Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: Examples disclosed herein relate, among other things, to a method. The method may obtain a time series comprising a plurality of data points associated with a sub-segment of a segment, obtaining a plurality of weights associated with a plurality of data point pairs from the plurality of data points, and based on the plurality of weights and the plurality of data point pairs, determine whether the time series comprises a trend. Based on a determination that the time series comprises a trend, the method may calculate a trend score for the trend based on at least one characteristic of at least one of the segment and the sub-segment, and provide the trend for display.

Abstract: The present disclosure provides a method, system and non-transient computer readable medium for evaluating system behaviour by deriving a statistical distance between each entity in a multi-entity system, and summing the statistical distance to each other entity to create a ranked abnormality score for each entity in the system.

Abstract: Examples disclosed herein relate, among other things, to a method. The method may obtain a time series comprising a plurality of data points associated with a sub-segment of a segment, obtaining a plurality of weights associated with a plurality of data point pairs from the plurality of data points, and based on the plurality of weights and the plurality of data point pairs, determine whether the time series comprises a trend. Based on a determination that the time series comprises a trend, the method may calculate a trend score for the trend based on at least one characteristic of at least one of the segment and the sub-segment, and provide the trend for display.

Abstract: The present disclosure provides a method, system and non-transient computer readable medium for evaluating system behaviour by deriving a statistical distance between each entity in a multi-entity system, and summing the statistical distance to each other entity to create a ranked abnormality score for each entity in the system.

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: Determining term scores based on a modified inverse domain frequency is disclosed. One example is a system including a data processing engine, an evaluator, and a data analytics module. The data processing engine identifies a key term associated with a system, and a sub-plurality of a plurality of documents, the sub-plurality of documents associated with the event. The evaluator determines, based on the presence or absence of the key term, a first distribution related to the sub-plurality of documents, and a second distribution related to the plurality of documents, and evaluates, for the key term, a term score based on the first distribution and the second distribution, the term score indicative of a modified inverse domain frequency based on the sub-plurality of documents. The data analytics module includes the key term in a word cloud when the term score for the key term satisfies a threshold.

Abstract: An interactive system to detect malware is provided to interactively analyze web proxy log data. The log data is progressively processed to compute analytics for different context settings. The system has a context module, an interaction module and a plurality of analytics modules. When a change of the context setting (filter, weights etc.) is requested, the processing and calculation of analytics for the current context setting is paused and subsequently restarted for the now changed context setting. An analytics interface provided via a graphical user interface is updated upon the change of context settings.

Abstract: Data streams that can be related to operation tracing and/or performance indications, for example, may be monitored. The data streams can have different dynamic statistical characteristics including static signal distributions and non-static signal distributions with respect to time. The data streams may be analyzed independent of any predetermined assumptions on statistical behavior and on changes in the statistical behavior. Data may be transformed into a set of key performance indicators and performance-change indicators that are adaptive to instantaneous statistical changes.

Abstract: Systems and methods for translating time-stamped events to performance indicators are provided. A data component can receive sequences of time-stamped events associated with a device with a set of subsystem components. A conversion component can convert the sequences to time series based upon log transformations of event-intervals associated with the events. An estimation component can estimate local event-descriptor distribution characteristics at an event count associated with the time series. A translation component can translate the local event-descriptor distributions characteristics into performance indicators.