Abstract: A computer-implemented method includes receiving, by a processor, real time operation data related to an application, identifying components of the application based on the operation data, extracting relationships and interdependencies between the components, and generating a graph of the identified components, the relationships and the interdependencies. The method also includes determining one or more dynamic metrics of the identified components, the one or more dynamic metrics indicative of interactions between the components, extracting statistical information describing at least one of performance and resource consumption based on the operation data, incorporating the dynamic metrics into the graph, determining a behavior of at least one component based on a pattern of appearance of the at least one component in the graph, and generating a model of the application based on the identified components and the determined behaviors.

Abstract: A computer-implemented method, system, and non-transitory machine readable medium for a graph-based analysis for an Information Technology (IT) operations includes generating a temporal graph by extracting one or more of operation objects, relations and attributes from operation data of workloads distributed across a plurality of levels of the IT operation within a predetermined time window. Anomalies are detected from the extracted operation data and annotating corresponding objects in the graph. A directional impact between corresponding objects on the temporal graph is determined, and the temporal graph is refined based on the determined directional impact. Accessible paths in the temporal graph indicating error propagation are searched, and potential causes for the detected anomalies in the temporal graph are identified. A list of the potential causes of the anomalies is generated, and a root cause ranked for each of the corresponding objects in the temporal graph.

Abstract: A method and system for relation discovery from operation data includes classifying categories of extracted entities from operation data into three or more classes identified in a knowledge base. A log affiliation of the extracted entities is determined, and relations of the extracted entities are identified according to a log affiliation. The identified relations information of the extracted entities is associated with operation objects of the operation data.

Abstract: A method and system for operation objects discovery from operation data includes performing pattern matching of operation data with patterns in a database. Fields in the operation data are identified as having matching patterns with the database as first potential objects. Data profiling is performed on unmatched fields of the operation data to generate data profiles. The data profiles are field classified and second potential objects are generated. The first potential objects and the second potential objects are de-duplicated, and operation objects are generated.

Abstract: A system and method for attribute discovery for operation objects from operation data includes segmenting a name of each of a plurality of operation objects based on one or more special characters used in the name of each operation object. A similarity comparison of the operation objects is performed by extracting common subsequences from substrings in operation data in a same log as a target object, and a string similarity is computed of the extracted common subsequences. Numerical attributes are determined by calculating statistical metrics for fields in the log, and additional information of the operation objects is discovered based on the determined numerical attributes.

Abstract: A method, system, and computer program product, include extracting information related to one or more processes of one or more applications running on a virtual machine from a memory of the virtual machine, building at least one first application signature based on the extracted information, and identifying the one or more applications running on the virtual machine by matching the at least one first application signature with one or more second application signatures previously stored.

Abstract: Determining a characteristic of a configuration file that is used to discover configuration files in a target machine, a computer identifies, using information associated with a configuration item of a machine, a candidate configuration file related to the configuration item of the machine, from among a plurality of files from the machine. The computer extracts a value of a feature of the candidate configuration file and aggregates the candidate configuration file with a second candidate configuration file related to the same configuration item identified from among a plurality of files from a second machine, based on the extracted value. The computer then determines a configuration file related to the configuration item from among the aggregated candidate configuration files based on a result of the aggregation, and determines a characteristic of the configuration file related to the configuration item.

Abstract: A computer-implemented method is presented for detecting anomalies in dynamic datasets generated in a cloud computing environment. The method includes monitoring a plurality of cloud servers receiving a plurality of data points, employing a two-level clustering training module to generate micro-clusters from the plurality of data points, each of the micro-clusters representing a set of original data from the plurality of data points, employing a detecting module to detect normal data points, abnormal data points, and unknown data points from the plurality of data points via a detection model, employing an evolving module using a different evolving mechanism for each of the normal, abnormal, and unknown data points to evolve the detection model, and generating a system report displayed on a user interface, the system report summarizing the micro-cluster information.

Abstract: Embodiments facilitating performance anomaly detection are described. A computer-implemented method comprises: detecting, by a device operatively coupled to one or more processing units, based on monitoring data of a plurality of performance metrics of a monitored device, at least one trend within the monitoring data of the respective performance metrics; removing, by the device, the at least one trend from the monitoring data of the respective performance metrics to generate modified data of the respective performance metrics; and detecting, by the device, a performance anomaly based on the modified data of the respective performance metrics and a behavior clustering model comprising at least one steady state.

Abstract: Embodiments facilitating performance anomaly detection are described. A computer-implemented method comprises: detecting, by a device operatively coupled to one or more processing units, based on monitoring data of a plurality of performance metrics of a monitored device, at least one trend within the monitoring data of the respective performance metrics; removing, by the device, the at least one trend from the monitoring data of the respective performance metrics to generate modified data of the respective performance metrics; and detecting, by the device, a performance anomaly based on the modified data of the respective performance metrics and a behavior clustering model comprising at least one steady state.

Abstract: Embodiments are directed to a computer implemented method for generating a drift detector. The method includes generating, using a processor system, drift cases based at least in part on known drift set data of a computer system. The method further includes injecting, using the processor system, the drift cases into the computer system to generate a first data set. The method further includes applying, using the processor system, cleaning rules to the first data set to reduce a size of the first data set and generate a cleaned data set. The method further includes extracting one or more features of the cleaned data set. The method further includes normalizing the extracted one or more features of the cleaned data set. The method further includes training a machine learning system using the extracted and normalized one or more features of the cleaned data, wherein an output of the machine learning system comprises the drift detector.

Abstract: A computer-implemented method is presented for detecting anomalies in dynamic datasets generated in a cloud computing environment. The method includes monitoring a plurality of cloud servers receiving a plurality of data points, employing a two-level clustering training module to generate micro-clusters from the plurality of data points, each of the micro-clusters representing a set of original data from the plurality of data points, employing a detecting module to detect normal data points, abnormal data points, and unknown data points from the plurality of data points via a detection model, employing an evolving module using a different evolving mechanism for each of the normal, abnormal, and unknown data points to evolve the detection model, and generating a system report displayed on a user interface, the system report summarizing the micro-cluster information.

Abstract: Techniques for Bayesian-based event grouping are provided. One technique includes determining a group of alarm events from received alarm events; in response to the group of alarm events matching a group of historical alarm events, determining a first correlation, wherein the group of historical alarm events comprises correlated events associated with a same entity; and determining a root cause of the group of alarm events based on the first correlation.

Abstract: The present invention discloses the use of a benzopyran compound in the preparation of a product for regulating lipid metabolism, and a composition of the same, where the benzopyran compound includes petunidin-3-O-?-D glucoside and/or malvidin-3-O-?-D glucoside. It provides a new research direction for the preparation of the product for regulating lipid metabolism.

Abstract: The present invention provides a device including a sound detector and a noise cancellation component. In the operations of the device, the sound detector is configured to receive an environment sound obtained from a microphone, and determine if the environment sound has a meaningful signal or not to generate a detection result; and the noise cancellation component is configured to perform a noise cancellation operation based on the detection result to generate an output signal to a speaker.

Abstract: Techniques that facilitate identification and/or analysis of sequences associated with computing devices are provided. In one example, a system includes a transaction component, a clustering component and a model component. The transaction component identifies at least one sequence in a stream of sequences generated by a computing device in communication with the system. The clustering component assigns the at least one sequence to a transaction sequence group. The model component generates a transaction model based on the transaction sequence group.

Abstract: Embodiments facilitating performance anomaly detection are described. A computer-implemented method comprises: detecting, by a device operatively coupled to one or more processing units, based on monitoring data of a plurality of performance metrics of a monitored device, at least one trend within the monitoring data of the respective performance metrics; removing, by the device, the at least one trend from the monitoring data of the respective performance metrics to generate modified data of the respective performance metrics; and detecting, by the device, a performance anomaly based on the modified data of the respective performance metrics and a behavior clustering model comprising at least one steady state.

Abstract: A computer-implemented method is presented for automatically generating alerting rules. The method includes identifying, via offline analytics, abnormal patterns and normal patterns from history logs based on machine learning, statistical analysis and deep learning, the history logs stored in a history log database, automatically generating the alerting rules based on the identified abnormal and normal patterns, and transmitting the alerting rules to an alerting engine for evaluation. The method further includes receiving a plurality of online log messages from a plurality of computing devices connected to a network, augmenting the plurality of online log messages, and extracting information from the plurality of augmented online log messages to be provided to the alerting engine, the alerting engine configured to approve and enforce the alerting rules automatically generated by the offline analytics processing.

Abstract: A computer-implemented method is presented for detecting anomalies in dynamic datasets generated in a cloud computing environment. The method includes monitoring a plurality of cloud servers receiving a plurality of data points, employing a two-level clustering training module to generate micro-clusters from the plurality of data points, each of the micro-clusters representing a set of original data from the plurality of data points, employing a detecting module to detect normal data points, abnormal data points, and unknown data points from the plurality of data points via a detection model, employing an evolving module using a different evolving mechanism for each of the normal, abnormal, and unknown data points to evolve the detection model, and generating a system report displayed on a user interface, the system report summarizing the micro-cluster information.

Abstract: Techniques for log-based diagnosis for declarative-deployed applications can comprise: based on a labeled deployment declaration, classifying, by a device operatively coupled to a processor, a runtime log associated with an application, resulting in a classified runtime log. Techniques can also comprise: based on the classified runtime log, training, by the device, an aggregation model to represent a defined state of the application.