Ca, Inc.

Smrati Gupta

Erhan Giral

Victor Muntés-Mulero

David Sanchez Charles

Balram Reddy Kakani

Ravindra Kumar Puli

Thomas Howard Ferrin

A multivariate clustering-based anomaly detector can generate an event for consumption by an APM manager that indicates detection of an anomaly based on multivariate clustering analysis after topology-based feature selection. The anomaly detector accumulates time-series data across a series of time instants to form a multivariate time-series data slice or multivariate data slice. The anomaly detector then performs multivariate clustering analysis with the multivariate data slice. The anomaly detector determines whether a multivariate data slice is within a cluster of multivariate data slices. If the multivariate data slice is within the cluster and the cluster is a known anomaly cluster, then the anomaly detector generates an anomaly detection event indicating detection of the known anomaly. The anomaly detector can also determine that a multivariate data slice is within an unknown cluster and generate an event indicating detection of an unknown anomaly.

Multivariate clustering-based anomaly detection

Instead of attempting to scan all metric measurements of a distributed application, an anomaly detector intelligently selects instances of metrics from the universe of metric instances available for the distributed application to detect anomalies. Intelligent feature selection allows the anomaly detector to efficiently and reliably detect anomalies for a distributed application. The intelligent selection is guided by execution paths of transactions of the distributed application, and the execution paths are determined from a topology of the distributed application. The anomaly detector scans the incoming time-series data of the selected metric instances by transaction type and determines whether the scanned measurements across the selected metric instances form a pattern correlated with anomalous behavior.

Topology-based feature selection for anomaly detection

A multivariate path-based anomaly detection and prediction service ('anomaly detector') can generate a prediction event for consumption by the APM manager that indicates a likelihood of an anomaly occurring based on path analysis of multivariate values after topology-based feature selection. To predict that a set of metrics will travel to a cluster that represents anomalous application behavior, the anomaly detector analyzes a set of multivariate date slices that are not within a cluster to determine whether dimensionally reduced representations of the set of multivariate data slices fit a path as described by a function.

Multivariate path-based anomaly prediction

A system uses event correlation to identify components belonging to a same service or service domain. The system correlates events by generating covariance matrices or by performing sequence mining with temporal databases in order to discover event patterns that occur sequentially in a fixed time window. Components corresponding to the correlated events are identified as being part of a same service domain and can be indicated in a service domain data structure, such as a topology. The system utilizes the identified service domains during root cause analysis. The system can determine an anomalous event occurring a lowest layer component in a service domain as a root cause or can determine an anomalous event which occurs first in an identified event sequence of a service domain as a root cause. After identifying the root cause event, the system suppresses notifications of events occurring at other components in the service domain.

Event based service discovery and root cause analysis

A non-intrusive system which monitors a data center by detecting electromagnetic waves alleviates a resource burden on components and is inexpensive to deploy and scale within a data center. The system detects waves using omnidirectional antennas positioned throughout the data center, thus alleviating the need to physically attach directional antennas to components. The system performs a learning phase wherein representations of detected waves are mapped to occurrence of events within the data center. Once the learning phase is complete, operation of existing network monitoring tools, such as agents and probes, may cease, and the system may begin monitoring for events based on the detected waves. The system may also analyze wave data prior to the occurrence of events to identify event prediction indicators, e.g. distinctive wave values or patterns, which may be used to predict the occurrence of an event.

Growing community of inventors

San Jose, CA, United States of America

Smrati Gupta