Adaptive Anomaly Grouping

Patent metadata

Field	Value
Publication number	US-2018032905-A1
Application number	US-201615224409-A
Country	US
Kind code	A1
Filing date	Jul 29, 2016
Priority date	Jul 29, 2016
Publication date	Feb 1, 2018
Grant date	—

Abstract

In one aspect, a machine learning system for performing anomaly grouping is disclosed. The machine learning system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive stack traces associated with corresponding anomaly events; automatically generate initial rules for grouping the anomaly events responsive to the received stack traces; apply the generated initial rules to the anomaly events; receive additional stack traces, user input, or both; update the initial rules based on the received additional stack traces, user input, or both; organize the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules; and provide a user interface to display the one or more groups of anomaly events.

First claim

What is claimed is:

1 . A machine learning system for performing anomaly grouping, the machine learning system including:
a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including:
receive stack traces associated with corresponding anomaly events;
automatically generate initial rules for grouping the anomaly events responsive to the received stack traces;
apply the generated initial rules to the anomaly events;
receive additional stack traces, user input, or both;
update the initial rules based on the received additional stack traces, user input, or both;
organize the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules;
and
provide a user interface to display the one or more groups of anomaly events.

2 . The system of claim 1 , wherein the one or more modules are executable by a processor to generate the initial rules including apply weights to properties of the received stack traces.

3 . The system of claim 1 , wherein the one or more modules are executable by a processor to update the initial rules including adjust the weights of the properties of the received stack traces based on the user input.

4 . The system of claim 1 , wherein the one or more modules are executable by a processor to update the initial rules including adjust the weights of the properties of the received stack traces based on the new stack traces.

5 . The system of claim 4 , wherein the one or more modules are executable by a processor to identify new properties based on the new stack traces and apply weights to the new properties.

6 . The system of claim 1 , wherein the one or more modules are executable by a processor to enable users to share the generated initial rules or adjusted rules with each other.

7 . The system of claim 6 , wherein the one or more modules are executable by a processor to update the initial rules including adjust the weights of the properties of the received stack traces based on the shared rules or adjusted rules.

8 . A method for performing machine learned anomaly grouping, the method including:
receiving stack traces associated with corresponding anomaly events; automatically generating initial rules for grouping the anomaly events responsive to the received stack traces; applying the generated initial rules to the anomaly events; receiving additional stack traces, user input, or both; updating the initial rules based on the received additional stack traces, user input, or both; organizing the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules; and providing a user interface to display the one or more groups of anomaly events.

9 . The method of claim 8 , wherein generating the initial rules include applying weights to properties of the received stack traces.

10 . The method of claim 8 , wherein updating the initial rules include adjusting the weights of the properties of the received stack traces based on the user input.

11 . The method of claim 8 , wherein updating the initial rules include adjusting the weights of the properties of the received stack traces based on the new stack traces.

12 . The method of claim 11 , including identifying new properties based on the new stack traces and apply weights to the new properties.

13 . The method of claim 8 , including enabling users to share the generated initial rules or adjusted rules with each other.

14 . The method of claim 13 , wherein updating the initial rules include adjusting the weights of the properties of the received stack traces based on the shared rules or adjusted rules.

15 . A non-transitory computer readable medium embodying instructions when executed by a processor to cause operations to be performed including:
receiving stack traces associated with corresponding anomaly events; automatically generating initial rules for grouping the anomaly events responsive to the received stack traces; applying the generated initial rules to the anomaly events; receiving additional stack traces, user input, or both; updating the initial rules based on the received additional stack traces, user input, or both; organizing the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules; and providing a user interface to display the one or more groups of anomaly events.

16 . The non-transitory computer readable medium of claim 15 , wherein the operations for generating the initial rules include applying weights to properties of the received stack traces.

17 . The non-transitory computer readable medium of claim 15 , wherein the operations for updating the initial rules include adjusting the weights of the properties of the received stack traces based on the user input.

18 . The non-transitory computer readable medium of claim 17 , wherein the operations for updating the initial rules include adjusting the weights of the properties of the received stack traces based on the new stack traces.

19 . The non-transitory computer readable medium of claim 18 , wherein the operations include identifying new properties based on the new stack traces and apply weights to the new properties.

20 . The non-transitory computer readable medium of claim 15 , wherein the operations include enabling users to share the generated initial rules or adjusted rules with each other.

Assignees

• Appdynamics Llc

Inventors

• Abercrombie Nathan

Classifications

• G06F2201/81

  Threshold · CPC title

• G06F11/3409

  for performance assessment · CPC title

• G06F11/323

  Visualisation of programs or trace data · CPC title

• G06F2201/87

  Monitoring of transactions · CPC title

• G06F11/302

  where the computing system component is a software system · CPC title