Real-time analysis of multidimensional time series data to identify an operational anomaly

Patent metadata

Field	Value
Publication number	US-10944692-B2
Application number	US-201916245966-A
Country	US
Kind code	B2
Filing date	Jan 11, 2019
Priority date	Feb 22, 2018
Publication date	Mar 9, 2021
Grant date	Mar 9, 2021

Abstract

A device may receive data for a plurality of metrics from a set of server resources associated with hosting an application. The plurality of metrics may be related to a performance of the set of server resources. The data may be time series data. The device may normalize the data for the plurality of metrics across a set of points in time to form normalized data. The device may determine a score for the performance of the set of server resources associated with hosting the application at a particular point in time based on the normalized data. The score may be used to determine whether an anomaly is present in the performance of the set of server resources at the particular point in time. The device may perform an action to facilitate improvement of the performance of the set of server resources based on the score satisfying a threshold.

First claim

What is claimed is:

1. A method comprising:
receiving, by one or more devices and from one or more servers that host an application, multidimensional time series data as the application performs one or more operations,
the multidimensional time series data being received in a periodic manner,
the multidimensional time series data being received in real-time or near real-time to the application performing the one or more operations, and
the multidimensional time series data being for one or more metrics related to performance of server resources associated with the one or more servers,

determining, by the one or more devices, scores for different subsets of metrics included in the one or more metrics;
determining, by the one or more devices, an overall score for the performance of the server resources associated with hosting the application at a particular point in time based on the scores for the different subsets of metrics,
wherein the overall score is to be used to determine whether an anomaly is present in the performance of the server resources at the particular point in time;

determining, by the one or more devices, that the multidimensional time series data does not match, or does not match within a threshold, other multidimensional time series data that was received at a previous point in time;
storing, by the one or more devices and according to metadata associated with the multidimensional time series data, the multidimensional time series data based on determining that the multidimensional time series data does not match, or does not match within the threshold, the other multidimensional time series data,
wherein the metadata is used to organize the multidimensional time series data by particular server resources of the server resources; and

performing, by the one or more devices and based on the overall score satisfying a threshold, an action to facilitate improvement of the performance of the server resources after storing the multidimensional time series data.

2. The method of claim 1 , where the multidimensional time series data includes values for one or more of:
a set of application-related metrics,
a set of runtime-related metrics,
a set of operating system-related metrics,
a set of hardware-related metrics, or
a set of network-related metrics.

3. The method of claim 1 , where the multidimensional time series data is received based on requesting the multidimensional time series data in a streaming manner.

4. The method of claim 1 , further comprising:
receiving the metadata.

5. The method of claim 1 , where the metadata includes one or more of:
a timestamp for the multidimensional time series data,
an identifier that identifies a set of server resources that includes the one or more servers, or
an identifier that identifies the application.

6. The method of claim 1 , where the multidimensional time series data is stored in a set of memory resources that are configured to store the multidimensional time series data.

7. The method of claim 1 , further comprising:
determining, before receiving the multidimensional time series data, that redundant data matches the other multidimensional time series data; and
eliminating the redundant data, without storing the redundant data, based on determining that the redundant data matches the other multidimensional time series data.

8. The method of claim 1 ,
where the metadata includes information regarding the particular server resources of the server resources.

9. The method of claim 1 , where the multidimensional time series data is received in association with different multidimensional time series data for one or more other applications.

10. The method of claim 1 , further comprising:
determining, based on the one or more servers providing the multidimensional time series data, that the server resources are active without separately identifying which one or more of the server resources are active.

11. A system comprising:
one or more memories; and
one or more processors, communicatively coupled to the one or more memories, to:
receive, from one or more servers that host an application, multidimensional time series data as the application performs one or more operations,
the multidimensional time series data being for one or more metrics related to performance of server resources associated with the one or more servers;

determine scores for different subsets of metrics included in the one or more metrics;
determine an overall score for the performance of the server resources associated with hosting the application at a particular point in time based on the scores for the different subsets of metrics,
wherein the overall score is to be used to determine whether an anomaly is present in the performance of the server resources at the particular point in time;

determine that the multidimensional time series data does not match, or does not match within a threshold, other multidimensional time series data that was received at a previous point in time; and
store, according to metadata associated with the multidimensional time series data, the multidimensional time series data based on determining that the multidimensional time series data does not match, or does not match within the threshold, the other multidimensional time series data,
wherein the metadata is used to organize the multidimensional time series data by particular server resources of the server resources.

12. The system of claim 11 , where the one or more processors are further to:
perform, based on the multidimensional time series data, an action to facilitate operational improvement of a performance of server resources, of the one or more servers, after storing the multidimensional time series data.

13. The system of claim 11 , where the multidimensional time series data is received in real-time or near real-time to the application performing the one or more operations.

14. The system of claim 11 , where the multidimensional time series data is for one or more metrics related to performance of server resources associated with the one or more servers.

15. The system of claim 11 , where the one or more processors are further to:
determine, based on the one or more servers providing the multidimensional time series data, that server resources, of the one or more servers, are active without separately identifying which one or more of the server resources are active.

16. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
receive, from one or more servers that host an application, multidimensional time series data as the application performs one or more operations,
the multidimensional time series data being for one or more metrics related to performance of server resources associated with the one or more servers;

determine scores for different subsets of metrics included in the one or more metrics;
determine an overall score for the performance of the server resources associated with hosting the application at a particular point in time based on the scores for the different subsets of metrics,
wherein the overall score is to be used to determine whether an anomaly is present in the performance of the server resources at the particular point in time;

determine that the multidimensional time series data does not match, or does not match within a threshold, other multidimensional time series data that was received at a previous point in time; and
store, according to

Assignees

• Capital One Services Llc

Inventors

• Anand Kumar
• Hoenig Aaron
• Pandey Amit

Classifications

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L43/16

  Threshold monitoring · CPC title

• G06F11/3452

  Performance evaluation by statistical analysis · CPC title

• H04L47/822 Primary

  Collecting or measuring resource availability data · CPC title