International Business Machines Corporation

Stefano Proietti

Antonio Mario Sgro

Gianluca Della Corte

Alessandro Donatelli

Leonida Gianfagna

Roberto Pecoraro

Filomena Ferrara

Andrea Alfonso Capasso

Ingo J Averdunk

Methods and systems for detecting anomalous behavior include performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes. The KPIs are clustered in a space defined by the set of principal axes. Local anomalies are determined in the clustered KPIs by comparing, for each individual KPI in clusters that conform to a Gaussian distribution, a distance from a respective cluster mean to a threshold. Structural anomalies are determined in the clustered KPIs. The structural and local anomalies are classified based on historical information. A management action is performed based on the classified structural and local anomalies.

Anomaly detection in performance management

Methods and systems for detecting anomalous behavior include performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes. The KPIs are clustered in a space defined by the set of principal axes. Local and structural anomalies are determined in the clustered KPIs. The structural and local anomalies are classified based on historical information. A transformation is performed from a space based on the principal axes to an original space. It is determined whether each of the local and structural anomalies is a global or a local anomaly. A management action is performed based on the classified structural and local anomalies.

A method to replace profile related data is suggested. A history database including recorded profile related data may be provided. Upon receiving actual profile related data, a processor may retrieve, from the history database, at least one recorded profile related data, matching to the actual profile related data. Then, a command may be received, from a user, to replace at least one part of the actual profile related data.

Masking of sensitive personal information based on anomaly detection

A solution for sending messages on a data-processing system is proposed. A corresponding method comprises upon a message to be sent from a sender to at least one receiver being submitted, parsing the message to identify an original expression therein matching an indication of one of a set of pre-defined concepts, determining, for the receiver, a preferred expression of the matched concept, among the corresponding original expression and a set of candidate expressions pre-defined to express the matched concept, according to a rating thereof representing an expected understanding by the receiver, processing the message for the receiver by replacing the original expression according, to the corresponding preferred expression for the receiver, and sending the processed message to the corresponding receiver.

Differentiation of messages for receivers thereof

A solution for sending messages on a data-processing system is proposed. A corresponding method comprises upon a message to be sent from a sender to at least one receiver being submitted, parsing the message to identify an original expression therein matching an indication of one of a set of pre-defined concepts, determining, for the receiver, a preferred expression of the matched concept, among the corresponding original expression and a set of candidate expressions pre-defined to express the matched concept, according to a rating thereof representing an expected understanding by the receiver, processing the message for the receiver by replacing the original expression according to the corresponding preferred expression for the receiver, and sending the processed message to the corresponding receiver.

A method and system or monitoring a resource consumption of an application running on a computer. A first metric describes the resource consumption of the application as a first function of time. A wavelet analysis of the first function of time is performed. A discontinuity in the first function is detected at a first time at which a coefficient determined from the wavelet analysis exceeds a specified threshold. A cross-correlation of the first metric and a second metric describing the resource consumption of the application as a second function of time are calculated. A diagnostic level associated with the discontinuity in the first function is adjusted based on the calculated cross-correlation. In response to adjusting the diagnostic level, a debugging function on the application is started in response to the cross correlation having a value indicative of an anomaly within the application.

Monitoring a resource consumption of an application

A method and system for monitoring a resource consumption of an application running on a computer. A first metric describing the resource consumption of the application as a first function of time is tracked. A wavelet analysis of the first function is performed and a discontinuity is detected in the first function at a first time at which a coefficient determined from the wavelet analysis exceeds a specified threshold. The coefficient is indexed on a dilation parameter and a time offset parameter.

Methods and systems for detecting anomalous behavior include performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes. The KPIs are clustered in a space defined by the set of principal axes. Local and structural anomalies are determined in the clustered KPIs. The structural and local anomalies are classified based on historical information. A management action is performed based on the classified structural and local anomalies.

A computer-implemented method for prediction of required number of server computing systems for future computing workload is provided. The computer implemented method comprises connecting a portion of a plurality of server computing systems of a data center. The computer-implemented method further comprises computing at least one server computing system of each of a class I server computing system, a class S server computing system, and a class R server computing system of the plurality of the server computing systems based on a deployment rate, an undeployment rate, and a removing rate of the each of the class I server computing system, the class S server computing system, and the class R server computing system.

IT system infrastructure prediction based on epidemiologic algorithm

An approach for hiding sensitive data in log files is provided. The approach uses a background program embedded within an operating system. The background program intercepts a write operation of an application and, in response to determining that the write operation is for a log file, gets content of the write operation. The background program checks a knowledge base that comprises information for the sensitive data and identifies the sensitive data in the content of the write operation. The background program masks the sensitive data in the content of the write operation, in response to determining that the content of the write operation has the sensitive data to be masked. In the log file, the background program writes modified content in which the sensitive data is masked.

Growing community of inventors

Rome, Italy

Stefano Proietti