Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: Systems, methods, and other embodiments associated with anomaly detection using tripoint arbitration are described. In one embodiment, a method includes identifying a set of clusters that correspond to a nominal sample of data points in a sample space. A point z is determined to be an anomaly with respect to the nominal sample when, for each cluster, a tripoint arbitration similarity between data points in the cluster calculated with z as arbiter is greater than a threshold.

Abstract: The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.

Abstract: Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: The disclosed embodiments relate to a system that reduces bandwidth requirements for transmitting telemetry data from sensors in a computer system. During operation, the system obtains a cross-imputability value for each sensor in a set of sensors that are monitoring the computer system, wherein a cross-imputability value for a sensor indicates how well a sensor value obtained from the sensor can be predicted based on sensor values obtained from other sensors in the set. Next, the system clusters sensors in the set of sensors into two or more groups based on the determined cross-imputability values. Then, while transmitting sensor values from the set of sensors, for a group of sensors having cross-imputability values exceeding a threshold, the system selectively transmits sensor values from some but not all of the sensors in the group to reduce a number of sensor values transmitted.

Abstract: The disclosed embodiments relate to a system that characterizes I/O performance of a computing device in terms of energy consumption across a range of vibrational operating environments. During operation, the system executes a test script on a computing device that is affixed to a programmable vibration table, wherein the test script causes the computing device to perform a predetermined I/O workload. While the test script is executing, the system controls the programmable vibration table to subject the computing device to different vibrational operating environments. At the same time, the system obtains test results by monitoring a progress of the test script and an associated power consumption of the computing device. Finally, the system uses the obtained test results to characterize the I/O performance of the computing device in terms of energy consumption across the range of vibrational operating environments.

Abstract: The system receives a stream of authentication events, which are associated with authentication events. Next, the system attempts to detect a formation of authentication events, wherein a formation comprises a time window of authentication events that satisfy a formation criterion, which is based on one or more of: a username for the authentication attempt, an Internet Protocol (IP) address from which the authentication attempt originated, and a resource identifier for a computing resource that the authentication attempt was directed to. If a formation is detected, the system determines a number of valid usernames in the formation. If the number of valid usernames is one or less, the system computes a username similarity score for authentication events in the formation, which is a function of a string distance between usernames in the formation. If the username similarity score exceeds a threshold value, the system reports a potential username guessing attack.

Abstract: Systems, methods, and other embodiments associated with tripoint arbitration for data classification are described. In one embodiment, a method includes receiving a query data point for classification, an arbiter point, a first set of classified data points belonging to a first class and a second set of classified data points belonging to a second class. A class-aggregated similarity metric for the query data point and each set is determined based, at least in part, on tripoint arbitration coefficients for data point pairs that include the query data point and a classified data point in the set, as calculated using the arbiter point. The query data point is classified based on a comparison of the similarity metric determined for the first set and the similarity metric determined for the second set.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.

Abstract: Systems, methods, and other embodiments associated with multi-distance clustering are described. In one embodiment, a method includes reading a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set. Each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one. The method includes clustering the data points in the data set into n clusters based on the similarity matrix S. The number of clusters n is not determined prior to the clustering.

Abstract: Systems, methods, and other embodiments associated with anomaly detection using tripoint arbitration are described. In one embodiment, a method includes identifying a set of clusters that correspond to a nominal sample of data points in a sample space. A point z is determined to be an anomaly with respect to the nominal sample when, for each cluster, a tripoint arbitration similarity between data points in the cluster calculated with z as arbiter is greater than a threshold.

Abstract: The disclosed embodiments relate to a system that characterizes I/O performance of a computing device in terms of energy consumption across a range of vibrational operating environments. During operation, the system executes a test script on a computing device that is affixed to a programmable vibration table, wherein the test script causes the computing device to perform a predetermined I/O workload. While the test script is executing, the system controls the programmable vibration table to subject the computing device to different vibrational operating environments. At the same time, the system obtains test results by monitoring a progress of the test script and an associated power consumption of the computing device. Finally, the system uses the obtained test results to characterize the I/O performance of the computing device in terms of energy consumption across the range of vibrational operating environments.

Abstract: The disclosed embodiments relate to a system that reduces bandwidth requirements for transmitting telemetry data from sensors in a computer system. During operation, the system obtains a cross-imputability value for each sensor in a set of sensors that are monitoring the computer system, wherein a cross-imputability value for a sensor indicates how well a sensor value obtained from the sensor can be predicted based on sensor values obtained from other sensors in the set. Next, the system clusters sensors in the set of sensors into two or more groups based on the determined cross-imputability values. Then, while transmitting sensor values from the set of sensors, for a group of sensors having cross-imputability values exceeding a threshold, the system selectively transmits sensor values from some but not all of the sensors in the group to reduce a number of sensor values transmitted.

Abstract: A system for characterizing vibration of a rack structure having at least one hard disk drive disposed therein and a vibration exciter operatively associated with the rack structure includes one or more computers. The one or more computers are configured to command the vibration exciter to provide vibration input to the rack structure and to command a plurality of reads from the at least one hard disk drive such that, for each of the plurality of reads, data stored on the at least one hard disk drive is retrieved from the at least one hard disk drive. The one or more computers are also configured to obtain read rate information related to the plurality of reads and to identify at least one resonant frequency of the rack structure based on the read rate information.

Abstract: Systems, methods, and other embodiments associated with clustering using tri-point arbitration are described. In one embodiment, a method includes selecting a data point pair and a set of arbiter points. A tri-point arbitration similarity is calculated for data point pairs based, at least in part, on a distance between the first and second data points and the arbiter points. In one embodiment, similar data points are clustered.

Abstract: Systems, methods, and other embodiments associated with multi-distance tri-point arbitration are described. In one embodiment, a method includes using a K different distance functions, calculating K per-distance tri-point arbitration similarities between a pair of data points with respect to an arbiter point. A multi-distance tri-point arbitration similarity S between the data points is calculated by determining that the data points are similar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are similar; and determining that the data points are dissimilar when a dominating number of the K per-distance tri-point arbitration similarities indicate that the data points are dissimilar. The multi-distance tri-point arbitration similarity is associated with the data points for use in future processing.