Abstract: Techniques are described for generating predictive alerts. In one or more embodiments, a seasonal model is generated, the seasonal model representing one or more seasonal patterns within a first set of time-series data, the first set of time-series data comprising data points from a first range of time. A trend-based model is also generated to represent trending patterns within a second set of time-series data comprising data points from a second range of time that is different than the first range of time. A set of forecasted values is generated based on the seasonal model and the trend-based model. Responsive to determining that a set of alerting thresholds has been satisfied based on the set of forecasted values, an alert is generated.

Abstract: Techniques are described for generating seasonal forecasts. According to an embodiment, a set of time-series data is associated with one or more classes, which may include a first class that represent a dense pattern that repeats over multiple instances of a season in the set of time-series data and a second class that represent another pattern that repeats over multiple instances of the season in the set of time-series data. A particular class of data is associated with at least two sub-classes of data, where a first sub-class represents high data points from the first class, and a second sub-class represents another set of data points from the first class. A trend rate is determined for a particular sub-class. Based at least in part on the trend rate, a forecast is generated.

Abstract: Techniques are described for classifying seasonal patterns in a time series. In an embodiment, a set of time series data is decomposed to generate a noise signal and a dense signal, where the noise signal includes a plurality of sparse features from the set of time series data and the dense signal includes a plurality of dense features from the set of time series data. A set of one or more sparse features from the noise signal is selected for retention. After selecting the sparse features, a modified set of time series data is generated by combining the set of one or more sparse features with a set of one or more dense features from the plurality of dense features. At least one seasonal pattern is identified from the modified set of time series data. A summary for the seasonal pattern may then be generated and stored.

Abstract: Techniques are described for generating seasonal forecasts. According to an embodiment, a set of time-series data is associated with one or more classes, which may include a first class that represent a dense pattern that repeats over multiple instances of a season in the set of time-series data and a second class that represent another pattern that repeats over multiple instances of the season in the set of time-series data. A particular class of data is associated with at least two sub-classes of data, where a first sub-class represents high data points from the first class, and a second sub-class represents another set of data points from the first class. A trend rate is determined for a particular sub-class. Based at least in part on the trend rate, a forecast is generated.

Abstract: Systems and methods are described for efficiently detecting an optimal number of behaviors to model software system performance data and the aspects of the software systems that best separate the behaviors. The behaviors may be ranked according to how well fitting functions partition the performance data.

Abstract: Techniques are disclosed for summarizing, diagnosing, and correcting the cause of anomalous behavior in computing systems. In some embodiments, a system identifies a plurality of time series that track different metrics over time for a set of one or more computing resources. The system detects a first set of anomalies in a first time series that tracks a first metric and assigns a different respective range of time to each anomaly. The system determines whether the respective range of time assigned to an anomaly overlaps with timestamps or ranges of time associated with anomalies from one or more other time series. The system generates at least one cluster that groups metrics based on how many anomalies have respective ranges of time and/or timestamps that overlap. The system may preform, based on the cluster, one or more automated actions for diagnosing or correcting a cause of anomalous behavior.

Abstract: Systems and methods for unsupervised training and evaluation of anomaly detection models are described. In some embodiments, an unsupervised process comprises generating an approximation of a data distribution for a training dataset including varying values for a metric of a computing resource. The process further determines, based on the size of the training dataset, a first quantile probability and a second quantile probability that represent an interval for covering a prescribed proportion of values for the metric within a prescribed confidence level. The process further trains a lower limit of the anomaly detection model using a first quantile that represents the first quantile probability in the approximation of the data distribution and an upper limit using a second quantile that represents the second quantile probability in the approximation. The trained upper and lower limits may be used to monitor input data for anomalous behavior and, if detected, trigger responsive action(s).

Abstract: Techniques are disclosed for summarizing, diagnosing, and correcting the cause of anomalous behavior in computing systems. In some embodiments, a system identifies a plurality of time series that track different metrics over time for a set of one or more computing resources. The system detects a first set of anomalies in a first time series that tracks a first metric and assigns a different respective range of time to each anomaly. The system determines whether the respective range of time assigned to an anomaly overlaps with timestamps or ranges of time associated with anomalies from one or more other time series. The system generates at least one cluster that groups metrics based on how many anomalies have respective ranges of time and/or timestamps that overlap. The system may preform, based on the cluster, one or more automated actions for diagnosing or correcting a cause of anomalous behavior.

Abstract: Techniques are described for applying what-f analytics to simulate performance of computing resources in cloud and other computing environments. In one or more embodiments, a plurality of time-series datasets are received including time-series datasets representing a plurality of demands on a resource and datasets representing performance metrics for a resource. Based on the datasets at least one demand propagation model and at least one resource prediction model are trained. Responsive to receiving an adjustment to a first set of one or more values associated with a first demand: (a) a second adjustment is generated for a second set of one or more values associated with a second demand; and (b) a third adjustment is generated for a third set of one or more values that is associated with the resource performance metric.

Abstract: Techniques are described for generating period profiles. According to an embodiment, a set of time series data is received, where the set of time series data includes data spanning a plurality of time windows having a seasonal period. Based at least in part on the set of time-series data, a first set of sub-periods of the seasonal period is associated with a particular class of seasonal pattern. A profile for a seasonal period that identifies which sub-periods of the seasonal period are associated with the particular class of seasonal pattern is generated and stored, in volatile or non-volatile storage. Based on the profile, a visualization is generated for at least one sub-period of the first set of sub-periods of the seasonal period that indicates that the at least one sub-period is part of the particular class of seasonal pattern.

Abstract: Techniques for analyzing, understanding, and remediating differences in configurations among many software resources are described herein. Machine learning processes are applied to determine a small feature set of parameters from among the complete set of parameters configured for each software resource. The feature set of parameters is selected to optimally cluster configuration instances for each of the software resources. Once clustered based on the values of the feature set of parameters, a graph is generated for each cluster of configuration instances that depicts the differences among the configuration instances within the cluster. An interactive visualization tool renders the graph in a user interface, and a management tool allows changes to the graph and changes to the configuration of one or more software resources.

Abstract: Techniques are disclosed for summarizing, diagnosing, and correcting the cause of anomalous behavior in computing systems. In some embodiments, a system identifies a plurality of time series that track different metrics over time for a set of one or more computing resources. The system detects a first set of anomalies in a first time series that tracks a first metric and assigns a different respective range of time to each anomaly. The system determines whether the respective range of time assigned to an anomaly overlaps with timestamps or ranges of time associated with anomalies from one or more other time series. The system generates at least one cluster that groups metrics based on how many anomalies have respective ranges of time and/or timestamps that overlap. The system may preform, based on the cluster, one or more automated actions for diagnosing or correcting a cause of anomalous behavior.

Abstract: Systems and methods are described for efficiently detecting an optimal number of behaviors to model software system performance data and the aspects of the software systems that best separate the behaviors. The behaviors may be ranked according to how well fitting functions partition the performance data.

Abstract: Techniques are described for classifying seasonal patterns in a time series. In an embodiment, a set of time series data is decomposed to generate a noise signal and a dense signal, where the noise signal includes a plurality of sparse features from the set of time series data and the dense signal includes a plurality of dense features from the set of time series data. A set of one or more sparse features from the noise signal is selected for retention. After selecting the sparse features, a modified set of time series data is generated by combining the set of one or more sparse features with a set of one or more dense features from the plurality of dense features. At least one seasonal pattern is identified from the modified set of time series data. A summary for the seasonal pattern may then be generated and stored.

Abstract: Techniques for artificial intelligence driven configuration management are described herein. In some embodiments, a machine-learning process determines a feature set for a plurality of deployments of a software resource. Based on varying values in the feature set, the process clusters each of the plurality of deployments into a cluster of a plurality of clusters. Each cluster of the plurality of clusters comprises one or more nodes and each node of the one or more nodes corresponds to at least a subset of values of the feature set that are detected in at least one deployment of the plurality of deployments of the software resource. The process determines a representative node for each cluster of the plurality of clusters. An operation may be performed based on the representative node for at least one cluster.

Abstract: Techniques are described for classifying seasonal patterns in a time series. In an embodiment, a set of time series data is decomposed to generate a noise signal and a dense signal, where the noise signal includes a plurality of sparse features from the set of time series data and the dense signal includes a plurality of dense features from the set of time series data. A set of one or more sparse features from the noise signal is selected for retention. After selecting the sparse features, a modified set of time series data is generated by combining the set of one or more sparse features with a set of one or more dense features from the plurality of dense features. At least one seasonal pattern is identified from the modified set of time series data. A summary for the seasonal pattern may then be generated and stored.

Abstract: Techniques are described for classifying seasonal patterns in a time series. In an embodiment, a set of time series data is decomposed to generate a noise signal and a dense signal. Based on the noise signal, a first classification is generated for a plurality of seasonal instances within the set of time series data, where each respective instance of the plurality of instances corresponds to a respective sub-period within the season and the first classification associates a first set of one or more instances from the plurality of instances with a particular class of seasonal pattern. Based on the dense signal, a second classification is generated that associates a second set of one or more instances with the particular class. Based on the first classification and the second classification, a third classification is generated, where the third classification associates a third set of one or more instances with the particular class.

Abstract: Techniques are described for generating period profiles. According to an embodiment, a set of time series data is received, where the set of time series data includes data spanning a plurality of time windows having a seasonal period. Based at least in part on the set of time-series data, a first set of sub-periods of the seasonal period is associated with a particular class of seasonal pattern. A profile for a seasonal period that identifies which sub-periods of the seasonal period are associated with the particular class of seasonal pattern is generated and stored, in volatile or non-volatile storage. Based on the profile, a visualization is generated for at least one sub-period of the first set of sub-periods of the seasonal period that indicates that the at least one sub-period is part of the particular class of seasonal pattern.

Abstract: Using and updating topological relationships amongst a set of nodes in event clustering is disclosed. A current event occurs on a current node. A first cluster of related events includes a first event, occurring on a first node, that is time-correlated with the current event. The first cluster does not include any event that is topologically-correlated with the current event based on the existing set of topological relationships. A level of interdependence is determined between (a) occurrence of events on the current node and (b) occurrence of events on the first node. Based on the level of interdependence, the current event is added to the first cluster. Further, an event-based topological relationship between the first node and the second node is added to the set of topological relationships. Subsequently, clustering for new events may be determined based on the event-based topological relationship between the first node and the second node.

Abstract: Techniques for artificial intelligence driven configuration management are described herein. In some embodiments, a machine-learning process determines a feature set for a plurality of deployments of a software resource. Based on varying values in the feature set, the process clusters each of the plurality of deployments into a cluster of a plurality of clusters. Each cluster of the plurality of clusters comprises one or more nodes and each node of the one or more nodes corresponds to at least a subset of values of the feature set that are detected in at least one deployment of the plurality of deployments of the software resource. The process determines a representative node for each cluster of the plurality of clusters. An operation may be performed based on the representative node for at least one cluster.