Dell Products Inc.

International Business Machines Corporation

Piotr Przestrzelski

Eric Thiebaut-George

A method may include calculating a cryptographic hash for each of a plurality of data blocks stored on a storage resource, calculating a locality-preserving hash for each of the plurality of data blocks, and performing clustering based on the locality-preserving hashes. The method may also include, for each particular cluster setting a cluster center data block for the particular cluster and for each particular data block of the particular cluster, storing the particular data block as a cluster member data block including a reference to the cluster center data block for the particular cluster, a list of differences of the particular data block from the cluster member data block, the cryptographic hash for the particular data block to identify the particular data block, and the locality-preserving hash for the particular data block for manipulation of the particular data block.

Systems and methods for block-data clustering-based deduplication

A method for detecting an anomaly includes retrieving a log file that includes log entries, grouping the log entries into clusters of log entry types based on number of occurrences and average time interval, and discovering a sequence of the log entry types within each of the clusters. The sequence of the log entry types is based on a shortest path from a first one of the log entry types to a last one of the log entry types.

System and method for detecting anomalies by discovering sequences in log entries

A device operation anomaly identification and reporting system includes device that generates an operating metric data stream. A management system is coupled to the device and receives and analyzes the operating metric data stream. The management system identifies peaks present in the operating metric data stream, and determines a peak height and a peak area for each of the peaks. The management system then clusters the peaks into height clusters based on their heights, and clusters the peaks into area clusters based on their areas. The management system then defines an operating periodicity for the device based on the height clusters and area clusters, and when the management system detects an operating anomaly in the device using the operating periodicity defined for the device, it generates and transmits an operating anomaly alert that reports the operating anomaly in the device.

Device operation anomaly identification and reporting system

An apparatus for comparing event data sets. A system and computer program for comparing event data sets comprising: calculating one or more derivatives for each event in a first and second set of events; classifying each event by the calculated derivatives; and evaluating a similarity of the first and second sets of events based on the classifications of the respective events.

Comparing event data sets

A method and apparatus for comparing event data sets. A method, system and computer program for comparing event data sets comprising: calculating one or more derivatives for each event in a first and second set of events; classifying each event by the calculated derivatives; and evaluating a similarity of the first and second sets of events based on the classifications of the respective events.

Growing community of inventors

Cork, Ireland

Piotr Przestrzelski