System and Method for Transforming Observed Metrics into Detected and Scored Anomalies – US10061632B2 [Grant]
A system includes a normal behavior characterization module configured to receive values for a first metric of a plurality of metrics and generate a baseline profile indicating normal behavior of the first metric based on the received values. The system also includes an anomaly identification module configured to identify an anomaly in response to present values of the metric deviating outside the baseline profile. The system also includes an anomaly behavior characterization module configured to analyze a plurality of prior anomalies identified by the anomaly identification module and develop a model of the anomalies of the first metric. The system also includes an anomaly scoring module configured to determine a first score for a present anomaly detected by the anomaly identification module for the first metric. The first score is based on characteristics of the present anomaly and the model of the anomalies of the first metric.
Fast automated detection of seasonal patterns in time series data without prior knowledge of seasonal periodicity – US10061677B2 [Grant]
A processing system receives a time series of values of a first metric corresponding to computing system performance. A computation module calculates an autocorrelation function (ACF) based on the time series of values across a set of values of tau. The spacing between each consecutive pair of values in the set of values of tau increases as tau increases. A local maxima extraction module identifies local maxima of the calculated ACF. A period determination module determines a significant period based on spacing between the local maxima and selectively outputs the significant period as a periodicity profile. A baseline profile indicating normal behavior of the first metric is generated based on the periodicity profile. An anomaly identification module selectively identifies an anomaly in present values of the first metric in response to the present values deviating outside the baseline profile.
Heuristic Inference of Topological Representation of Metric Relationships – US20160210556A1 [Application]
A system includes a windowing module that divides time series data for each metric into portions. Each portion corresponds to a respective window of time. A hash module calculates a hash value for each of the portions for each of the metrics. An identification module compares the hash values for each pair of metrics and, for a selected pair of metrics, counts how many windows of time in which the hash values of the selected pair of metrics are equal. A pair is identified as a candidate pair in response to the count exceeding a threshold. A metric graph module creates a first edge in a graph based on the candidate pair of metrics. Each of the metrics is a node in the graph and direct relationships between each pair of the metrics are edges in the graph. An anomaly combination module analyzes an anomaly condition based on the graph.