Abstract: Probable anomalies associated with at least one data metric may be detected across a series of windows of time series data by comparison of data to a threshold. An estimated probability of anomalies for each of the windows of time series data may be determined based on the detected probable anomalies and the threshold. The windows of time series data may be ranked based on the estimated probabilities. Probable anomalies associated with highest ranked windows of time series data may be output to a user.

Abstract: A method for event correlation includes capturing events and arranging the events sequentially in at least one dimension. An event correlator implemented by a computational device convolves a kernel density function with each of the events to produce a convolved function for each event. Co-occurrences between events are found by calculating overlap between convolved functions.

Abstract: Event determination can include selecting a time lag, calculating a dependency value at the time lag between event pairs within a first textual stream and a second textual stream, and ordering the event pairs based on the dependency value.

Abstract: Methods and devices are provided for data compression. Data compression can include receiving a plurality of data chunks, sampling at least some of the plurality of data chunks extracting a common portion from a number of the plurality of data chunks based on the sampling, and storing a remainder of the plurality of data chunks in memory.

Abstract: A similarity search initialization system includes a leaf selector to select a leaf of a suffix tree generated from a target string representing a target sequence. The selected leaf is associated with a prefix in the suffix tree having a longest match to a suffix of a query string representing a query. The system further includes a distance module to determine a distance between the query and a subsequence of the target sequence represented by a candidate substring of the target string. The candidate substring includes the prefix associated with the selected leaf. The determined distance is to provide an initial upper bound in a similarity search of the target sequence using the query.

Abstract: A joint image compression system and method compress a target image and a reference image under a selected transform to produce a compressed difference image. The joint image compression system includes a computer readable media and a computer program stored on the computer readable media. The computer program includes instructions that implement selecting a transform from among a plurality of transforms that includes a subset determined projective (SDP) transform, where the selected transform minimizes a cumulative mapping error (CME) for corresponding feature points in each of a target image and a reference image. The instructions further implement applying the selected transform to one of the target image and the reference image; forming a difference image under the selected transform and compressing the difference image to produce a compressed difference image.

Abstract: Event determination can include selecting a time lag, calculating a dependency value at the time lag between event pairs within a first textual stream and a second textual stream, and ordering the event pairs based on the dependency value.

Abstract: Systems and methods of anomaly detection in data centers. An example method may include analyzing time series data for the data center by testing statistical hypotheses. The method may also include constructing upper and lower bounds based on the statistical hypotheses. The method may also include flagging anomalies in the time series data falling outside of the upper and lower bounds.

Abstract: A system is disclosed comprising a non-transitory, computer-readable storage device storing software. The software, when executed by a processor, causes the processor to perform the following operations for each of a plurality of non-functional electronic devices: count a number of other non-functional electronic devices within a defined distance from the non-functional electronic device; and define the non-functional electronic device to be a core electronic device if the counted number is at least a threshold value, wherein threshold value is based on a total number of electronic devices within the defined distance around the non-functional electronic device. For each core electronic device, the software, when executed by a processor, further causes the processor to form a neighborhood group comprising the core electronic device and other non-functional electronic devices within the defined distance around the core electronic device.

Abstract: A method and apparatus are disclosed for identifying anomalies of a signal, by analyzing a signal using a frequency-based technique, analyzing results of the frequency-based analysis using a statistical analysis technique, determining one or more limits based on the statistical analysis, and comparing a frequency domain representation of the signal to the limits to identify anomalies of the signal.

Abstract: A similarity search initialization system includes a leaf selector to select a leaf of a suffix tree generated from a target string representing a target sequence. The selected leaf is associated with a prefix in the suffix tree having a longest match to a suffix of a query string representing a query. The system further includes a distance module to determine a distance between the query and a subsequence of the target sequence represented by a candidate substring of the target string. The candidate substring includes the prefix associated with the selected leaf. The determined distance is to provide an initial upper bound in a similarity search of the target sequence using the query.

Abstract: A lowest common ancestor of a first data sequence and a second data sequence is determined. Based on the lowest common ancestor, symbols that differ between the first data sequence and the second data sequence are identified. A distance between the first data sequence and the second data sequence is determined based on the symbols.

Abstract: Improving data clustering stability. A computer accesses a first plurality of cluster groups comprising data. The computer then applies a clustering method to the first plurality of cluster groups while adjusting said first plurality of cluster groups to be in higher agreement between themselves, thereby generating a second plurality of cluster groups that is in higher agreement between themselves than the first plurality of cluster groups. The second plurality of cluster groups corresponds to the first plurality of cluster groups.

Abstract: A method for constructing a histogram can include sampling attributes in a column of a database on a server and determining a bucket set for the histogram based on a number of buckets that represents a distribution of the attributes with minimum error. A bucket in the bucket set includes boundaries and an approximation of a count of attributes falling within the boundaries. The method further includes determining a precision for encoding the approximation, such that the histogram having the bucket set fits within a storage limit on a tangible computer-readable medium. The histogram can then be stored for the database on a tangible computer-readable medium by encoding the approximation with the precision.

Abstract: Methods and devices are provided for data compression. Data compression can include receiving a plurality of data chunks, sampling at least some of the plurality of data chunks extracting a common portion from a number of the plurality of data chunks based on the sampling, and storing a remainder of the plurality of data chunks in memory.

Abstract: Probable anomalies associated with at least one data metric may be detected across a series of windows of time series data by comparison of data to a threshold. An estimated probability of anomalies for each of the windows of time series data may be determined based on the detected probable anomalies and the threshold. The windows of time series data may be ranked based on the estimated probabilities. Probable anomalies associated with highest ranked windows of time series data may be output to a user.

Abstract: Systems and methods of anomaly detection in data centers. An example method may include analyzing time series data for the data center by testing statistical hypotheses. The method may also include constructing upper and lower bounds based on the statistical hypotheses. The method may also include flagging anomalies in the time series data falling outside of the upper and lower bounds.

Abstract: Systems and methods for detecting anomalies in a large scale and cloud datacenter are disclosed. Anomaly detection is performed in an automated, statistical-based manner by using a parametric Gini coefficient technique or a non-parametric Tukey technique. In the parametric Gini coefficient technique, sample data is collected within a look-back window. The sample data is normalized to generate normalized data, which is binned into a plurality of bins defined by bin indices. A Gini coefficient and a threshold are calculated for the look-back window and the Gini coefficient is compared to the threshold to detect an anomaly in the sample data. In the non-parametric Tukey technique, collected sample data is divided into quartiles and compared to adjustable Tukey thresholds to detect anomalies in the sample data.

Abstract: A joint image compression system (200, 300) and method (100) compress a target image and a reference image under a selected transform to produce a compressed difference image. The joint image compression system includes a computer readable media (210) and a computer program (220) stored on the computer readable media. The computer program includes instructions that implement selecting (110) a transform from among a plurality of transforms that includes a subset determined projective (SDP) transform, where the selected transform minimizes a cumulative mapping error (CME) for corresponding feature points in each of a target image (302) and a reference image (304). The instructions further implement applying (120) the selected transform to one of the target image and the reference image; forming (130) a difference image under the selected transform and compressing (140) the difference image to produce a compressed difference image.

Abstract: A method for constructing a histogram can include sampling attributes in a column of a database on a server and determining a bucket set for the histogram based on a number of buckets that represents a distribution of the attributes with minimum error. A bucket in the bucket set includes boundaries and an approximation of a count of attributes falling within the boundaries. The method further includes determining a precision for encoding the approximation, such that the histogram having the bucket set fits within a storage limit on a tangible computer-readable medium. The histogram can then be stored for the database on a tangible computer-readable medium by encoding the approximation with the precision.