Behavior analysis and visualization for a computer infrastructure

Patent metadata

Field	Value
Publication number	US-11657309-B2
Application number	US-201916424127-A
Country	US
Kind code	B2
Filing date	May 28, 2019
Priority date	Mar 29, 2012
Publication date	May 23, 2023
Grant date	May 23, 2023

Abstract

The field of the disclosure relates generally to a method and system for analyzing behavior of a computer infrastructure and the displaying the behavior of the computer infrastructure in a graphical manner. The system comprises an analytical engine connected to agents running on devices in the computer infrastructure and analyzing continuous data and asynchronous data.

First claim

What is claimed is:

1. A method for analyzing behavior of a computer infrastructure, the method comprising:
monitoring and collecting continuous data on at least one device of a computer infrastructure by at least one agent associated with the at least one device, the continuous data comprises system parameters regarding the at least one device;
monitoring and collecting asynchronous data, by the at least one agent, when changes happen on the at least one device of the computer infrastructure, the asynchronous data including at least log file data of the at least one device;
executing a self-learning process comprising:
probabilistically modelling behaviors of the computer infrastructure using the continuous data and the asynchronous data in real-time;
identifying patterns in the probabilistically modeled behaviors via one or more statistical methods over time that includes analyzing relationships between the continuous data and the asynchronous data to detect a behavior type, of a plurality of behavior types, of at least one component of the computer infrastructure; and
identifying abnormal behaviors based on the identified patterns; and
initiating displaying of an indication indicative of the detected behavior type as graphic elements, at least one of the graphic elements being linked to the continuous data and the asynchronous data;

initiating display of an indication of a degree of impact of the detected behavior type on the computer infrastructure, wherein the graphic elements have different colors or shapes in relation to the degree of impact of the detected behavior type on the computer infrastructure, wherein at least a portion of the graphic elements are selectable, and in response to a selection of at least a portion of the graphic elements, opening related types of the system parameters and the log file data of the continuous data and asynchronous data within the computer infrastructure;
determining or simulating probabilities of certain streams of the log file data of the at least one device of the computer infrastructure; and
providing a forecast of possible future performance of the at least one device of the computer infrastructure based on the determination or simulation.

2. The method of claim 1 , wherein the probabilistically modelling identifies patterns across the log file data and the system parameters.

3. The method of claim 1 , wherein the one or more statistical methods identify patterns in the system parameters of the computer infrastructure.

4. The method of claim 3 , wherein the one or more statistical methods includes multivariate Gaussian analysis.

5. The method of claim 1 , further comprising linking at least some of the graphic elements to relationships determined between the system parameters and the log file data.

6. The method of claim 1 , wherein the system parameters include central processing unit (CPU) processing, access time, and/or memory usage.

7. The method of claim 1 , wherein the self-learning process initially identifies a first one of the behaviors as being abnormal behavior.

8. The method of claim 7 , wherein the self-learning process, in response to identifying a particular pattern, changes the identification of the first one of the behaviors from the abnormal behavior to a normal running process of the at least one device of the computer infrastructure.

9. The method of claim 1 , wherein the self-learning process uses stored previously collected asynchronous and continuous data to establish an initial pattern to obtain an initial behavior of the computer infrastructure.

10. A system for visualization of behavior within a computer infrastructure, the system comprising:
at least one agent associated with at least one device of a computer infrastructure for monitoring and collecting continuous data on the at least one device, the continuous data comprises system parameters regarding the at least one device;
the at least one agent further for monitoring and collecting asynchronous data when changes happen on the at least one device of the computer infrastructure, the asynchronous data including at least log file data of the at least one device of the computer infrastructure; and
an analytics engine configured for:
probabilistically modelling behaviors of computer infrastructure using the continuous data and the asynchronous data in real-time;
identifying patterns in the probabilistically modeled behaviors via one or more statistical methods over time that includes analyzing relationships between the continuous data and asynchronous data to detect a behavior type, of a plurality of behavior types, of at least one component of the computer infrastructure;
identifying abnormal behaviors based on the identified patterns;
initiating displaying of an indication indicative of the detected behavior type as graphic elements, at least one of the graphic elements being linked to the continuous data and the asynchronous data;
initiating a degree of impact of the detected behavior type, wherein the graphic elements have different colors or shapes in relation to the degree of impact of the detected behavior type, wherein at least a portion of the graphic elements are selectable, and in response to a selection of at least a portion of the graphic elements, opening related types of the system parameters and the log file data of the continuous data and asynchronous data within the computer infrastructure;
determining or simulating probabilities of certain streams of the log file data of the at least one device of the computer infrastructure; and
providing a forecast of possible future performance of the at least one device of the computer infrastructure based on the determination or simulation.

11. The system of claim 10 , wherein the analytics engine is a self-learning system.

12. The system of claim 10 , wherein the computer infrastructure is connectable with a data source for reception of data via a server and the server transfers data between the data source and the computer infrastructure.

13. A computer-readable program having a plurality of non-transitory instructions stored on a non-volatile medium which, when executed on a processer, causes the computer program to:
to monitor and collect continuous data on at least one device of a computer infrastructure by at least one agent associated with the at least one device, the continuous data comprises system parameters regarding the at least one device;
to monitor and collect asynchronous data when changes happen on the at least one device of the computer infrastructure by at least one agent associated with the at least one device, the asynchronous data including at least log file data of the at least one device of the computer infrastructure;
to execute a self-learning process, the self-learning process comprising:
probabilistically modelling behaviors of computer infrastructure using the continuous data and the asynchronous data in real-time;
identifying patterns in the probabilistically modeled behaviors via one or more statistical methods over time that includes analyzing relationships between the continuous data and the asynchronous data to detect a behavior type, of a plurality of behavior types, of at least one component of the computer infrastructure; and
identifying abnormal behaviors based on the identified patterns;

to initiate displaying of an indication indicative of the behavior type as graphic elements, at least one of the graphic elements being linked to the continuous data and the asynchronous data;
to initiate displaying a degree of impact of the detected behavior type on the computer infrastructure, wherein the graphic elements hav

Assignees

• Elasticsearch Bv

Inventors

• Dodson Stephen

Classifications

• G06F11/328 Primary

  Computer systems status display (G06F11/327 takes precedence) · CPC title

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/3495

  for systems · CPC title

• G06N5/02

  Knowledge representation; Symbolic representation · CPC title

• G06F11/3055

  Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16) · CPC title