Classifying telemetry data to identify and remediate issues

Patent metadata

Field	Value
Publication number	US-11106948-B2
Application number	US-201816021171-A
Country	US
Kind code	B2
Filing date	Jun 28, 2018
Priority date	Jun 28, 2018
Publication date	Aug 31, 2021
Grant date	Aug 31, 2021

Abstract

In some examples, a server may receive, from a computing device, data identifying an event that occurred on the computing device. The server may determine a plurality of features associated with the event, determine a distance between individual features of the plurality of features and individual centroids of a plurality of clusters, and determine that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters. The server may determine a classification of the event based on the particular cluster and determine that the classification is a remediable issue. Based on the classification, the server may select and perform a remediation action from a plurality of remediation actions.

First claim

What is claimed is:

1. A method comprising:
receiving, by one or more processors and from a computing device, data identifying an event that occurred on the computing device;
determining, by the one or more processors, a plurality of features associated with the event;
determining, by the one or more processors, a distance between individual features of the plurality of features and individual centroids of a plurality of clusters;
determining, by the one or more processors, that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters;
determining, by the one or more processors, a classification of the event based on the particular cluster;
determining, by the one or more processors, that the classification is a remediable issue;
selecting, by the one or more processors and based on the classification, a remediation action from a plurality of remediation actions; and
performing, by the one or more processors, the remediation action.

2. The method of claim 1 , wherein the event comprises:
a name of the computing device;
a description of the computing device;
a timestamp indicating when the event occurred; and
a description of the event.

3. The method of claim 2 , wherein the description of the event comprises at least one of an operating system crash, an install of a particular software application was initiated, the particular software application failed to install, the install of the particular software application was successful, a downloaded software application failed a security hash check, a downloaded firmware failed the security hash check, a heartbeat event, or a selection event.

4. The method of claim 1 , wherein the classification comprises one of a normal event, a security issue, a bug, or an anomaly.

5. The method of claim 4 , wherein the remediable issue comprises one of the security issue or the bug.

6. The method of claim 1 , wherein the remediation action comprises at least one of:
temporarily deactivating an application programming interface (API) key associated with the computing device; or
temporarily discarding an additional event received from the computing device.

7. The method of claim 1 , wherein the remediation action comprises at least one of:
sending a first remediation instruction to the computing device instructing the computing device to:
uninstall an application;
download a latest version of the application; and,
install the latest version of the application;

sending a second remediation instruction to the computing device instructing the computing device to:
download a latest version of firmware associated with component of the computing device; and,
install the latest version of the firmware; or

sending a third remediation instruction to the computing device instructing the computing device to:
download a latest version of a basic input output system (BIOS) of the computing device; and,
install the latest version of the BIOS.

8. A server comprising:
one or more processors; and
one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:
receiving, from a computing device, data identifying an event that occurred on the computing device;
determining a plurality of features associated with the event;
determining a distance between individual features of the plurality of features and individual centroids of a plurality of clusters;
determining that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters;
determining a classification of the event based on the particular cluster;
determining that the classification is a remediable issue;
selecting, based on the classification, a remediation action from a plurality of remediation actions; and
performing the remediation action.

9. The server of claim 8 , wherein the event comprises:
a name of the computing device;
a description of the computing device;
a timestamp indicating when the event occurred; and
a description of the event.

10. The server of claim 9 , wherein the description of the event comprises at least one of an operating system crash, an install of a particular software application was initiated, the particular software application failed to install, the install of the particular software application was successful, a downloaded software application failed a security hash check, a downloaded firmware failed the security hash check, a heartbeat event, or a selection event.

11. The server of claim 8 , wherein:
the classification comprises one of a normal event, a security issue, a bug, or an anomaly; and
the remediable issue comprises one of the security issue or the bug.

12. The server of claim 8 , wherein the remediation action comprises at least one of:
temporarily deactivating an application programming interface (API) key associated with the computing device; or
temporarily discarding an additional event received from the computing device.

13. The server of claim 8 , wherein the remediation action comprises at least one of:
sending a first remediation instruction to the computing device instructing the computing device to:
uninstall an application;
download a latest version of the application; and,
install the latest version of the application;

sending a second remediation instruction to the computing device instructing the computing device to:
download a latest version of firmware associated with component of the computing device; and,
install the latest version of the firmware; or

sending a third remediation instruction to the computing device instructing the computing device to:
download a latest version of a basic input output system (BIOS) of the computing device; and,
install the latest version of the BIOS.

14. One or more non-transitory computer readable media storing instructions executable by one or more processors to perform operations comprising:
receiving, from a computing device, data identifying an event that occurred on the computing device;
determining a plurality of features associated with the event;
determining a distance between individual features of the plurality of features and individual centroids of a plurality of clusters;
determining that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters;
determining a classification of the event based on the particular cluster;
determining that the classification is a remediable issue;
selecting, based on the classification, a remediation action from a plurality of remediation actions; and
performing the remediation action.

15. The one or more non-transitory computer readable media of claim 14 , wherein the event comprises:
a name of the computing device;
a description of the computing device;
a timestamp indicating when the event occurred; and
a description of the event.

Assignees

• Dell Products Lp

Inventors

• Vichare Nikhil M
• Ramos Jr Arturo

Classifications

• H04Q9/00 Primary

  Arrangements in telecontrol or telemetry systems for selectively calling a substation from a main station, in which substation desired apparatus is selected for applying a control signal thereto or for obtaining measured values therefrom · CPC title

• G06F18/24

  Classification techniques · CPC title

• G06F18/24137

  Distances to cluster centroïds · CPC title

• G06F18/23213

  with fixed number of clusters, e.g. K-means clustering · CPC title

• G06F18/22

  Matching criteria, e.g. proximity measures · CPC title