Abstract: Techniques are described herein for scalable clustering of target resources by parameter set. In some embodiments, a plurality of parameter sets of varying length are received, where a parameter set identifies attributes of a target resource. A plurality of signature vectors are generated based on the plurality of parameter sets such that the signature vectors have equal lengths. A signature vector may map to one or more parameter sets of the plurality of parameter sets. A plurality of clusters are generated based on the similarity between signature vectors. Operations may be performed on a target resource based on one or more nodes in the plurality of clusters.

Abstract: Techniques for efficiently generating aggregate distribution approximations are disclosed. In some embodiments, a system receives a plurality of piecewise approximations that represent different distributions of a set of values on at least one computing resource. Based on the plurality of piecewise approximations, a set of clusters are generated, within volatile or non-volatile memory, that approximate an aggregate distribution of the set of metric values on the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to an aggregate piecewise approximation of a function for the set of metric values on the at least one computing resource.

Abstract: Systems and methods for performing unsupervised baselining and anomaly detection using time-series data are described. In one or more embodiments, a baselining and anomaly detection system receives a set of time-series data. Based on the set of time-series, the system generates a first interval that represents a first distribution of sample values associated with the first seasonal pattern and a second interval that represents a second distribution of sample values associated with the second seasonal pattern. The system then monitors a time-series signals using the first interval during a first time period and the second interval during a second time period. In response to detecting an anomaly in the first seasonal pattern or the second seasonal pattern, the system performs a responsive action, such as generating an alert.

Abstract: Techniques for generating distribution approximations with low memory footprints are disclosed. In some embodiments, a system receives a first set of values that measure one or more metrics of at least one computing resource. A set of clusters are generated, within volatile or non-volatile memory, that approximate a distribution of the first set of values measuring the one or more metrics of the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to a piecewise approximation of a function for the first set of values.

Abstract: The present disclosure describes a flexible technique to learn patterns in time series data that recur over time. The patterns may be used for simulation, predicting future behavior, or detecting anomalies in a system in which the data is collected. The technique incrementally detects daily, weekly, monthly, and yearly patterns. Each pattern is built over time instead of requiring all the data to be available at the beginning of the analysis. Instead of modeling each pattern explicitly, each pattern is described in the context of a day and formed based on time series data collected over an entire day. An example use of the technique is detecting load patterns in a computer system. A metric of system load such as CPU utilization may be collected periodically over a day. The techniques presented herein capture multiple daily models, each representing a different load pattern.

Abstract: Techniques are described herein for scalable clustering of target resources by parameter set. In some embodiments, a plurality of parameter sets of varying length are received, where a parameter set identifies attributes of a target resource. A plurality of signature vectors are generated based on the plurality of parameter sets such that the signature vectors have equal lengths. A signature vector may map to one or more parameter sets of the plurality of parameter sets. A plurality of clusters are generated based on the similarity between signature vectors. Operations may be performed on a target resource based on one or more nodes in the plurality of clusters.

Abstract: Techniques are described herein for scalable clustering of target resources by parameter set. In some embodiments, a plurality of parameter sets of varying length are received, where a parameter set identifies attributes of a target resource. A plurality of signature vectors are generated based on the plurality of parameter sets such that the signature vectors have equal lengths. A signature vector may map to one or more parameter sets of the plurality of parameter sets. A plurality of clusters are generated based on the similarity between signature vectors. Operations may be performed on a target resource based on one or more nodes in the plurality of clusters.

Abstract: Techniques for analyzing, understanding, and remediating differences in configurations among many software resources are described herein. Machine learning processes are applied to determine a small feature set of parameters from among the complete set of parameters configured for each software resource. The feature set of parameters is selected to optimally cluster configuration instances for each of the software resources. Once clustered based on the values of the feature set of parameters, a graph is generated for each cluster of configuration instances that depicts the differences among the configuration instances within the cluster. An interactive visualization tool renders the graph in a user interface, and a management tool allows changes to the graph and changes to the configuration of one or more software resources.

Abstract: Using and updating topological relationships amongst a set of nodes in event clustering is disclosed. A current event occurs on a current node. A first cluster of related events includes a first event, occurring on a first node, that is time-correlated with the current event. The first cluster does not include any event that is topologically-correlated with the current event based on the existing set of topological relationships. A level of interdependence is determined between (a) occurrence of events on the current node and (b) occurrence of events on the first node. Based on the level of interdependence, the current event is added to the first cluster. Further, an event-based topological relationship between the first node and the second node is added to the set of topological relationships. Subsequently, clustering for new events may be determined based on the event-based topological relationship between the first node and the second node.

Abstract: Techniques are described for characterizing and summarizing seasonal patterns detected within a time series. According to an embodiment, a set of time series data is analyzed to identify a plurality of instances of a season, where each instance corresponds to a respective sub-period within the season. A first set of instances from the plurality of instances are associated with a particular class of seasonal pattern. After classifying the first set of instances, a second set of instances may remain unclassified or otherwise may not be associated with the particular class of seasonal pattern. Based on the first and second set of instances, a summary may be generated that identifies one or more stretches of time that are associated with the particular class of seasonal pattern. The one or more stretches of time may span at least one sub-period corresponding to at least one instance in the second set of instances.

Abstract: Techniques are described for characterizing and summarizing seasonal patterns detected within a time series. A set of time series data is analyzed to identify a plurality of instances of a season, where each instance corresponds to a respective sub-period within the season. A first set of instances from the plurality of instances are associated with a particular class of seasonal pattern. After classifying the first set of instances, a second set of instances may remain unclassified or otherwise may not be associated with the particular class of seasonal pattern. Based on the first and second set of instances, a summary may be generated that identifies one or more stretches of time that are associated with the particular class of seasonal pattern. The one or more stretches of time may span at least one sub-period corresponding to at least one instance in the second set of instances.

Abstract: Techniques are described herein for scalable clustering of target resources by parameter set. In some embodiments, a plurality of parameter sets of varying length are received, where a parameter set identifies attributes of a target resource. A plurality of signature vectors are generated based on the plurality of parameter sets such that the signature vectors have equal lengths. A signature vector may map to one or more parameter sets of the plurality of parameter sets. A plurality of clusters are generated based on the similarity between signature vectors. Operations may be performed on a target resource based on one or more nodes in the plurality of clusters.

Abstract: Techniques are described for characterizing and summarizing seasonal patterns detected within a time series. A set of time series data is analyzed to identify a plurality of instances of a season, where each instance corresponds to a respective sub-period within the season. A first set of instances from the plurality of instances are associated with a particular class of seasonal pattern. After classifying the first set of instances, a second set of instances may remain unclassified or otherwise may not be associated with the particular class of seasonal pattern. Based on the first and second set of instances, a summary may be generated that identifies one or more stretches of time that are associated with the particular class of seasonal pattern. The one or more stretches of time may span at least one sub-period corresponding to at least one instance in the second set of instances.

Abstract: Techniques are described for modeling variations in correlation to facilitate analytic operations. In one or more embodiments, at least one computing device receives first metric data that tracks a first metric for a first target resource and second metric data that tracks a second metric for a second target resource. In response to receiving the first metric data and the second metric data, the at least one computing device generates a time-series of correlation values that tracks correlation between the first metric and the second metric over time. Based at least in part on the time-series of correlation data, an expected correlation is determined and compared to an observed correlation. If the observed correlation falls outside of a threshold range or otherwise does not satisfy the expected correlation, then an alert and/or other output may be generated.

Abstract: Techniques for artificial intelligence driven configuration management are described herein. In some embodiments, a machine-learning process determines a feature set for a plurality of deployments of a software resource. Based on varying values in the feature set, the process clusters each of the plurality of deployments into a cluster of a plurality of clusters. Each cluster of the plurality of clusters comprises one or more nodes and each node of the one or more nodes corresponds to at least a subset of values of the feature set that are detected in at least one deployment of the plurality of deployments of the software resource. The process determines a representative node for each cluster of the plurality of clusters. An operation may be performed based on the representative node for at least one cluster.

Abstract: Techniques are described for modeling variations in correlation to facilitate analytic operations. In one or more embodiments, at least one computing device receives first metric data that tracks a first metric for a first target resource and second metric data that tracks a second metric for a second target resource. In response to receiving the first metric data and the second metric data, the at least one computing device generates a time-series of correlation values that tracks correlation between the first metric and the second metric over time. Based at least in part on the time-series of correlation data, an expected correlation is determined and compared to an observed correlation. If the observed correlation falls outside of a threshold range or otherwise does not satisfy the expected correlation, then an alert and/or other output may be generated.

Abstract: Techniques are described for generating period profiles. According to an embodiment, a set of time series data is received, where the set of time series data includes data spanning a plurality of time windows having a seasonal period. Based at least in part on the set of time-series data, a first set of sub-periods of the seasonal period is associated with a particular class of seasonal pattern. A profile for a seasonal period that identifies which sub-periods of the seasonal period are associated with the particular class of seasonal pattern is generated and stored, in volatile or non-volatile storage. Based on the profile, a visualization is generated for at least one sub-period of the first set of sub-periods of the seasonal period that indicates that the at least one sub-period is part of the particular class of seasonal pattern.

Abstract: Techniques are described for applying what-f analytics to simulate performance of computing resources in cloud and other computing environments. In one or more embodiments, a plurality of time-series datasets are received including time-series datasets representing a plurality of demands on a resource and datasets representing performance metrics for a resource. Based on the datasets at least one demand propagation model and at least one resource prediction model are trained. Responsive to receiving an adjustment to a first set of one or more values associated with a first demand: (a) a second adjustment is generated for a second set of one or more values associated with a second demand; and (b) a third adjustment is generated for a third set of one or more values that is associated with the resource performance metric.

Abstract: Techniques are described for generating period profiles. According to an embodiment, a set of time series data is received, where the set of time series data includes data spanning a plurality of time windows having a seasonal period. Based at least in part on the set of time-series data, a first set of sub-periods of the seasonal period is associated with a particular class of seasonal pattern. A profile for a seasonal period that identifies which sub-periods of the seasonal period are associated with the particular class of seasonal pattern is generated and stored, in volatile or non-volatile storage. Based on the profile, a visualization is generated for at least one sub-period of the first set of sub-periods of the seasonal period that indicates that the at least one sub-period is part of the particular class of seasonal pattern.

Abstract: Techniques are described for performing cluster analysis on a set of data points using tri-point arbitration. In one embodiment, a first cluster that includes a set of data points is generated within volatile and/or non-volatile storage of a computing device. A set of tri-point arbitration similarity values are computed where each similarity value in the set of similarity values corresponds to a respective data point pair and is computed based, at least in part, on a distance between the respective data point pair and a set of one or more arbiter data points. The first cluster is partitioned within volatile and/or non-volatile storage of the computing device into a set of two or more clusters. A determination is made, based at least in part on the set of similarity values in the tri-arbitration similarity matrix, whether to continue partitioning the set of data points.