System and method for performing root-cause analysis of anomalies in a shared data protection environment

Patent metadata

Field	Value
Publication number	US-2024348642-A1
Application number	US-202418635485-A
Country	US
Kind code	A1
Filing date	Apr 15, 2024
Priority date	Apr 15, 2023
Publication date	Oct 17, 2024
Grant date	—

Abstract

A system for performing root-cause analysis of cost and/or usage anomalies in a shared data protection environment is presented. The shared backup environment includes a backup/restore system configured to backup data in a storage server and/or restore data from the storage server. The system is configured to perform the root-cause analysis based on storage server data and backup/restore system telemetry data.

First claim

What is claimed is:

1 . A system for performing root-cause analysis of cost and/or usage anomalies in a shared data protection environment comprising a backup/restore system configured to backup data in a storage server and/or restore data from the storage server, the system comprising:
a memory configured to store one or more processor-executable routines; and a processor communicatively coupled to the memory, the processor configured to execute the one or more processor-executable routines to:
identify one or more anomalies by comparing predicted cost and/or usage values of one or more feature sets corresponding to the storage server with actual cost and/or usage values of the same one or more feature sets corresponding to the storage server;
identify one or more related feature sets in a backup/restore system telemetry data based on the identified one or more anomalies; and
correlate one or more clients to the identified one or more anomalies by comparing predicted cost and/or usage values of one or more related feature sets corresponding to the backup/restore system telemetry data with actual cost and/or usage values of the one or more related feature sets corresponding to the backup/restore system telemetry data.

2 . The system of claim 1 , wherein the processor is further configured to execute the one or more processor-executable routines to suggest one or more mitigation strategies to the one or more clients correlated to the identified one or more anomalies.

3 . The system of claim 1 , wherein the processor is further configured to execute the one or more processor-executable routines to:
access historical data comprising cost and/or usage data corresponding to the storage server; identify one or more feature sets from the historical data corresponding to the storage server; and estimate predicted cost and/or usage values for each feature set of the one or more feature sets corresponding to the storage server.

4 . The system of claim 3 , wherein the processor is configured to execute the one or more processor-executable routines to estimate the predicted cost and/or usage values for each feature set of one or more feature sets corresponding to the storage server based on one or more trained time forecasting models.

5 . The system of claim 1 , wherein the processor is further configured to execute the one or more processor-executable routines to estimate predicted usage values for each feature set of one or feature sets corresponding to the backup/restore system telemetry data.

6 . The system of claim 5 , wherein the processor is configured to execute the one or more processor-executable routines to estimate the predicted cost and/or usage values for each feature set of the one or more feature sets corresponding to the backup/restore system telemetry data based on one or more trained time forecasting models.

7 . The system of claim 1 , wherein the processor is configured to execute the one or more processor-executable routines to identify related feature sets based on one or more common attributes in the feature sets corresponding to the backup storage and the feature sets corresponding to the backup/restore system telemetry data.

8 . The system of claim 7 , wherein the one or more common attributes comprise time, cloud service, or cloud region.

9 . The system of claim 1 , wherein the system is configured to perform root-cause analysis for one or more cost anomaly use cases in the shared data protection environment.

10 . The system of claim 1 , wherein the system is configured to perform root-cause analysis for one or more data protection and ransomware detection use cases in the shared data protection environment.

11 . A method for performing root-cause analysis of cost and/or usage anomalies in a shared data protection environment comprising a backup/restore system configured to backup data in a storage server and/or restore data from the storage server, the method comprising:
identifying one or more anomalies by comparing predicted cost and/or usage values of one or more feature sets corresponding to the storage server with actual cost and/or usage values of the one or more feature sets corresponding to the storage server; identifying related feature sets in a backup/restore system telemetry data based on the identified one or more anomalies; and correlating one or more clients to the identified one or more anomalies by comparing predicted cost and/or usage values of the one or more related feature sets corresponding to the backup/restore system telemetry data with actual cost and/or usage values of the one or more related feature sets corresponding to the backup/restore system telemetry data.

12 . The method of claim 11 , wherein the method further comprises suggesting one or more mitigation strategies to the one or more clients correlated to the identified one or more anomalies.

13 . The method of claim 11 , wherein the method further comprises:
accessing historical data comprising cost and/or usage data corresponding to the storage server; identifying one or more feature sets from the historical data corresponding to the data storage; and estimating predicted cost and/or usage values for each feature set of one or more feature sets corresponding to the storage server.

14 . The method of claim 13 , wherein the method comprises estimating the predicted cost and/or usage values for each feature set of one or more feature sets corresponding to the storage server based on one or more trained time forecasting models.

15 . The method of claim 11 , wherein the method further comprises estimating the predicted cost and/or usage values for each feature set of one or more feature sets corresponding to the backup/restore system telemetry data.

16 . The method of claim 15 , wherein the method comprises estimating the predicted cost and/or usage values for each feature set of the one or more feature sets corresponding to the backup/restore system telemetry data based on one or more trained time forecasting models.

17 . The method of claim 11 , wherein the method further comprises identifying related feature sets in the backup/restore system telemetry data based on one or more common attributes in the feature sets corresponding to the storage server and the feature sets corresponding to the backup/restore system telemetry data.

18 . The method of claim 17 , wherein the one or more common attributes comprise time, cloud service, or cloud region.

19 . The method of claim 11 , wherein the method comprises performing root-cause analysis for one or more cost anomaly use cases in the shared data protection environment.

20 . The method of claim 11 , wherein the method comprises performing root-cause analysis for one or more data protection and ransomware detection use cases in the shared data protection environment.

Assignees

• Druva Inc

Inventors

• Kumar Prabal
• Srinivasan Preethi
• Punera Vinay

Classifications

• G06F11/1464

  for networked environments · CPC title

• G06F11/1469

  Backup restoration techniques · CPC title

• G06F11/1461

  Backup scheduling policy · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F2201/84

  Using snapshots, i.e. a logical point-in-time copy of the data · CPC title