Abstract: After sensors are placed at three or more non-collinear locations on a surface of the component, the system receives time-series signals from the sensors while the component operates on a representative workload. The system then defines one or more triangles on the surface of the component, wherein each triangle is defined by three vertices, which coincide with different sensor locations on the surface of the component. For each triangle, the system applies a barycentric coordinate technique (BCT) to time-series signals received from sensors located at the vertices of the triangle to determine a candidate location within the triangle to place an additional sensor. The system then compares the candidate locations for each of the one or more triangles to determine a globally optimal location for the additional sensor, and a new sensor is placed at this location. This process is repeated until a desired number of sensors are placed.

Abstract: The disclosed embodiments relate to a system that detects degradation in one or more rotating components in a monitored system. During operation, the system receives one or more telemetry signals comprising vibration sensor readings from one or more vibration sensors in the monitored system. The system then performs a fast Fourier transform (FFT) on the vibration sensor readings to produce a power spectral density (PSD) distribution. Next, the system identifies a peak in the PSD distribution, wherein the peak is associated with a target rotating component in the monitored system. After identifying the peak, the system computes a full width half maximum (FWHM) value for a curve associated with the peak. Finally, if the FWHM value exceeds a pre-specified threshold, the system generates a notification about degradation of the target rotating component in the monitored system.

Abstract: Systems, methods, and other embodiments are disclosed for data-driven user authentication misuse detection. In one embodiment, for a user authentication attempt to access a secure computer resource, user authentication log data having user attribute values is collected. The user authentication log data is transformed into a tracer data structure. The tracer data structure is augmented with timestamp data to generate an event data structure. It is determined whether the tracer data structure matches an existing tracer data structure stored in a rules database and, if not, a novelty flag is set to generate a new user behavior model filter. If the tracer data structure matches the existing tracer data structure: an existing user behavior model filter is applied, issuance of an alarm message or signal is controlled, and the existing user behavior model filter is updated based, at least in part, on the event data structure.

Abstract: Systems, methods, and other embodiments are disclosed for data-driven user authentication misuse detection. In one embodiment, for each of multiple authentication attempts to a computing device by a user via user authentication log messages: user authentication log data having user attribute values is collected; the user authentication log data is transformed into a tracer data structure having the user attribute values organized in a common format; the tracer data structure is augmented with timestamp data to generate an event data structure, where the timestamp data represents a time at which the user authentication log data is observed by the computing device; a user behavior model filter, representing account usage patterns of the user, is updated based at least in part on the event data structure. A malicious authentication attempt to the computing device by a malicious user is detected based on, at least in part, the user behavior model filter.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Abstract: Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Abstract: Systems, methods, and other embodiments are disclosed for data-driven user authentication misuse detection. In one embodiment, for each of multiple authentication attempts to a computing device by a user via user authentication log messages: user authentication log data having user attribute values is collected; the user authentication log data is transformed into a tracer data structure having the user attribute values organized in a common format; the tracer data structure is augmented with timestamp data to generate an event data structure, where the timestamp data represents a time at which the user authentication log data is observed by the computing device; a user behavior model filter, representing account usage patterns of the user, is updated based at least in part on the event data structure. A malicious authentication attempt to the computing device by a malicious user is detected based on, at least in part, the user behavior model filter.

Abstract: The disclosed embodiments relate to a system that characterizes I/O performance of a computing device in terms of energy consumption across a range of vibrational operating environments. During operation, the system executes a test script on a computing device that is affixed to a programmable vibration table, wherein the test script causes the computing device to perform a predetermined I/O workload. While the test script is executing, the system controls the programmable vibration table to subject the computing device to different vibrational operating environments. At the same time, the system obtains test results by monitoring a progress of the test script and an associated power consumption of the computing device. Finally, the system uses the obtained test results to characterize the I/O performance of the computing device in terms of energy consumption across the range of vibrational operating environments.

Abstract: The disclosed embodiments relate to a system that reduces bandwidth requirements for transmitting telemetry data from sensors in a computer system. During operation, the system obtains a cross-imputability value for each sensor in a set of sensors that are monitoring the computer system, wherein a cross-imputability value for a sensor indicates how well a sensor value obtained from the sensor can be predicted based on sensor values obtained from other sensors in the set. Next, the system clusters sensors in the set of sensors into two or more groups based on the determined cross-imputability values. Then, while transmitting sensor values from the set of sensors, for a group of sensors having cross-imputability values exceeding a threshold, the system selectively transmits sensor values from some but not all of the sensors in the group to reduce a number of sensor values transmitted.

Abstract: The disclosed embodiments provide a system that detects anomalous events in a virtual machine. During operation, the system obtains time-series virtual machine (VM) data including garbage-collection (GC) data collected during execution of a virtual machine in a computer system. Next, the system computes, by a service processor, a time window for analyzing the time-series VM data based at least in part on a working time scale of high-activity patterns in the time-series GC data. The system then uses a trend-estimation technique to analyze the time-series VM data within the time window to determine an out-of-memory (OOM) risk in the virtual machine. Finally, the system stores an indication of the OOM risk for the virtual machine based at least in part on determining the OOM risk in the virtual machine.

Abstract: A system for characterizing vibration of a rack structure having at least one hard disk drive disposed therein and a vibration exciter operatively associated with the rack structure includes one or more computers. The one or more computers are configured to command the vibration exciter to provide vibration input to the rack structure and to command a plurality of reads from the at least one hard disk drive such that, for each of the plurality of reads, data stored on the at least one hard disk drive is retrieved from the at least one hard disk drive. The one or more computers are also configured to obtain read rate information related to the plurality of reads and to identify at least one resonant frequency of the rack structure based on the read rate information.

Abstract: The disclosed embodiments provide a system that detects anomalous events in a virtual machine. During operation, the system obtains time-series virtual machine (VM) data including garbage-collection (GC) data collected during execution of a virtual machine in a computer system. Next, the system computes, by a service processor, a time window for analyzing the time-series VM data based at least in part on a working time scale of high-activity patterns in the time-series GC data. The system then uses a trend-estimation technique to analyze the time-series VM data within the time window to determine an out-of-memory (OOM) risk in the virtual machine. Finally, the system stores an indication of the OOM risk for the virtual machine based at least in part on determining the OOM risk in the virtual machine.

Abstract: Systems, methods, and other embodiments associated with clustering using tri-point arbitration are described. In one embodiment, a method includes selecting a data point pair and a set of arbiter points. A tri-point arbitration similarity is calculated for data point pairs based, at least in part, on a distance between the first and second data points and the arbiter points. In one embodiment, similar data points are clustered.

Abstract: Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Abstract: The disclosed embodiments provide a system that prevents oscillatory load behavior for a multi-node distributed system. During operation, the system uses a load-balancing policy to distribute requests to nodes of the distributed system. The system determines operational characteristics for the nodes as they process a set of requests, and then uses these operational characteristics to compute machine queuing models that describe the machine state of each node. The system then uses this machine state for the nodes to determine whether the load-balancing policy and the distributed system are susceptible to oscillatory load behavior.

Abstract: A method for generating instructions for a monitoring facility. The method includes obtaining a signal from a data server, where the data server is monitored by the monitoring facility using a task, identifying a signal characteristic of the signal, and determining a first category for the signal based on the signal characteristic. The method further includes identifying a first signal processing tool for the signal based on the task and the first category and instructing the monitoring facility to perform the task by applying the first signal processing tool to the signal.

Abstract: A method for processing signals from a data server system including generating, by a monitoring module on a monitoring facility, a plurality of frequency data items, where the monitoring facility comprises a central processing unit, obtaining, by the monitoring module, a first signal value from the data server system, where the signal value is a measurement of an element of the data server system, and calculating a plurality of fit errors for the plurality of frequency data items using the first signal value. The method further includes selecting a frequency data item of the plurality of frequency data items with a lowest fit error to obtain a selected frequency data item, removing a cyclic component of the first signal value using the selected frequency data item to obtain a first processed signal value, and displaying the first processed signal value on a graph.

Abstract: One embodiment provides a system that analyzes telemetry data from a monitored system. During operation, the system periodically obtains the telemetry data as a set of telemetry variables from the monitored system and updates a multidimensional real-time distribution of the telemetry data using the obtained telemetry variables. Next, the system analyzes a statistical deviation of the multidimensional real-time distribution from a multidimensional reference distribution for the monitored system using a multivariate sequential probability ratio test (SPRT) and assesses the integrity of the monitored system based on the statistical deviation of the multidimensional real-time distribution. If the assessed integrity falls below a threshold, the system determines a fault in the monitored system corresponding to a source of the statistical deviation.

Abstract: Systems, methods, and other embodiments associated with similarity analysis using tri-point arbitration are described. In one embodiment, a method includes selecting a data point pair and an arbiter point from a data set. A tri-point arbitration coefficient (?TAC) is calculated for data point pairs based, at least in part, on a distance between the first and second data points and the arbiter point. A similarity metric is determined for the data set based, at least in part, on an aggregation of tri-point arbitration coefficients for data point pairs in the set of data points using the selected arbiter point.