Splunk Inc.

Cisco Technology, Inc.

Ryan Gannon

Xiao Lin

Zhaohui Wang

Chandrima Sarkar

Ram Sriharsha

Abhinav Mishra

A computerized method for detection of format drift and format anomalies is described. A format representation for each data point of a first data sample is extracted. Transformations of each format representation is conducted, resulting in a first plurality of count values (reference) and a second plurality of count values. Each count value identifies a number of occurrences of a transformed format representation within that data sample. Thereafter, a first probability distribution for the first plurality of count values and a second probability distribution for the second plurality of count values are computed. Analytics using the first and probability distributions are conducted to produce a first metric. A format drift is determined based on an evaluation of the first metric to a second metric operating as a threshold metric. Format anomalies are detected based on analytics of hashed format representation and determination of infrequent usage of a particular format representation.

System and method for format drift and format anomaly detection

A computerized method for detection of categorical drift within an incoming data stream. Herein, an error threshold is computed based on a first set of training data samples selected to detect categorical drift occurring for a data stream. Thereafter, probability distributions associated with content of a first and second data samples of the data stream are computed. Analytics are conducted to compute a difference between content of the first probability distribution that is based on a first data point of the first data sample and content of the second probability distribution that is based on a first data point of the second data sample. After computing the difference, that categorical drift is determined whether categorical drift detection has been conducted.

System and method for categorical drift detection

A computerized method is disclosed including operations of receiving a data stream, performing a changepoint detection resulting in a detection of changepoints in the data stream including: maintaining a listing of starting indices for each run within the data stream in a buffer of size L wherein each index of the listing has a run length probability representing a likelihood of being a changepoint, receiving a new data point within the data stream and adding a new index to the buffer resulting in the buffer having size L+1, calculating a posterior run length probability that the new data point is a changepoint, and removing an index from the listing that has a lowest run length probability thereby returning the buffer to size L, and responsive to determining the index removed from the listing does not correspond to the new data point, identifying a changepoint associated with the new data point.

Growing community of inventors

San Francisco, CA, United States of America

Ryan Gannon