Systems and methods for adaptive thresholding using maximum concentration intervals

Patent metadata

Field	Value
Publication number	US-10069900-B2
Application number	US-201414452283-A
Country	US
Kind code	B2
Filing date	Aug 5, 2014
Priority date	Aug 5, 2014
Publication date	Sep 4, 2018
Grant date	Sep 4, 2018

Abstract

Aspects provide a generic and adaptive approach to adaptive thresholding by using a maximum concentration interval of data to determine one or more adaptive thresholds for any type of operational metric. The generated adaptive thresholds and operational metrics may be used to calculate or otherwise perform a statistical analysis that provides a confidence-level for any changes detected in the operational metric behavior.

First claim

What is claimed is:

1. A method comprising:
for a first set of values that quantify behavior of a computing system, determining, by one or more computing devices, a value range that covers at least a certain percentage of all value occurrences in the first set but does not cover at least one or more value occurrences in the first set, wherein the value range is selected based at least in part on the value range having a shorter length than one or more other possible value ranges that also cover at least the certain percentage of all value occurrences in the first set;
determining, by the one or more computing devices, at least a first probability that the value occurrences in the first set are above or below the value range;
for a second set of values that quantify behavior of the computing system, determining, by the one or more computing devices, a number of values in the second set that are above or below the value range that was determined for the first set;
based at least in part on the number of values and at least the first probability, determining, by the one or more computing devices, whether the second set of values likely represents a different distribution than the first set of values; and
in response to determining that the second set of values likely represents a different distribution than the first set of values, sending, by the one or more computing devices to the computing system, an alarm that indicates that the behavior of the computing system quantified by the second set of values corresponds to a change in an operational state of the computing system from the behavior of the computing system quantified by the first set of values, wherein the alarm triggers one or more operations in the computing system to account for the change in the operational state of the computing system.

2. The method of claim 1 , wherein the second set of values does not include a first subset of the first set of values but does include a second subset of the first set of values; and
wherein the second set of values further includes a third subset of values that replaces the first subset in a sliding window of a fixed number of values.

3. The method of claim 1 , wherein the first set of values and the second set of values skip over sets of values that were collected between the first set and second set.

4. The method of claim 1 , wherein the value range is a first value range, and wherein the number of values is a first number of values, further comprising:
for the second set of values, determining, by the one or more computing devices, a second value range that covers at least the certain percentage of all value occurrences in the second set but does not cover at least one or more value occurrences in the second set, wherein the second value range is selected based at least in part on the second value range having a shorter length than one or more other possible value ranges that also cover at least the certain percentage of all value occurrences in the second set;
determining, by the one or more computing devices, at least a second probability that the value occurrences in the second set are above or below the second value range;
for a third set of values that quantify behavior of the computing system, determining, by the one or more computing devices, a second number of values in the third set that are above or below the second value range that was determined for the second set;
based at least in part on the second number of values and at least the second probability, determining, by the one or more computing devices, whether the third set of values likely represents a different distribution than the second set of values; and
in response to determining that the third set of values likely represents a different distribution than the second set of values, storing, by the one or more computing devices, an indication that the third set of values likely represents a different distribution than the second set of values.

5. The method of claim 1 , wherein a length of the value range is a minimum possible length required to cover the certain percentage of all value occurrences.

6. The method of claim 1 , wherein the first probability indicates a probability that the value occurrences are above the value range.

7. The method of claim 1 , wherein the first probability indicates a probability that the value occurrences are below the value range.

8. The method of claim 1 , wherein the first probability indicates a probability that the value occurrences are above and below the value range.

9. The method of claim 1 , wherein determining whether the second set of values likely represents a different distribution than the first set of values comprises calculating a p-value based on the first probability and the number of values.

10. The method of claim 1 , wherein the first set of values and the second set of values include measurements of response times of the computing system; wherein the alarm indicates that the computing system is taking more time to process requests than in a previous operational state.

11. The method of claim 1 , wherein the first set of values and the second set of values include measurements of a throughput within the computing system; wherein the alarm indicates that the computing system is experiencing less throughput than in a previous operational state.

12. A non-transitory computer-readable medium encoded within instructions executable by a processor comprising:
for a first set of values that quantify behavior of a computing system, determining a value range that covers at least a certain percentage of all value occurrences in the first set but does not cover at least one or more value occurrences in the first set, wherein the value range is selected based at least in part on the value range having a shorter length than one or more other possible value ranges that also cover at least the certain percentage of all value occurrences in the first set;
determining at least a first probability that the value occurrences in the first set are above or below the value range;
for a second set of values that quantify behavior of the computing system, determining a number of values in the second set are above or below the value range that was determined for the first set;
based at least in part on the number of values and at least the first probability, determining whether the second set of values likely represents a different distribution than the first set of values; and
in response to determining that the second set of values likely represents a different distribution than the first set of values, sending, to the computing system, an alarm that indicates that the behavior of the computing system quantified by the second set of values corresponds to a change in an operational state of the computing system from the behavior of the computing system quantified by the first set of values, wherein the alarm triggers one or more operations in the computing system to account for the change in the operational state of the computing system.

13. The non-transitory computer-readable medium of claim 12 , wherein the second set of values does not include a first subset of the first set of values but does include a second subset of the first set of values; wherein the second set of values further includes a third subset of values that replaces the first subset in a sliding window of a fixed number of values.

14. The non-transitory computer-readable medium of claim 12 , wherein the first set of values and the second set of values skip over sets of values that were collected between the first set and second set.

15. The non-t

Assignees

• Oracle Int Corp

Inventors

• Poola Thyagaraju
• Enck Brent
• Volchegursky Vladimir

Classifications

• G06N7/00 Primary

  Computing arrangements based on specific mathematical models · CPC title

• H04L67/10 Primary

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title