Abstract: Application data is received from a plurality of monitored applications. The application data is parsed into a plurality of features describing an operation of the plurality of monitored applications. A counter associated with at least one of the plurality of features is incremented. A system health is derived for the plurality of monitored applications from the counter.

Abstract: A report cost estimation module is used with cloud storage systems that store and process client data. Reports on the cloud stored client data take a significant amount of CPU, memory, storage and networking resources. A data analysis model dynamically estimates pricing for client data reports according to resource consumption by identifying a cluster group for the report and using the designated regression model for the cluster group. The data analysis can store the estimated and actual report costs and improve the estimated report costs using machine learning algorithms and crowed sourcing techniques. The report price is accurately provided to the client before running the report and thus allowing the customer to carefully manage a client report budget.

Abstract: At least part of an analytic process is executed on one or more data sets. Execution of the analytic process is performed within an analytic computing environment. During the course of execution of the analytic process, a data structure is generated comprising data structure elements. The data structure elements represent attributes associated with execution of the analytic process. Value is assigned to at least a portion of the data structure elements. The data structure generated during execution of the analytic process may be stored in an accessible catalog of other data structures generated during execution of other analytic processes.

Abstract: Methods and apparatus are provided for multi-site time series data analysis. An exemplary method comprises obtaining a plurality of vectors over a period of time, wherein each vector comprises a local health score from each of a plurality of distributed sites that perform operational analytics on time-series data; determining a distribution of the vectors during a training phase; and calculating a global health score for the plurality of distributed sites for a given vector during a prediction phase based on a distance of the given vector from a center of mass of the distribution. Feedback is optionally provided to individual sites, such as an indication of a local health score of an individual site relative to the global health score, and adjustments to thresholds and/or parameters used by the individual site.

Abstract: Data compression optimization based on client clusters is described. A system identifies a cluster of similar client devices in a group of client devices, by comparing data compression factors that correspond to each client device in the group of client devices. The system identifies a relationship between data compression factors corresponding to the cluster and data compression ratios corresponding to the cluster. The system identifies a client device, in the cluster, which corresponds to a data compression ratio that is inefficient relative to other compression ratios corresponding to other client devices in the cluster. The system outputs a data compression recommendation for the client device, based on data compression factors corresponding to the client device and the identified relationship between the data compression factors corresponding to the cluster and the data compression ratios corresponding to the cluster.

Abstract: Techniques are provided for sensor data compression in a multi-sensor Internet of Things environment. An exemplary method comprises obtaining sensor data from a plurality of sensors satisfying one or more of predefined sensor proximity criteria and predefined similar sensor type criteria; applying an image-based compression technique to the sensor data to generate compressed sensor data; and providing the compressed sensor data to a data center. The image-based compression technique comprises a discrete cosine transform technique, a video compression technique, and/or an auto-encoder deep learning technique that utilizes one or more over-fitted bidirectional recurrent convolutional neural networks. The sensor data is optionally normalized prior to being applied to the image-based compression technique.

Abstract: Techniques are provided for correcting sensor data in a multi-sensor environment. An exemplary method comprises obtaining sensor data from a first sensor; applying an anomaly detection technique to detect an anomaly in the sensor data from the first sensor based on additional sensor data from one or more of the first sensor and at least one additional sensor in proximity to the first sensor; and correcting the anomalous sensor data from the first sensor using additional sensor data from one or more of the first sensor and the at least one additional sensor. In some embodiments, additional sensor data from a plurality of neighboring sensors is used to predict the sensor data from the first sensor. The anomalous sensor data is optionally corrected substantially close in time to the detection of the anomaly in the sensor data.

Abstract: Techniques are provided for decompression of compressed log data, such as for a real-time viewing of compressed log data. An exemplary method comprises: obtaining a compressed log file comprised of a plurality of compressed log messages, wherein a given compressed log message is comprised of one or more message variables and a message signature corresponding to a message template of the given compressed log message; and presenting a first subset of the compressed log file by translating, in memory, the message templates of the compressed log messages within the first subset to corresponding message signatures using a decompression index that maps a plurality of the message signatures to corresponding message templates. The first subset of the compressed log file optionally comprises a predefined number of lines surrounding a requested line of the compressed log file. In further variations, at least one additional subset of the compressed log file is precomputed using the disclosed decompression techniques.

Abstract: Example embodiments of the present invention relate to a method, an apparatus, and a computer program product for predictive behavioral analytics for information technology (IT) operations. The method includes collecting key performance indicators from a plurality of data sources in a network. The method also includes performing predictive behavioral analytics on the collected data and reporting on results of the predictive behavioral analytics.

Abstract: Described are techniques that determine cumulative skew curves. A first model is determined that generates a predicted destination cumulative skew curve for a specified data set in a destination data storage system having a destination data movement granularity. The predicted destination cumulative skew curve is predicted by the first model in accordance with one or more inputs including a source cumulative skew curve for the specified data set in a source data storage system that uses a source data movement granularity. The source cumulative skew curve for the specified data set is determined based on observed data. First processing is performed using the first model. The first model generates as an output the predicted destination cumulative skew curve. The first processing includes providing the one or more inputs to the first model. Also described is how to generate the first model.

Abstract: Predicting individual drive failures is achieved using machine learning models of drive behavior history based on samples of SMART data attributes collected over distinct time-periods. The drive behavior history is a historical feature added to drive features modeled based on a last sample of SMART data attributes. The drive behavior history feature is used in successive modeling of drive behavior history to increase accuracy in predicting an individual drive's failure over time. Consecutive individual drive failure predictions are aggregated to further increase accuracy in predicting an individual drive's failure. In one embodiment, the system models drive behavior history and other drive features using a machine learning model. Individual drives classified as predicted to fail within a certain period of time are incorporated into a drive replacement strategy that factors in a field-based replacement cost associated with the drive.

Abstract: An apparatus comprises a processing platform configured to implement an analytic engine for evaluation of at least one of a converged infrastructure environment and one or more components of the converged infrastructure environment. The analytic engine comprises an extraction module configured to extract one or more features corresponding to the converged infrastructure environment, a learning and modeling module configured to predict an expected quantitative performance value of at least one of the converged infrastructure environment and the one or more components of the converged infrastructure environment based on the extracted one or more features, and comparison and ranking modules. The comparison module is configured to calculate a difference between an actual quantitative performance value of at least one of the converged infrastructure environment and the one or more components of the converged infrastructure environment and the expected quantitative performance value.

Abstract: An improved technique involves processing network traffic data to automatically establish whether a device on the network satisfies a particular set of constraints. Along these lines, a SIEM server observes and processes incoming and outgoing traffic data corresponding to a particular device at an address of the network. The SIEM server then analyzes this traffic data in order to determine whether the data satisfies a set of constraints satisfied by a client, or another set of constraints satisfied by a server. The SIEM server then applies the label of “client” or “server” to the device according to which set of constraints the SIEM server determines the data to have satisfied.