Dynamic anomaly reporting

Patent metadata

Field	Value
Publication number	US-11410061-B2
Application number	US-201916721629-A
Country	US
Kind code	B2
Filing date	Dec 19, 2019
Priority date	Jul 2, 2019
Publication date	Aug 9, 2022
Grant date	Aug 9, 2022

Abstract

Systems and methods are provided for dynamic selection of anomaly detection options for particular metric data. Metric data corresponding to one or more configuration items of an information technology (IT) infrastructure is collected. A selected anomaly detection action option that applies to the metric data is identified. An action is performed using the metric data, based upon the selected anomaly detection action option. A dashboard graphical user interface (GUI) display results of the action.

First claim

The invention claimed is:

1. A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions that, when executed by one or more processors of the machine, cause the machine to:
collect metric data corresponding to one or more configuration items of an information technology (IT) infrastructure;
classify time-series data present in the metric data related to the one or more configuration items of the IT infrastructure;
generate, based on the classified time-series data, a statistical model used to identify anomalies in the metric data;
determine a quality of the statistical model use;
automatically select an anomaly detection action option of a plurality of anomaly detection action options based upon the quality of the statistical model;
perform an action using the metric data based upon the selected anomaly detection action option; and
generate a dashboard graphical user interface (GUI) configured to display results of the action.

2. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the selected anomaly detection action option comprises a default option when no overriding options are indicated.

3. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the plurality of anomaly detection action options comprise a metric collection option that stores the metric data without performing subsequent anomaly detection actions on the metric data.

4. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the plurality of anomaly detection action options comprise a boundary generation option that generates statistical upper bounds and statistical lower bounds for the metric data.

5. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the plurality of anomaly detection action options comprise an anomaly score generation option that generates one or more anomaly scores for the metric data, wherein the anomaly scores indicate a magnitude of deviation between the metric data and the statistical model over one or both of multiple measurements of the metric data or a particular time interval.

6. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the plurality of anomaly detection action options comprise an anomaly alert generation option that generates anomaly alerts in an anomaly list of the dashboard GUI based on identified anomalies in the metric data, wherein the anomalies are identified based upon one or both of:
a magnitude of outlier data found in the metric data, or
a magnitude of deviation between the metric data and the statistical model over one or both of multiple measurements of the metric data or a particular time interval.

7. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the plurality of anomaly detection action options comprise an IT alert generation option that generates IT alerts on an IT view of the dashboard GUI based on identified anomalies in the metric data, wherein the anomalies are identified based upon one or both of:
a magnitude of outlier data found in the metric data, or
a magnitude of deviation between the metric data and the statistical model over one or both of multiple measurements of the metric data or a particular time interval; and wherein the IT view comprises a view that is elevated in importance over an anomaly alert view of the dashboard GUI.

8. The tangible, non-transitory, machine-readable medium of claim 1 , where the selected anomaly detection action is set by selecting from a modal list of the plurality of anomaly detection action options in a metric data configuration view of the GUI.

9. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the quality of the statistical model is below a quality threshold, resulting in selection of a metric collection option that stores the metric data without performing subsequent anomaly detection actions on the metric data as the selected anomaly detection action option.

10. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the quality of the statistical model meets or exceeds a quality threshold, resulting in selection of an alert generation option that generates anomaly alerts based upon a magnitude of deviation between the metric data and the statistical model over one or both of multiple measurements of the metric data or a particular time interval.

11. The tangible, non-transitory, machine-readable medium of claim 1 , comprising machine-readable instructions that, when executed by the one or more processors, cause the machine to:
identify, via machine learning, patterns that indicate a particular anomaly detection action option to use for the metric data; and
automatically select the particular anomaly detection action option as the selected anomaly detection action option.

12. The tangible, non-transitory, machine-readable medium of claim 1 , wherein the quality of the statistical model is indicative of an ability of the statistical model to accurately identify the anomalies.

13. The tangible, non-transitory, machine-readable medium of claim 12 , comprising machine-readable instructions that, when executed by the one or more processors, cause the machine to:
automatically select the anomaly detection action option of the plurality of anomaly detection action options based upon a comparison of the quality of the statistical model to a qualitative threshold.

14. The tangible, non-transitory, machine-readable medium of claim 1 , wherein automatically selecting the anomaly detection action option of the plurality of anomaly detection action options comprises automatically selecting the anomaly detection action option of the plurality of anomaly detection action options based on a priority of the metric data.

15. A computer-implemented method, comprising:
collecting metric data corresponding to one or more configuration items of an information technology (IT) infrastructure;
classifying time-series data present in the metric data related to the one or more configuration items of the IT infrastructure;
generating, based on the classified time-series data, a statistical model used to identify anomalies in the metric data;
determining a quality of the statistical model;
automatically selecting an anomaly detection action option of a plurality of anomaly detection action options based upon the quality of the statistical model;
performing an action using the metric data based upon the selected anomaly detection action option; and
generating a dashboard graphical user interface (GUI) configured to display results of the action.

16. The computer-implemented method of claim 15 , comprising:
using a default option as the selected anomaly detection action option when no overriding options are indicated.

17. The computer-implemented method of claim 15 , wherein the plurality of anomaly detection action options comprise:
a metric collection option that stores the metric data without performing subsequent anomaly detection actions on the metric data;
a boundary generation option that generates statistical upper bounds and statistical lower bounds for the metric data;
an anomaly score generation option that generates one or more anomaly scores for the metric data, wherein the anomaly scores indicate a magnitude of deviation between the metric data and the statistical model over multiple measurements of the metric data, over a particular time interval, or both;
an anomaly alert generation option that generates anomaly alerts in an anomaly list of the dashboard GUI based on identified a

Assignees

• Servicenow Inc

Inventors

• Dang Kanwaldeep K
• Mehta Anand Nikhil
• Bushireddy Kiran Kumar
• Patel Swapnesh
• Makovsky Bnayahu

Classifications

• H04L41/0686

  Additional information in the notification, e.g. enhancement of specific meta-data · CPC title

• G06F3/04847

  Interaction techniques to control parameter settings, e.g. interaction with sliders or dials · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• G06N7/00 Primary

  Computing arrangements based on specific mathematical models · CPC title

• H04L41/22 Primary

  comprising specially adapted graphical user interfaces [GUI] · CPC title