Abstract: This disclosure presents computational systems and methods for detecting anomalies in data output from any type of monitoring tool. The data is aggregated and sent to an alerting system for abnormality detection via comparison with normalcy bounds. The anomaly detection methods are performed by construction of normalcy bounds of the data based on the past behavior of the data output from the monitoring tool. The methods use data quality assurance and data categorization processes that allow choosing a correct procedure for determination of the normalcy bounds. The methods are completely data agnostic, and as a result, can also be used to detect abnormalities in time series data associated with any complex system.

Abstract: An approach to root cause determination in a complex systems based on monitoring and event data is disclosed. It includes a historical analysis of events with their probabilistic correlations. Applying information measures between the random variables which embody those events one can detect origins of problems and generate real-time recommendations for their locations in a hierarchical system. Estimation of system bottlenecks, as well as the risk of “black swan”-type events are also computed. The processes are based on a statistical processing of a virtual directed graph produced from historical events.

Abstract: This disclosure presents systems and methods for run-time analysis of streams of log data for abnormalities using a statistical structure of meta-data associated with the log data. The systems and methods convert a log data stream into meta-data and perform statistical analysis in order to reveal a dominant statistical pattern within the meta-data. The meta-data is represented as a graph with nodes that represent each of the different event types, which are detected in the stream along with event sources associated with the events. The systems and methods use real-time analysis to compare a portion of a current log data stream collected in an operational window with historically collected meta-data represented by a graph in order to determine the degree of abnormality of the current log data stream collected in the operational window.

Abstract: A system and method for correlating fingerprints in an Information Technology (IT) infrastructure for automated intelligence, where a fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding an event. It is determined whether a correlation exists between multiple fingerprints to determine whether such fingerprints separately indicate the occurrence of the event for the same reason. If a degree of match is found to exist between the rule sets of multiple fingerprints that exceeds a certain threshold, the fingerprints are determined to indicate the occurrence of the event for the same reason and the rule sets for those fingerprints can be merged together with the probabilities that such rules will indicate the occurrence of the event adjusted accordingly. In one or more embodiments, the fingerprint matching correlation procedures are implemented to account for time or phase shifts between the rule sets in two fingerprints.

Abstract: The current application is directed to automated methods and systems for processing and analyzing unstructured data. The methods and systems of the current application identify patterns and determine characteristics of, and interrelationships between, events parsed from the unstructured data without necessarily using user-provided or expert-provided contextual knowledge. In one implementation, the unstructured data is parsed into attributed-associated events, reduced by eliminating attributes of low-information content, and coalesced into nodes that are incorporated into one or more graphs, within which patterns are identified and characteristics and interrelationships determined.

Abstract: An approach to root cause determination in a complex systems based on monitoring and event data is disclosed. It includes a historical analysis of events with their probabilistic correlations. Applying information measures between the random variables which embody those events one can detect origins of problems and generate real-time recommendations for their locations in a hierarchical system. Estimation of system bottlenecks, as well as the risk of “black swan”-type events are also computed. The processes are based on a statistical processing of a virtual directed graph produced from historical events.

Abstract: According to a feature of the present disclosure, a method is provided for the determination of anomalous events in complex systems, such as problems, inefficiencies, and failures, and a tool is provided for the detection of these events. Many complex systems are non-stationary or experience periodic fluctuations or spikes in values that are outside of normal ranges, but constitute normal behavior nevertheless. The method accounts for both non-stationarity, as well as fluctuations and spikes. Additional novel features include both a threshold setting initialization method and a regression method for the determination of the start points and end points of events.

Abstract: A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur.

Abstract: Methods and systems for determination of thresholds for time-series data. Data is transformed by reducing outliers, dividing the time series data into discrete time intervals, and taking parts of the data corresponding to the range that the thresholds will bound. If data cycles are known, they may be applied to the data and the resulting sets are weighted. Thresholds are then derived from the weighted means and variances of the sets of weighted data.

Abstract: An integrity management system predicts abnormalities in complex systems before they occur based upon the prior history of abnormalities within the complex system. A topology of the nodes of a complex system is generated and data is collected from the system based on predetermined metrics. In combination with dynamic thresholding, fingerprints of the relevant nodes within a complex system at various time intervals prior to the occurrence of the abnormality are captured and weighted. The fingerprints can then be applied to real-time data to provide alerts of potential abnormality prior to their actual occurrence.

Abstract: According to a feature of the present disclosure, a method is provided for the determination of anomalous events in complex systems, such as problems, inefficiencies, and failures, and a tool is provided for the detection of these events. Many complex systems are non-stationary or experience periodic fluctuations or spikes in values that are outside of normal ranges, but constitute normal behavior nevertheless. The method accounts for both non-stationarity, as well as fluctuations and spikes. Additional novel features include both a threshold setting initialization method and a regression method for the determination of the start points and end points of events.

Abstract: According to a feature of the present disclosure, a method is provided for the determination of anomalous events in complex systems, such as problems, inefficiencies, and failures, and a tool is provided for the detection of these events. Many complex systems are non-stationary or experience periodic fluctuations or spikes in values that are outside of normal ranges, but constitute normal behavior nevertheless. The method accounts for both non-stationarity, as well as fluctuations and spikes. Additional novel features include both a threshold setting initialization method and a regression method for the determination of the start points and end points of events.

Abstract: An integrity management system predicts abnormalities in complex systems before they occur based upon the prior history of abnormalities within the complex system. A topology of the nodes of a complex system is generated and data is collected from the system based on predetermined metrics. In combination with dynamic thresholding, fingerprints of the relevant nodes within a complex system at various time intervals prior to the occurrence of the abnormality are captured and weighted. The fingerprints can then be applied to real-time data provide alerts of potential abnormality prior to their actual occurrence.

Abstract: An integrity management system predicts abnormalities in complex systems before they occur based upon the prior history of abnormalities within the complex system. A topology of the nodes of a complex system is generated and data is collected from the system based on predetermined metrics. In combination with dynamic thresholding, fingerprints of the relevant nodes within a complex system at various time intervals prior to the occurrence of the abnormality are captured and weighted. The fingerprints can then be applied to real-time data provide alerts of potential abnormality prior to their actual occurrence.

Abstract: A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur.

Abstract: A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur.

Abstract: A system and method are provided for determining problem conditions in an IT infrastructure using aggregate anomaly analysis. The anomalies in the metrics occurring in the monitored IT infrastructure are aggregated from all resources reporting metrics as a function of time. The aggregated metric anomalies are then normalized to account for the state of the monitored IT infrastructure to provide a normalized aggregate anomaly count. A threshold noise level is then determined utilizing a variably selectable desired level of confidence such that a problem event is only determined to likely be occurring in the IT infrastructure when the normalized aggregate anomaly count exceeds the threshold noise level. The normalized aggregate anomaly count is monitored against the threshold noise level as a function of time, such that a problem event in the IT infrastructure is identified when the normalized aggregate anomaly count exceeds the threshold noise level at a given time.

Abstract: Methods and systems for determination of thresholds for time-series data. Data is transformed by reducing outliers, dividing the time series data into discrete time intervals, and taking parts of the data corresponding to the range that the thresholds will bound. If data cycles are known, they may be applied to the data and the resulting sets are weighted. Thresholds are then derived from the weighted means and variances of the sets of weighted data.

Abstract: According to a feature of the present disclosure, a method is provided for the determination of anomalous events in complex systems, such as problems, inefficiencies, and failures, and a tool is provided for the detection of these events. Many complex systems are non-stationary or experience periodic fluctuations or spikes in values that are outside of normal ranges, but constitute normal behavior nevertheless. The method accounts for both non-stationarity, as well as fluctuations and spikes. Additional novel features include both a threshold setting initialization method and a regression method for the determination of the start points and end points of events.

Abstract: A system and method for correlating fingerprints in an Information Technology (IT) infrastructure for automated intelligence, where a fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding an event. It is determined whether a correlation exists between multiple fingerprints to determine whether such fingerprints separately indicate the occurrence of the event for the same reason. If a degree of match is found to exist between the rule sets of multiple fingerprints that exceeds a certain threshold, the fingerprints are determined to indicate the occurrence of the event for the same reason and the rule sets for those fingerprints can be merged together with the probabilities that such rules will indicate the occurrence of the event adjusted accordingly. In one or more embodiments, the fingerprint matching correlation procedures are implemented to account for time or phase shifts between the rule sets in two fingerprints.