Visualization of behavior clustering of computer applications

Patent metadata

Field	Value
Publication number	US-9870294-B2
Application number	US-201514596151-A
Country	US
Kind code	B2
Filing date	Jan 13, 2015
Priority date	Jan 23, 2014
Publication date	Jan 16, 2018
Grant date	Jan 16, 2018

Abstract

Dimensionality reduction, such as principal component analysis, may be performed against a time series of performance observations for a computer application. A visual representation of the results may be displayed in one, two, or three dimensions, and often show clusters of operational behavior. The representation may be animated to show a sequence of observations and how the behavior of an application may change from one cluster of operation to another. The representation may be further applied to show both a historical view of the observations and new observations. The time series may contain performance and operational data, as well as metadata observed from a computer application.

First claim

What is claimed is:

1. A method performed at a computer system comprising one or more processors, for displaying one or more dimensionally transformed datasets, the method comprising:
generating, at the computer system, a dimensionality reduction transformation function representing a first time series, including at least:
receiving, at the computer system, the first time series collected from tracing a computer application at a first time, the first time series comprising performance data for a plurality of functions of the computer application observed while tracing the computer application at the first time;
processing, at the computer system, the first time series data into one or more time series vectors; and
creating, at the computer system, a dimensionality reduction transformation function by identifying one or more principal components within the one or more time series vectors;

receiving, at the computer system, a second time series collected from tracing the computer application at a second time;
applying, at the computer system, the dimensionality reduction transformation function to the first time series and the second time series to generate a transformed dataset comprising at least the identified principal components of the first time series and the second time series; and
causing the transformed dataset to be displayed at a display of the computer system.

2. The method of claim 1 , the performance observations comprising resource utilization for each of the plurality of functions.

3. The method of claim 2 , the resource utilization being at least one of a group composed of:
memory utilization;
processor utilization; and
network utilization.

4. The method of claim 1 , the transformed dataset being displayed in two dimensions.

5. The method of claim 1 , the transformed dataset being displayed in three dimensions.

6. The method of claim 1 , the transformed dataset being displayed using animation showing a sequence of the observations in the transformed dataset.

7. The method of claim 6 , the transformed dataset being displayed at least within a timeframe sufficient for an event prediction to occur prior to the occurrence of the predicted event.

8. The method of claim 1 , at least some of the functions being part of a library of functions.

9. The method of claim 1 further comprising:
receiving a predicted observation, the predicted observation being predicted based on the second time series;
applying the dimensionality reduction transformation to generate a transformed predicated observation; and
causing the transformed predicted observation to be displayed.

10. A system comprising:
at least one computer processor;
a dimensionality reduction analyzer, executing on the at least one computer processor, that is configured to:
generate a dimensionality reduction transformation function representing a first time series, including at least:
receiving the first time series collected from tracing a computer application at a first time, the first time series comprising performance data for a plurality of functions of the computer application at the first time;
processing the first time series data into one or more time series vectors; and
creating a dimensionality reduction transformation function by identifying one or more principal components within the one or more time series vectors; and

a display engine that:
receives a second time series collected from tracing the computer application at a second time;
applies the dimensionality reduction transformation function to the first time series and the second time series to generate a transformed dataset comprising at least the identified principal components of the first time series and the second time series; and
causes the transformed dataset to be displayed at a display of the computer system.

11. The system of claim 10 , the performance observations comprising resource utilization for each of the plurality of functions.

12. The system of claim 11 , the resource utilization being at least one of a group composed of:
memory utilization;
processor utilization; and
network utilization.

13. The system of claim 10 , the transformed dataset being displayed in two dimensions.

14. The system of claim 10 , the transformed dataset being displayed in three dimensions.

15. The system of claim 10 , the transformed dataset being displayed using animation showing a sequence of the observations in the transformed dataset.

16. The system of claim 15 , the transformed dataset being displayed at least within a timeframe sufficient for an event prediction to occur prior to the occurrence of the predicted event.

17. The system of claim 10 , at least some of the functions being part of a library of functions.

18. The method of claim 1 , wherein the one or more principal components are chosen from observations of the computer application's performance comprising:
individual application functions, application programming interface calls, library components, network calls, memory operations, processing time, memory latency, memory consumption, and peripheral operations.

19. The method of claim 1 , wherein the one or more principal components comprises one or more selection from either of a first group of observations comprising individual application functions, application programming interface calls, library components, network calls, and memory operations,
or from a second group of observations comprising processing time, memory latency, memory consumption, and peripheral operations.

20. The method of claim 19 , wherein the one or more principal components comprises at least one selection from each of the first group of observations and the second group of observations.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Seto Tetsuo

Classifications

• G06F11/3452

  Performance evaluation by statistical analysis · CPC title

• G06F11/323 Primary

  Visualisation of programs or trace data · CPC title

• G06F2201/86

  Event-based monitoring · CPC title

• G06F11/3409

  for performance assessment · CPC title

• G06F11/3466

  Performance evaluation by tracing or monitoring · CPC title