Abstract: A computer system receives a set of messages, and processes the messages using a filter. In some examples, the filter is defined using a pattern matching language such as a regular expression. The system collects a set of representative messages that match the filter. Using the set of representative messages, the system generates a corresponding flow network graph. Using the flow network graph, the system determines a similarity measure that indicates whether a new message resembles other matching messages of the filter. Based on the similarity measure, in various embodiments, the system identifies potential errors in the filter definitions, omissions in the terms of the filter, and message outliers that indicate system anomalies or events of particular interest to the user.

Abstract: Systems and methods for monitoring and detecting parameters within a facility. The systems and methods include an actuator to adjust a position of a sensor device, the sensor device capable of gathering sensor data related to one or more parameters. The sensor device is in communication with a transmitter to transmit sensor data, a horizontal position, and a vertical position of the sensor device as it moves and gathers the sensor data. The data is assembled into a data structure showing the data throughout the facility for identification of abnormalities and adjustment of facility parameters.

Abstract: A real-time stream-based clustering algorithm is disclosed for correlating network impact according to time and space. The clustering algorithm operates at discrete time steps and produces a partitioning of a network graph such that each partition is a cluster. Clusters are tracked at each time step and the partitions can change by disappearing, splitting or merging with others. To track an incident over many clustering time steps, an ID is assigned to and related to previous clusters such that the same ID can propagate between multiple cluster time steps. Thus, a same incident can be tracked over time as its effect traverses the network. Anchor nodes can be assigned to the clusters to establish a relationship between clusters at different time steps.

Abstract: Directional capacity of interfaces for networking devices are dynamically modified. Network traffic utilization of one direction of a network interface may be determined. A modification to a capacity of the networking device to process network traffic in the one direction of the network may be determined. The modification may then be applied to the networking device so that subsequent network traffic is processed according to the modified capacity in the one direction of the interface.

Abstract: Cause and remediation data from one or more prior network incidents can be identified using a determined global similarity between these prior incidents and a current incident. Various network data can be collected, and data determined to potentially be relevant to a current incident can be selected or clustered into a single document or file. This document can have relevant features extracted, which can be used to generate a smaller numerical representation, or fingerprint, of the current incident. This fingerprint may be broken down into three categories of incident data, as may include general, topology, and alert categories. These categories of data can be compared for a current network incident and one or more prior incidents using their respective fingerprints, such as by using cosine similarity determinations. These values can be combined into global similarity values, which can be used to identify similar incidents as well as to provide visualization.

Abstract: Directional capacity of interfaces for networking devices are dynamically modified. Network traffic utilization of one direction of a network interface may be determined. A modification to a capacity of the networking device to process network traffic in the one direction of the network may be determined. The modification may then be applied to the networking device so that subsequent network traffic is processed according to the modified capacity in the one direction of the interface.

Abstract: An anomaly detection system is provided that obtains messages, log entries, or other information from computing resources in a distributed computing system. The messages may be compared to virtual messages generated during a training phase. The messages and the virtual messages may be compared using a spatial cosine similarity algorithm. A message may then be classified (e.g., as anomalous or not) based at least in part on the spatial cosine similarity between the message and the virtual message.