Method and apparatus for historical analysis analytics

Patent metadata

Field	Value
Publication number	US-9336259-B1
Application number	US-201313962497-A
Country	US
Kind code	B1
Filing date	Aug 8, 2013
Priority date	Aug 8, 2013
Publication date	May 10, 2016
Grant date	May 10, 2016

Abstract

A computer-implemented method is disclosed in which multiple disparate data sources having a different schemas are gathered, and relationships between the data sources are determined. A blended data set is created from the multiple data sources based on the determined relationships. A current behavior of a computing system is determined, with the current behavior being indicative of an anomaly. From the blended data set, historical behaviors of the same computing system or a similar computing system are determined. The current behavior is correlated to the historical behaviors to obtain a correlation, and a response to the anomaly is determined based on the correlation. A complementary computing device and computer program product are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method comprising:
gathering data from multiple disparate data sources that have different schemas;
determining relationships between the data gathered from the multiple data sources;
creating a blended data set from the data gathered from the multiple data sources based on the determined relationships;
determining a current behavior of a computing system, the current behavior being indicative of an anomaly, said determining a current behavior comprising determining that performance data for the computing system which relates to performance of a plurality of computer-implemented transactions does not conform with a performance profile for the computing system;
determining, from the blended data set, historical behaviors of the same computing system or a similar computing system;
correlating the current behavior to the historical behaviors to obtain a correlation; and
determining, based on the correlation, a response to the anomaly and a confidence indicator indicating an estimated likelihood that the response to the anomaly will resolve the anomaly, wherein the response comprises one of:
a recommendation to rollback a detected change to a component of the computing system that has been altered during an observation period during which the computing system was configured to implement the transactions;
a recommendation to implement a new change to a component of the computing system; and
a recommendation that no components of the computing system need to be changed; and

presenting the response along with its determined confidence indicator to a user.

2. The computer-implemented method of claim 1 , wherein gathering data from multiple data sources having different schemas comprises:
receiving the data from a plurality of gatherers, each gatherer being in communication with one or more of the data sources.

3. The computer-implemented method of claim 1 , wherein determining a current behavior of the computing system that is indicative of an anomaly further comprises:
determining components included in the computing system; and
determining if a configuration of any of the components of the computing system has changed over an observation period during which the computing system was configured to implement the transactions.

4. The computer-implemented method of claim 3 , wherein if the configuration of any of the components is determined to have been changed over the observation period the method further comprises:
determining if the changes were intentional; and
determining who made the changes.

5. The computer-implemented method of claim 1 , wherein the recommendation that no components of the computing system need to be changed is only determined as the response if the occurrence of the performance data not conforming with the performance profile is determined to be permissible based on the data in one or more of the data sources.

6. A computing device comprising:
an interface circuit configured to receive data from a plurality of gatherers, each gatherer being in communication with one or more of a plurality of data sources, wherein the data sources are disparate and have different schemas; and
a controller circuit configured to:
gather the data received from the plurality of data sources;
determine relationships between the data sources;
create a blended data set from the multiple data sources based on the determined relationships;
determine that a current behavior of a computing system is indicative of an anomaly by determining that performance data for the computing system which relates to performance of a plurality of computer-implemented transactions does not conform with a performance profile for the computing system;
determine, from the blended data set, historical behaviors of the same computing system or a similar computing system;
correlate the current behavior to the historical behaviors to obtain a correlation; and
determine, based on the correlation, a response to the anomaly and a confidence indicator that represents an estimated likelihood that the response to the anomaly will resolve the anomaly, wherein the controller circuit is configured to determine the response as comprising one of:
a recommendation to rollback a detected change to a component of the computing system that has been altered during an observation period during which the computing system was configured to implement the transactions;
a recommendation to implement a new change to a component of the computing system; and
a recommendation that no components of the computing system need to be changed; and

present the response along with its associated confidence indicator to a user.

7. The computing device of claim 6 , wherein to determine a current behavior of the computing system that is indicative of an anomaly, the controller circuit is configured to:
determine components included in the computing system; and
determine if a configuration of any of the components of the computing system has changed over an observation period during which the computing system was configured to implement the transactions.

8. The computing device of claim 7 , wherein the controller circuit is configured to, if the configuration of any of the components is determined to have been changed over the observation period:
determine if the changes were intentional; and
determine who made the changes.

9. The computing device of claim 6 , wherein the recommendation that no components of the computing system need to be changed is only determined as the response if the occurrence of the performance data not conforming with the performance profile is determined to be permissible based on data in one or more of the data sources.

10. A computer program product comprising:
a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
computer readable program code configured to gather data from multiple disparate data sources that have different schemas;
computer readable program code configured to determine relationships between the data sources;
computer readable program code configured to create a blended data set from the multiple data sources based on the determined relationships;
computer readable program code configured to determine that a current behavior of a computing system is indicative of an anomaly by determining that performance data for the computing system relating to performance of a plurality of computer-implemented transactions does not conform with a performance profile for the computing system;
computer readable program code configured to determine, from the blended data set, historical behaviors of the same computing system or a similar computing system;
computer readable program code configured to correlate the current behavior to the historical behaviors to obtain a correlation; and
computer readable program code configured to determine, based on the correlation, a response to the anomaly and a confidence indicator indicating an estimated likelihood that the response to the anomaly will resolve the anomaly, wherein the response comprises one of:
a recommendation to rollback a detected change to a component of the computing system that has been altered during an observation period during which the computing system was configured to implement the transactions;
a recommendation to implement a new change to a component of the computing system; and
a recommendation that no components of the computing system need to be changed; and

computer readable program code configured to present the response along with its associated confidence indicator to a user.

Assignees

• Ca Inc

Inventors

• Kane John P

Classifications

• G06F11/0706

  the processing taking place on a specific hardware platform or in a specific software environment · CPC title

• G06F11/0793 Primary

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F11/1471

  involving logging of persistent data for recovery · CPC title

• G06F16/256

  in federated or virtual databases · CPC title