Hewlett-Packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Entit Software LLC

Anodot Ltd.

Micro Focus Lcc

Ira Cohen

Eli Mordechai

Ohad Assulin

Moises Goldszmidt

Eran Samuni

Ruth Bernstein

Michal Aharon

Terence Patrick Kelly

Julie Anna Symons

Olga Kogan-Katz

Yoni Yom Tov Ben Simhon

Ruth Bergman

Mehmet Kivanc Ozonat

Yonatan Ben Simhon

David Drai

Marina Lyan

Gilad Barash

Inbar Yogev

Lior Ben Ze'ev

Chengdu Huang

Doron Shaked

Kave Eshghi

Sharad Singhal

Carl Staelin

Xiaoyun Zhu

Kimberly Keeton

Dirk Manfred Beyer

Zhikui Wang

Xue Liu

Sujoy Basu

Eric T Anderson

Omer Barkol

William Robert Powers, Iii

Janet Lynn Wiener

Rotem Steuer

Shyam Sundar Rajaram

John M Green

Magnus Karlsson

Yair Horovitz

Shahar Golan

Alexandre Bronstein

Boaz Shor

Avi Kabizon

Kobi Eisenberg

Anish Pulikottil Joseph

Tomer Priel

Meir Toledano

Gerald T Wade

Steve Y Zhang

Roy Wallerstein

Chen Kahana

Ori Adijes

Blaine Nelson

Alon Sade

Gal Noy

Inbal Tadeski

Tsahi Flysher

Anat Levinger

Sergey Persikov

Barak Yeshoua

Rudy Medarov

Atali Levi

Erez Yaakov

Charlie Dagli

Keren Gattegno

Liat Ashkenazi

Avishai Krepel

Refael Dakar

Michael Rozman

Marsha Prescott Duro

En C Lee

A method for generating samples for an anomaly detection system includes receiving events that occurred during a time series of a target metric. Each respective event includes an event attribute characterizing the respective event. The method includes generating a set of event groups for the events. Each event shares a respective attribute with one or more other events of the respective event group. For each respective event group of the set of event groups, the method includes determining an influence pattern that identifies an influence of the respective event group on the target metric. The method includes clustering the set of event groups into event clusters based on a respective influence pattern of each respective event group. Each event cluster includes one or more event groups that share a similar influence pattern. The method includes generating training samples for an anomaly detection system based on a respective event cluster.

Event-based machine learning for a time-series metric

A system includes a normal behavior characterization module configured to receive values for a first metric of a plurality of metrics and generate a baseline profile indicating normal behavior of the first metric based on the received values. The system also includes an anomaly identification module configured to identify an anomaly in response to present values of the metric deviating outside the baseline profile. The system also includes an anomaly behavior characterization module configured to analyze a plurality of prior anomalies identified by the anomaly identification module and develop a model of the anomalies of the first metric. The system also includes an anomaly scoring module configured to determine a first score for a present anomaly detected by the anomaly identification module for the first metric. The first score is based on characteristics of the present anomaly and the model of the anomalies of the first metric.

System and method for transforming observed metrics into detected and scored anomalies

A system includes a windowing module that divides time series data for each metric into portions. Each portion corresponds to a respective window of time. A hash module calculates a hash value for each of the portions for each of the metrics. An identification module compares the hash values for each pair of metrics and, for a selected pair of metrics, counts how many windows of time in which the hash values of the selected pair of metrics are equal. A pair is identified as a candidate pair in response to the count exceeding a threshold. A metric graph module creates a first edge in a graph based on the candidate pair of metrics. Each of the metrics is a node in the graph and direct relationships between each pair of the metrics are edges in the graph. An anomaly combination module analyzes an anomaly condition based on the graph.

Creation of metric relationship graph based on windowed time series data for anomaly detection

End user data partitioning can include receiving a number of data queries for a data source from a user, developing a dimension relation graph based on attributes of the number of data queries, and partitioning the data source based on the dimension relation graph.

Data partioning based on end user behavior

Methods performed by a physical computing system include automatically identifying, using at least one trained classifier, an action for responding to an anomaly in the execution of the application in a cloud computing system. The at least one trained classifier relates a metrics set to a result of performing an action for addressing an anomaly. Systems and computer readable media are also described herein.

Methods and systems for identifying action for responding to anomaly in cloud computing system

Method and systems for analyzing event log elements are provided. In one example, a method includes receiving an event log element in a computer. A similarity index is calculated between the event log element and a text element. A threshold of similarity is calculated. The similarity index is compared to the threshold. If the similarity index is greater than the threshold, the event log element is grouped into a cluster with the text element to create a file of cluster assignments.

Event log analysis

Methods and systems of aligning annotation of fields of documents are provided. Training information that includes first measurement information pertaining to features of each of a plurality of fields associated with training clusters for documents of a document type is accessed. A first training cluster is annotated with a first name and the second training cluster is annotated with a second name. An electronic classification model is generated based on the training information. Second measurement information for features of fields associated with new clusters of a new document is accessed. Each of the new clusters is automatically annotated based on the second measurement information using the classification model. For example, a first new cluster that has fields of the first field type is annotated with the first name and a second new cluster that has fields of the second field type is annotated with the second name.

Aligning annotation of fields of documents

Systems, methods, and machine-readable and executable instructions are provided for error developer association. Error developer association can include identifying a number of portions of the source code associated with a message, wherein the message is associated with an error. Error developer association can also include associating a developer with a portion of the source code of the number of portions of the source code. Error developer association can also include identifying a developer of the number of developers to resolve the error.

Error developer association

In one example of the disclosure, event notices are received, with each notice indicative of degradation of a configuration item. Configuration item past-preference pairings are accessed. Each pairing includes a count of operator-exhibited preferences for event notices associated with a first configuration item relative to event notices associated with a second configuration item. A prioritized ordering of the received event notices is created utilizing the past-preference pairings.

Prioritizing event notices utilizing past-preference pairings

In one example of the disclosure, data indicative of a word or phrase communicated during a meeting including a plurality of participants is obtained. For each participant, records electronically accessible to the participant are identified, and each record is associated with a tier from a hierarchy of record-relevancy tiers. A set of explanations for the communication and associated scores is identified, including for each participant, beginning with a most relevant tier, searching the records accessible to the participant tier by tier until an explanation is identified, and assigning a score to the explanation according to the tier associated with the record in which the explanation is found. A preferred explanation for the communication is determined based upon the scores, and a display of the preferred explanation is caused.

Determining preferred communication explanations using record-relevancy tiers

Examples disclosed herein relate to generating a fingerprint representing a response of an application to a simulation of a fault of an external service. Examples include causing simulation of a fault of an external service in a simulation of the external service, and generating a testing application fingerprint representing a response of an application to the simulation of the fault of the external service during the testing of the application.

Generating a fingerprint representing a response of an application to a simulation of a fault of an external service

Determining suspected root causes of anomalous network behavior includes identifying anomalous components in a network exhibiting anomalous behavior from a plurality of network components, assigning a likelihood score to network components based on a scoring policy that considers recent change events affecting the anomalous components, and identifying a subset of the network components that are suspected to be root causes based on the likelihood score.

Determining suspected root causes of anomalous network behavior

Disclosed herein are a system, non-transitory computer-readable medium, and method for responding to natural language queries. Keywords likely to appear in a natural language query are determined and each likely keyword is associated with a module. A response to a natural language query comprises information generated by each module associated with a likely keyword appearing in the natural language query.

Responding to natural language queries

Growing community of inventors

Modiin, Israel

Ira Cohen