Oracle America, Inc.

Oracle International Corporation

Sun Microsystems, Inc.

Aleksey M Urmanov

Kenny C Gross

Anton A Bougaev

David K McElfresh

Kalyanaraman Vaidyanathan

Alan Paul Wood

Keith A Whisnant

Kenneth Clayton Gross

Ramakrishna C Dhanekula

Steven F Zwinger

Andrew J Lewis

Jonathan D Klein

John J Cooley

Yuri Langer

George Popescu

Dustin R Garvey

Lik Wong

Ayse K Coskun

Guang Chao Wang

Sampanna Shahaji Salunke

Stephen Ho

Steven K Heller

Dan Vacar

Matthew T Gerdes

Sajjit Thampy

Leoncio D Lopez

Edwina Lu

Douglas B Meyer

Lawrence G Votta

Charles E Kinney

Ronald J Melanson

James Britton

Steve Lin

Lawrence G Votta, Jr

Shreya Singh

Darrell D Donaldson

Filiz Gurtuna

Kornelija Zgonc

Su-Jaen Huang

Stanley P Haag

Daivd K McElfresh

Alexander V Usynin

During operation, the system uses N sensors to sample an electromagnetic interference (EMI) signal emitted by a target asset while the target asset is running a periodic workload, wherein each of the N sensors has a sensor sampling frequency f, and wherein the N sensors perform sampling operations in a round-robin ordering with phase offsets between successive samples. During the sampling operations, the system performs phase adjustments among the N sensors to maximize phase offsets between successive sensors in the round-robin ordering. Next, the system combines samples obtained through the N sensors to produce a target EMI signal having an EMI signal sampling frequency F=f&#xd7;N. The system then generates a target EMI fingerprint from the target EMI signal. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target asset to determine whether the target asset contains any unwanted electronic components.

Combining signals from multiple sensors to facilitate EMI fingerprint characterization of electronic systems

The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Estimating the remaining useful life for cooling fans based on a wear-out index analysis

During operation, the system obtains a training dataset during a training mode, wherein the training dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the training dataset to produce corresponding per-action datasets. The system then cleanses the training dataset based on counts of actions in the per-action datasets to produce a cleansed training dataset, and uses the cleansed training dataset to produce corresponding per-user datasets. Next, the system trains per-user models based on the per-user datasets to detect anomalous actions of users. The system then obtains a surveillance dataset during a surveillance mode, wherein the surveillance dataset includes counts of actions performed by users while operating applications in the computer system. Next, the system uses the trained per-user models to detect anomalous actions in the surveillance dataset. Finally, when an anomalous action is detected, the system triggers an alert.

Detecting anomalies in software service usage activity

Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Multi-distance similarity analysis with tri-point arbitration

The system obtains a multimodal dataset containing different types of data gathered during operation of the computer system, wherein the multimodal dataset includes time-series data for different variables associated with operation of the computer system. Next, the system forms a set of feature groups from the multimodal dataset, wherein each feature group comprises variables from the multimodal dataset containing the same type of data. The system then computes a tripoint similarity matrix for each feature group, and aggregates the tripoint similarity matrices for the feature groups to produce a crossmodal tripoint similarity matrix. Next, the system uses the crossmodal tripoint similarity matrix to cluster the multimodal dataset to form a model. The system then performs prognostic-surveillance operations on real-time multimodal data received from the computer system, wherein the prognostic-surveillance operations use the model as a classifier to detect anomalies. When an anomaly is detected, the system triggers an alert.

Detecting anomalies during operation of a computer system based on multimodal data

Systems, methods, and other embodiments associated with anomaly detection using tripoint arbitration are described. In one embodiment, a method includes identifying a set of clusters that correspond to a nominal sample of data points in a sample space. A point z is determined to be an anomaly with respect to the nominal sample when, for each cluster, a tripoint arbitration similarity between data points in the cluster calculated with z as arbiter is greater than a threshold.

Anomaly detection using tripoint arbitration

Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Multi-distance clustering

The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.

System and method for protecting online resources against guided username guessing attacks

After sensors are placed at three or more non-collinear locations on a surface of the component, the system receives time-series signals from the sensors while the component operates on a representative workload. The system then defines one or more triangles on the surface of the component, wherein each triangle is defined by three vertices, which coincide with different sensor locations on the surface of the component. For each triangle, the system applies a barycentric coordinate technique (BCT) to time-series signals received from sensors located at the vertices of the triangle to determine a candidate location within the triangle to place an additional sensor. The system then compares the candidate locations for each of the one or more triangles to determine a globally optimal location for the additional sensor, and a new sensor is placed at this location. This process is repeated until a desired number of sensors are placed.

Using the barycentric coordinate technique to determine optimal sensor locations

The disclosed embodiments provide a system that detects an anomaly in a computer system based on log messages. During operation, the system receives log messages generated by the computer system during operation of the computer system. Next, the system maps each received log message to a cluster in a set of clusters of log messages, wherein each cluster is associated with a specific event. The system then forms events for consecutive log messages into sequences of events. Finally, the system performs anomaly detection based on the sequences of events, wherein if an anomaly is detected, the system triggers an alert.

Anomaly detection based on events composed through unsupervised clustering of log messages

The disclosed embodiments relate to a system that reduces bandwidth requirements for transmitting telemetry data from sensors in a computer system. During operation, the system obtains a cross-imputability value for each sensor in a set of sensors that are monitoring the computer system, wherein a cross-imputability value for a sensor indicates how well a sensor value obtained from the sensor can be predicted based on sensor values obtained from other sensors in the set. Next, the system clusters sensors in the set of sensors into two or more groups based on the determined cross-imputability values. Then, while transmitting sensor values from the set of sensors, for a group of sensors having cross-imputability values exceeding a threshold, the system selectively transmits sensor values from some but not all of the sensors in the group to reduce a number of sensor values transmitted.

Reducing bandwidth requirements for telemetry data using a cross-imputability analysis technique

The disclosed embodiments relate to a system that characterizes I/O performance of a computing device in terms of energy consumption across a range of vibrational operating environments. During operation, the system executes a test script on a computing device that is affixed to a programmable vibration table, wherein the test script causes the computing device to perform a predetermined I/O workload. While the test script is executing, the system controls the programmable vibration table to subject the computing device to different vibrational operating environments. At the same time, the system obtains test results by monitoring a progress of the test script and an associated power consumption of the computing device. Finally, the system uses the obtained test results to characterize the I/O performance of the computing device in terms of energy consumption across the range of vibrational operating environments.

Characterizing the I/O-performance-per-watt of a computing device across a range of vibrational operating environments

Systems, methods, and other embodiments are disclosed for data-driven user authentication misuse detection. In one embodiment, for a user authentication attempt to access a secure computer resource, user authentication log data having user attribute values is collected. The user authentication log data is transformed into a tracer data structure. The tracer data structure is augmented with timestamp data to generate an event data structure. It is determined whether the tracer data structure matches an existing tracer data structure stored in a rules database and, if not, a novelty flag is set to generate a new user behavior model filter. If the tracer data structure matches the existing tracer data structure: an existing user behavior model filter is applied, issuance of an alarm message or signal is controlled, and the existing user behavior model filter is updated based, at least in part, on the event data structure.

System and method for providing data-driven user authentication misuse detection

Systems, methods, and other embodiments are disclosed for data-driven user authentication misuse detection. In one embodiment, for each of multiple authentication attempts to a computing device by a user via user authentication log messages: user authentication log data having user attribute values is collected; the user authentication log data is transformed into a tracer data structure having the user attribute values organized in a common format; the tracer data structure is augmented with timestamp data to generate an event data structure, where the timestamp data represents a time at which the user authentication log data is observed by the computing device; a user behavior model filter, representing account usage patterns of the user, is updated based at least in part on the event data structure. A malicious authentication attempt to the computing device by a malicious user is detected based on, at least in part, the user behavior model filter.

System and method providing data-driven user authentication misuse detection

Growing community of inventors

San Diego, CA, United States of America

Aleksey M Urmanov