Abstract: A method may include calculating a cryptographic hash for each of a plurality of data blocks stored on a storage resource, calculating a locality-preserving hash for each of the plurality of data blocks, and performing clustering based on the locality-preserving hashes. The method may also include, for each particular cluster setting a cluster center data block for the particular cluster and for each particular data block of the particular cluster, storing the particular data block as a cluster member data block including a reference to the cluster center data block for the particular cluster, a list of differences of the particular data block from the cluster member data block, the cryptographic hash for the particular data block to identify the particular data block, and the locality-preserving hash for the particular data block for manipulation of the particular data block.

Abstract: A method for detecting an anomaly includes retrieving a log file that includes log entries, grouping the log entries into clusters of log entry types based on number of occurrences and average time interval, and discovering a sequence of the log entry types within each of the clusters. The sequence of the log entry types is based on a shortest path from a first one of the log entry types to a last one of the log entry types.

Abstract: A method may include calculating a cryptographic hash for each of a plurality of data blocks stored on a storage resource, calculating a locality-preserving hash for each of the plurality of data blocks, and performing clustering based on the locality-preserving hashes. The method may also include, for each particular cluster setting a cluster center data block for the particular cluster and for each particular data block of the particular cluster, storing the particular data block as a cluster member data block including a reference to the cluster center data block for the particular cluster, a list of differences of the particular data block from the cluster member data block, the cryptographic hash for the particular data block to identify the particular data block, and the locality-preserving hash for the particular data block for manipulation of the particular data block.

Abstract: An information handling system may include at least one processor, and a non-transitory memory communicatively coupled to the at least one processor. The information handling system may be configured to: receive a data stream of data points indicative of a parameter of a monitored system; determine local maxima and minima based on the data stream; determine relative amplitudes of the local maxima and minima based on an absolute value of differences between consecutive ones of the local maxima and minima; partition the relative amplitudes into a plurality of clusters; and determine at least one of the plurality of clusters as at least one noise cluster.

Abstract: A method for detecting an anomaly includes retrieving a log file that includes log entries, grouping the log entries into clusters of log entry types based on number of occurrences and average time interval, and discovering a sequence of the log entry types within each of the clusters. The sequence of the log entry types is based on a shortest path from a first one of the log entry types to a last one of the log entry types.

Abstract: A device operation anomaly identification and reporting system includes device that generates an operating metric data stream. A management system is coupled to the device and receives and analyzes the operating metric data stream. The management system identifies peaks present in the operating metric data stream, and determines a peak height and a peak area for each of the peaks. The management system then clusters the peaks into height clusters based on their heights, and clusters the peaks into area clusters based on their areas. The management system then defines an operating periodicity for the device based on the height clusters and area clusters, and when the management system detects an operating anomaly in the device using the operating periodicity defined for the device, it generates and transmits an operating anomaly alert that reports the operating anomaly in the device.

Abstract: A method and system for implementing histogram-based alarms in a production system. Specifically, the method and system disclosed herein entail generating histograms overlaid with frequency (i.e., number of data samples) based class policies to serve as data classifiers for measurements, metrics, or information produced by physical and/or logical sensors. The accurateness of histograms to represent distributions of data, however, may depend on certain constraints—one of which may be the number of intervals or buckets employed. Therefore, disclosed herein is also a methodology for identifying an optimal number of buckets, for particular sensor specific datasets, based on a maximum samples trend and an empty buckets trend associated with the datasets.

Abstract: A device operation anomaly identification and reporting system includes device that generates an operating metric data stream. A management system is coupled to the device and receives and analyzes the operating metric data stream. The management system identifies peaks present in the operating metric data stream, and determines a peak height and a peak area for each of the peaks. The management system then clusters the peaks into height clusters based on their heights, and clusters the peaks into area clusters based on their areas. The management system then defines an operating periodicity for the device based on the height clusters and area clusters, and when the management system detects an operating anomaly in the device using the operating periodicity defined for the device, it generates and transmits an operating anomaly alert that reports the operating anomaly in the device.

Abstract: An apparatus for comparing event data sets. A system and computer program for comparing event data sets comprising: calculating one or more derivatives for each event in a first and second set of events; classifying each event by the calculated derivatives; and evaluating a similarity of the first and second sets of events based on the classifications of the respective events.

Abstract: A method and apparatus for comparing event data sets. A method, system and computer program for comparing event data sets comprising: calculating one or more derivatives for each event in a first and second set of events; classifying each event by the calculated derivatives; and evaluating a similarity of the first and second sets of events based on the classifications of the respective events.

Abstract: A method and apparatus for comparing event data sets. A method, system and computer program for comparing event data sets comprising: calculating one or more derivatives for each event in a first and second set of events; classifying each event by the calculated derivatives; and evaluating a similarity of the first and second sets of events based on the classifications of the respective events.

Abstract: A method and apparatus for comparing event data sets. A method, system and computer program for comparing event data sets comprising: calculating one or more derivatives for each event in a first and second set of events; classifying each event by the calculated derivatives; and evaluating a similarity of the first and second sets of events based on the classifications of the respective events.