Behavior clustering analysis and alerting system for computer applications

Patent metadata

Field	Value
Publication number	US-9921937-B2
Application number	US-201514596159-A
Country	US
Kind code	B2
Filing date	Jan 13, 2015
Priority date	Jan 23, 2014
Publication date	Mar 20, 2018
Grant date	Mar 20, 2018

Abstract

Dimensionality reduction, such as principal component analysis, may be used at least in part to generate a model of time series observations of a computer application. The model may be applied to current and predicted observations. Outliers may be identified from current or predicted observations by analyzing those observations against the model, and statistically relevant outliers may generate alerts or corrective or other action to be taken. The outliers may be analyzed by searching for similar outliers that may have been previously observed, and predicting any future events based on similar observations of the past.

First claim

What is claimed is:

1. A method performed on at least one computer processor, said method comprising:
generating a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application;
applying said dimensionality reduction transformation to a previously observed time series to generate transformed historical data;
receiving a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset;
comparing said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset; and
generating an alert based on said anomalous observation, said alert triggering said at least one computer processor to cause a corrective action to be taken to correct said anomalous observation.

2. The method of claim 1 further comprising:
performing a cluster analysis on said transformed historical data to generate cluster definitions within said transformed historical data.

3. The method of claim 2 , said comparing said transformed current time series dataset comprising determining that a first observation in said transformed current time series dataset is an outlier with respect to said cluster definitions.

4. The method of claim 1 further comprising:
determining a predicted time series observation;
generating a predicted transformed observation by applying said dimensionality reduction transformation to said predicted time series observation; and
comparing said predicted transformed observation to said transformed historical data to identify a predicted outlier.

5. The method of claim 4 , wherein said alert comprises a first alert, the method further comprising generating a second alert based on said predicted transformed observation, said second alert triggering said at least one computer processor to cause a corrective action to be taken prior to occurrence of said predicted outlier.

6. The method of claim 4 , said predicted time series observation being made by analyzing time series having at least one similar time series segment.

7. A system comprising:
a processor;
a memory; and
an analyzer operating on said processor and said memory, said analyzer that:
receives a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application;
applies said dimensionality reduction transformation to a previously observed time series to generate transformed historical data;
receives a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset;
compares said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset; and
generates an alert based on said anomalous observation, said alert triggering said system to cause a corrective action to be taken to correct said anomalous observation.

8. The system of claim 7 , said analyzer that further:
receives cluster definitions within said transformed historical data.

9. The system of claim 8 , said analyzer that further:
determines that said transformed current time series dataset comprising determining that a first observation in said transformed current time series dataset is an outlier with respect to said cluster definitions.

10. The system of claim 7 , said analysis engine that further:
determines a predicted time series observation;
generates a predicted transformed observation by applying said dimensionality reduction transformation to said predicted time series observation; and
compares said predicted transformed observation to said transformed historical data to identify a predicted outlier.

11. The system of claim 10 , wherein said alert comprises a first alert, said analysis engine that further generates a second alert based on said predicted transformed observation, said second alert triggering said system to cause a corrective action to be taken prior to occurrence of said predicted outlier.

12. The system of claim 10 , said predicted time series observation being made by analyzing time series having at least one similar time series segment.

13. One or more hardware storage devices having stored thereon instructions that are executable by at least one processor to perform at least the following:
receive a dimensionality reduction transformation representing a first time series collected from tracing a computer application, said first time series comprising performance data for a plurality of functions at each observation of said first time series, each of said plurality of functions being part of said computer application;
apply said dimensionality reduction transformation to a previously observed time series to generate transformed historical data;
receive a current time series dataset and applying said dimensionality reduction transformation to generate a transformed current time series dataset;
compare said transformed current time series dataset to said transformed historical data to identify an anomalous observation from said transformed current time series dataset; and
generate an alert based on said anomalous observation, said alert triggering said at least one processor to cause a corrective action to be taken to correct said anomalous observation.

14. The one or more hardware storage devices of claim 13 , the instructions also executable by said at least one processor to receive cluster definitions within said transformed historical data.

15. The one or more hardware storage devices of claim 14 , the instructions also executable by said at least one processor to determine that said transformed current time series dataset comprising determining that a first observation in said transformed current time series dataset is an outlier with respect to said cluster definitions.

16. The one or more hardware storage devices of claim 13 , the instructions also executable by said at least one processor to:
determine a predicted time series observation;
generate a predicted transformed observation by applying said dimensionality reduction transformation to said predicted time series observation; and
compare said predicted transformed observation to said transformed historical data to identify a predicted outlier.

17. The one or more hardware storage devices of claim 16 , wherein said alert comprises a first alert, the instructions also executable by said at least one processor to generate a second alert based on said predicted transformed observation, said second alert triggering said at least one processor to cause a corrective action to be taken prior to occurrence of said predicted outlier.

18. The one or more hardware storage devices of claim 16 , said predicted time series observation being made by analyzing time series having at least one similar time series segment.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Seto Tetsuo

Classifications

• G06F11/008

  Reliability or availability analysis · CPC title

• G06F11/3452 Primary

  Performance evaluation by statistical analysis · CPC title