International Business Machines Corporation

Bruno Wassermann

Nir Rozenbaum

David Ohana

Artem Barger

Vita Bortnikov

Idan Zach

Guy Laden

Alexey Roytman

Gennady Laventman

Michal Malka

Embodiments may include techniques for hierarchical evaluation of the anomaly level of a system and its sub-components using domain knowledge, so as to provide improved accuracy and explainability compared to conventional methods. For example a method of anomaly detection in a hierarchical computer network may comprise defining a tree-like topological structure which describes how the hierarchical computer network comprises sub-components, wherein each node of the tree-like topological structure represents a sub-component of the hierarchical computer network, and wherein at least some of the sub-components are monitored to generate signals indicating an operational condition of each sub-component, collecting a plurality of time-series of maximum absolute anomaly scores for each monitored signal, and computing an anomaly score for a root node of the tree-like topological structure.

Hierarchical evaluation of multivariate anomaly level

Managing cooperative computer software applications by applying a link analysis algorithm to a data set including identifiers representing a plurality of computer software applications and including indicators of operational relationships between the computer software applications, thereby associating a cooperation value with each of the computer software applications represented within the data set, and notifying a computer software application manager of the computer software applications and their associated cooperation values.

Managing cooperative computer software applications

There is provided a system for identifying a system level anomalous, comprising code for receiving data-points indicative of a time-based dynamic state of processing nodes of a distributed system, each associated with a timestamp, a metric, and a metric value, clustering the data-points into clusters, comprising a sub-set of the data-points having a same metric and a timestamp within a same metric anomaly time interval, computing metric anomaly scores for each respective cluster denoting likelihood of an anomaly being present, analyzing metric anomaly scores of each system level anomalous time interval including at least two of the metric anomaly time intervals, computing a single anomalous event score for each respective system level anomalous time interval according to the analysis, and generating an alert indicative of the system level anomalous event for a certain system level anomalous time interval when the single anomalous event score is according to an anomaly requirement.

Systems and methods for anomaly detection in a distributed computing system

Embodiments of the present systems and methods may provide the capability to reduce service unavailability, client disruption, network traffic and processing load due to state synchronization. For example, a computer-implemented method for controlling operation of a plurality of server computer systems may comprise determining an order in which the plurality of server computer systems is to be restarted and restarting each of the plurality of server computer systems sequentially according to the determined order, wherein a leader of the server computer systems receives and handles write requests for the plurality of server computer systems, and wherein the leader server computer system is restarted last.

Optimized rolling restart of stateful services to minimize disruption

Embodiments of the present invention provide a means for managing portable Internet Protocol (IP) addresses and virtual machine persistent storage. The invention includes defining a set of available portable IP addresses. When a request for a portable IP address is received from a first virtual machine (VM), a first portable IP address is assigned to the first VM. The assignment of the first portable IP address to the first VM extends for a predetermined amount of time and requires a lease renewal to extend the assignment.

Growing community of inventors

Raanana, Israel

Bruno Wassermann