps of claim 18 for multiple cyclical components.

20. The method of claim 16, wherein the step of determining the alert status for the computer network comprises the step of comparing the forecast estimate to a confidence value associated with the threshold value.

21. The method of claim 20, wherein the threshold value is based on the time-based baseline variance for the selected input variable and a user-defined configuration parameter.

22. The method of claim 15, wherein the step of computing the erratic component of the selected input variable further comprises the step of removing a seasonal component from the signature of the selected input variable.

23. The method of claim 15, wherein the step of computing the erratic component of the selected input variable further comprises the step of removing a global trend from the signature of the selected input variable.

24. The method of claim 16, wherein the step of updating the time-based baseline mean for the selected input variable comprises the step of:

computing an updated baseline mean based on a weighted sum comprising the baseline mean for the selected input variable and the measurement for the current time trial for the selected input variable.

25. The method of claim 16, wherein the step of updating the time-based baseline mean for the selected input variable comprises the steps of:

computing an updated time-based baseline mean for the cyclical component;

computing an updated time-based baseline mean for the erratic component; and

summing the time-based baseline means for the cyclical and the erratic components.

26. The method of claim 15, further comprising the steps of:

receiving forecast estimate alerts corresponding to multiple input measurements;

weighting the alerts;

computing an alert score based on the weighted alerts; and

determining whether to activate an alarm condition based on the alert score.

27. A computer storage medium storing computer-executable instruction for performing the method of claim 15.

28. An apparatus configured to perform the method of claim 15.

29. A method for analyzing and predicting the performance of a computer network characterized by a time-based signature, comprising the steps of:

(a) receiving a current measurement for a current time for an input variable reflective of the performance of the computer network;

(b) defining a signature for the input variable comprising a time series of measurements for the selected input variable including historical measurements for past time trials and the current measurement for the current time trial;

(c) determining a cyclical component associated with the time-based signature by dividing the signature for the selected input variable into multiple iterations of a repeating cycle wherein each iteration comprises a portion of the signature having a similar number of measurements, dividing each iteration into a plurality of similar contiguous time index periods, and computing a cyclical component of the selected input variable reflecting data accumulated for each time index period across multiple iterations of the cycle;

(d) computing an erratic component associated with the signature by removing at least the cyclical component from the signature;

(e) computing a forecast estimate of the erratic component based on a plurality of input variables reflected in the signature and a statistical model of the system comprising learned parameters reflecting observed relationships among the input variables;

(f) determining and displaying an alert status for the computer network based on an analysis of the erratic component;

(g) updating the learned parameters based on the inputs received the current time trial; and

(h) repeating steps (a) through (g) for each of a plurality of successive time trials.

30. The method of claim 29, wherein the step of computing the erratic component associated with the signature further comprises the step of removing a seasonal component from the signature.

31. The method of claim 30, wherein the seasonal component and the cyclical component overlap each other in time.

32. The method of claim 29, further comprising the step of updating the alert status for each time trial.

33. The method of claim 32, wherein the step of determining the alert status for the forecast estimate comprises the steps of:

computing a confidence value for the forecast estimate;

computing a threshold value for the forecast estimate based on the confidence value;

computing a forecast estimate alert value reflecting a difference between the forecast estimate and the erratic component for the selected input variable to the threshold value for the forecast estimate; and

determining an alert status for the forecast estimate by comparing the alert value to the threshold value for the imputed estimate.

34. The method of claim 33, wherein:

the threshold value is based on a standard error of the erratic component and a user-defined configuration parameter.

35. The method of claim 32, wherein the step of determining the alert status for the forecast estimate comprises the steps of:

computing a threshold value for the forecast estimate; and

determining an alert status for the computer network by comparing the forecast estimate to the threshold value.

36. The method of claim 35, wherein the threshold value is based on a time-based baseline variance for the selected input variable and a user-defined configuration parameter.

37. The method of claim 36, further comprising the step of computing a time-based baseline mean and variance for the selected input variable by:

computing a mean and variance for the seasonal component, the cyclical component and the erratic component;

combining the means for the components to obtain the time-based baseline mean; and

combining the variances for the components to obtain the time-based baseline variance.

38. The method of claim 37, further comprising the step of updating the time-based baseline mean and variance for the selected input variable each trim trial.

39. The method of claim 38, wherein the step of updating the time-based baseline mean and variance for the selected input variable comprises the steps of:

computing an updated baseline mean based on a weighted sum comprising the baseline mean for the selected input variable and the measurement for the current time trial for the selected input variable; and

computing an updated baseline variance based on a weighted sum comprising the baseline variance for the selected input variable and the measurement for the current time trial for the selected input variable.

40. The method of claim 39, wherein the step of updating the time-based baseline mean and variance for the selected input variable comprises the steps of:

computing an updated time-based baseline mean by;

computing an updated mean for each component based on a weighted sum comprising the baseline mean for the component and the measurement received for the selected input variable for the current time trial, and

summing the updated means for the components; and

computing an updated time-based baseline variance by;

computing an updated variance for each component based on a weighted sum comprising the baseline variance for the component and the measurement received for the selected input variable for the current time trial, and

summing the updated variances for the components.

41. The method of claim 40, further comprising the steps of:

receiving imputed estimate and forecast estimate alerts corresponding to multiple input measurements;

weighting the alerts;

computing an alert score based on the weighted alerts; and

determining whether to activate an alarm condition based on the alert score.

42. A computer storage medium storing computer-executable instruction for performing the method of claim 29.

43. An apparatus configured to perform the method of claim 29.