Abstract: A monitoring system including a baseline model that automatically captures and models normal system behavior, a correlation model that employs multivariate autoregression analysis to detect abnormal system behavior, and an alarm service that weights and scores a variety of alerts to determine an alarm status and implement appropriate response actions. The baseline model decomposes the input variables into a number of components representing relatively predictable behaviors so that the erratic component e(t) may be isolated for further processing. These components include a global trend component, a cyclical component, and a seasonal component. Modeling and continually updating these components separately permits a more accurate identification of the erratic component of the input variable, which typically reflects abnormal patterns when they occur.

Abstract: Feature values, which may be multi-dimensional, collected over successive time slices, are efficiently processed for use, for example, in known adaptive learning functions and event detection. A Markov chain in a recursive function to calculate imputed values for data points by use of a “nearest neighbor” matrix. Only data for the time slices currently required to perform computations must be stored. Earlier data need not be retained. A data selector, referred to herein for convenience as a window driver, selects successive cells of appropriate adjacent values in one or more dimensions to comprise an estimation set. The window driver effectively indexes tables of data to efficiently deliver input data to the matrix. In one form, feature inputs are divided into subgroups for parallel, pipelined processing.

Abstract: This invention specifies analyzers to be run in conjunction with computer estimation systems, which may be applied to performance monitoring (APM) services. A semi-automated analyzer may be used by a human analyst to periodically evaluate available historical data for establishing a desired set of input measurements, model parameters, and reporting criteria, collectively called configuration parameters, to be used by an estimation system. In addition, a fully automated analyzer may periodically and automatically reevaluate such configuration parameters and automatically reconfigure the estimation system accordingly.

Abstract: A monitoring system including a baseline model that automatically captures and models normal system behavior, a correlation model that employs multivariate autoregression analysis to detect abnormal system behavior, and an alarm service that weights and scores a variety of alerts to determine an alarm status and implement appropriate response actions. The baseline model decomposes the input variables into a number of components representing relatively predictable behaviors so that the erratic component e(t) may be isolated for further processing. These components include a global trend component, a cyclical component, and a seasonal component. Modeling and continually updating these components separately permits a more accurate identification of the erratic component of the input variable, which typically reflects abnormal patterns when they occur.

Abstract: This invention specifies analyzers to be run in conjunction with computer estimation systems, which may be applied to performance monitoring (APM) services. A semi-automated analyzer may be used by a human analyst to periodically evaluate available historical data for establishing a desired set of input measurements, model parameters, and reporting criteria, collectively called configuration parameters, to be used by an estimation system. In addition, a fully automated analyzer may periodically and automatically reevaluate such configuration parameters and automatically reconfigure the estimation system accordingly.

Abstract: The present invention provides a system for learning from and responding to regularly arriving information at once by quickly combining prior information with concurrent trial information to produce useful learned information. A parallel embodiment of the system performs can perform updating operations for memory elements of matrix through the coordinated use of parallel feature processors and a joint access memory, which contains weighted values and provision for connecting feature processors pairwise. The parallel version also performs feature function monitoring, interpretation and refinement operations promptly and in concert with concurrent operation. A non-parallel embodiment of the system uses a single processor to perform the above operations however, more slowly than the parallel embodiment, yet faster than available alternatives.