Computer systems monitoring using beat frequency analysis

Patent metadata

Field	Value
Publication number	US-10503575-B2
Application number	US-201715414491-A
Country	US
Kind code	B2
Filing date	Jan 24, 2017
Priority date	Jun 26, 2015
Publication date	Dec 10, 2019
Grant date	Dec 10, 2019

Abstract

A monitoring service receives, from a variety of hardware components of a set of computer systems, binary signals indicative of operation of these components. The monitoring service determines, based at least in part on these signals, a set of beat frequencies for pairings of hardware components of the set of computer systems. The monitoring service uses this set of beat frequencies, as well as information included in a profile for the set of computer systems, to determine whether there is any indication of anomalous behavior in operation of the set of computer systems. If so, the monitoring service generates one or more alerts indicating the anomalous behavior.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
accessing signal information generated based at least in part on a plurality of signals resulting from operation of a computer system;
determining, based at least in part on the accessed signal information, a set of beat frequencies;
obtaining a profile of the computer system, the profile indicating a plurality of reference beat frequencies associated with the computer system;
determining, based at least in part on the set of beat frequencies and the plurality of reference beat frequencies, that the set of beat frequencies fail to satisfy a set of criteria to indicate anomalous behavior; and
updating the profile of the computer system to incorporate the set of beat frequencies with the plurality of reference beat frequencies for detection of anomalies in operation of the computer system.

2. The computer-implemented method of claim 1 , wherein the plurality of signals resulting from the operation of the computer system correspond to hardware components of the computer system.

3. The computer-implemented method of claim 1 , further comprising:
obtaining, from the profile, a first set of patterns for the plurality of reference beat frequencies;
determining, for the set of beat frequencies, a second set of patterns corresponding to the set of beat frequencies; and
performing pattern matching of the first set of patterns with the second set of patterns to determine that the set of beat frequencies fail to satisfy the set of criteria to indicate the anomalous behavior.

4. The computer-implemented method of claim 1 , further comprising:
calculating, for the plurality of signals, a plurality of peak frequencies; and
utilizing the plurality of peak frequencies to calculate the set of beat frequencies.

5. A system, comprising at least one computing device with a processor, the at least one computing device configured to implement one or more services, wherein the one or more services are configured to:
access signal information generated based at least in part on a plurality of signals resulting from operation of a computer system;
determine, based at least in part on the signal information, a set of beat frequencies;
obtain, from a profile of the computer system, a plurality of reference beat frequencies associated with the computer system;
determine, based at least in part on the set of beat frequencies and the plurality of reference beat frequencies, that the set of beat frequencies fail to satisfy a set of criteria to indicate anomalous behavior; and
update the profile of the computer system to incorporate the set of beat frequencies with the plurality of reference beat frequencies, resulting in an updated profile of the computer system.

6. The system of claim 5 , wherein the plurality of signals correspond to a plurality of different hardware components of the computer system, wherein individual hardware components of the plurality of hardware components generate individual signals of the plurality of signals.

7. The system of claim 5 , wherein the one or more services are further configured to:
access second signal information corresponding to operation of the computer system;
determine, based at least in part on the second signal information, a second set of beat frequencies;
obtain the updated profile;
determine, based at least in part on the updated profile and the second set of beat frequencies, that one or more anomalies have been identified; and
generate an alert specifying an indication of the one or more anomalies.

8. The system of claim 5 , wherein the one or more services are further configured to perform a Fourier transform on the signal information to obtain a set of frequencies usable to determine the set of beat frequencies.

9. The system of claim 5 , wherein the one or more services are further configured to perform a comparison of individual beat frequencies of the set of beat frequencies with the plurality of reference beat frequencies to determine that the set of beat frequencies fail to satisfy the set of criteria to indicate anomalous behavior.

10. The system of claim 5 , wherein the one or more services are further configured to:
obtain, from the profile, information specifying a first set of patterns associated with the plurality of reference beat frequencies;
identify, for the set of beat frequencies, a second set of patterns associated with the set of beat frequencies; and
analyze the first set of patterns and the second set of patterns to determine that the set of beat frequencies fail to satisfy the set of criteria to indicate anomalous behavior.

11. The system of claim 5 , wherein the one or more services are further configured to:
obtain, from the profile, statistical data for the plurality of reference beat frequencies; and
analyze the set of beat frequencies using the statistical data to determine that the set of beat frequencies fail to satisfy the set of criteria to indicate anomalous behavior.

12. The system of claim 5 , wherein the one or more services are further configured to:
determine, based at least in part on the plurality of signals, a set of characteristic frequencies for the computer system; and
use the set of characteristic frequencies to determine the set of beat frequencies.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
obtain signal information based at least in part on a plurality of signals resulting from a second computer system;
determine, based at least in part on the obtained signal information, a set of beat frequencies;
determine, based at least in part on the set of beat frequencies, that there are no anomalies in operation of the second computer system; and
update a profile of the second computer system to incorporate the set of beat frequencies for detection of anomalies in operation of the second computer system.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further cause the computer system to:
obtain, from the profile, reference beat frequencies associated with the second computer system; and
compare the set of beat frequencies with the reference beat frequencies to determine that there are no anomalies.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions further cause the computer system to:
identify, from the profile, one or more patterns associated with the reference beat frequencies; and
determine that there are no anomalies in response to a determination that the set of beat frequencies comport with the one or more patterns.

16. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions further cause the computer system to:
identify, from the profile, statistical data generated based at least in part on the reference beat frequencies; and
determine that there are no anomalies based at least in part on an analysis of the set of beat frequencies using the statistical data.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions further cause the computer system to use the set of beat frequencies to update the statistical data.

18. The non-transitory computer-readable storage medium of claim 16 , wherein the statistical data includes standard deviation values for the reference beat frequencies, variance values for the reference beat frequencies, and mean values

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Sethi Tushaar
• Stathakopoulos George Nikolaos

Classifications

• G06F11/3068

  where the reporting involves data format conversion · CPC title

• G06F11/3065

  Monitoring arrangements determined by the means or processing involved in reporting the monitored data (error or fault reporting or logging G06F11/0766) · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title

• G06F11/0706

  the processing taking place on a specific hardware platform or in a specific software environment · CPC title

• G06F11/0775

  Content or structure details of the error report, e.g. specific table structure, specific error fields · CPC title