Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: The present disclosure provides a method, system and non-transient computer readable medium for evaluating system behaviour by deriving a statistical distance between each entity in a multi-entity system, and summing the statistical distance to each other entity to create a ranked abnormality score for each entity in the system.

Abstract: In some examples, a first pair of parameters in respective first and second log message streams associated with respective first and second source components and a second pair of parameters in the respective first and second log message streams may be identified. The first pair may be identical and the second pair may be identical. It may be determined that first pair of parameters was simultaneously generated and that the second pair of parameters was simultaneously generated in the first and in the second log message streams. A linkage score may be determined between the first and the second source components. The linkage score may be based on the determination that each of the respective first and the second pairs of parameters was simultaneously generated. It may be determined that that the first and second source components are topologically linked based on the linkage score.

Abstract: Event-time pairs are received for a current time slot. Each event-time pair denotes the occurrence of an event at a system by an event type as well as an occurrence time. For each different event type, a property value for the time slot is computed for each different property of a number of different properties, from the event-time pairs having the different event type. For each different property, a time-decaying histogram of identified property values of the different property is updated using the property value computed for the different property for the current time slot. An anomaly score for each identified property value within the time-decaying histogram of each different property is computed to detect occurrence of an anomaly within the system.

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

Abstract: In some examples, host IDs associated with the respective source component and a result of a partial calculation of an aggregate metric score may be received from each of a plurality of source components associated with a host of an information technology (IT) system. The partial calculation based on individual metric scores may be associated with the respective source component. The aggregate metric score may be calculated using the partial calculations and the host IDs, the aggregate metric score associated with metric measurements of the source components.

Abstract: The present disclosure provides a method, system and non-transient computer readable medium for evaluating system behaviour by deriving a statistical distance between each entity in a multi-entity system, and summing the statistical distance to each other entity to create a ranked abnormality score for each entity in the system.

Abstract: A current measurement receipt interval is computed as a difference between a current receipt time of a current measurement from a sensor and a previous receipt time of a previous measurement from the sensor. An expected measurement receipt interval is estimated, based on a lowest mode of measurement receipt intervals including the computed current measurement receipt interval.

Abstract: Event-time pairs are received for a current time slot. Each event-time pair denotes the occurrence of an event at a system by an event type as well as an occurrence time. For each different event type, a property value for the time slot is computed for each different property of a number of different properties, from the event-time pairs having the different event type. For each different property, a time-decaying histogram of identified property values of the different property is updated using the property value computed for the different property for the current time slot. An anomaly score for each identified property value within the time-decaying histogram of each different property is computed to detect occurrence of an anomaly within the system.

Abstract: In some examples, a first pair of parameters in respective first and second log message streams associated with respective first and second source components and a second pair of parameters in the respective first and second log message streams may be identified. The first pair may be identical and the second pair may be identical. It may be determined that first pair of parameters was simultaneously generated and that the second pair of parameters was simultaneously generated in the first and in the second log message streams. A linkage score may be determined between the first and the second source components. The linkage score may be based on the determination that each of the respective first and the second pairs of parameters was simultaneously generated. It may be determined that that the first and second source components are topologically linked based on the linkage score.

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

Abstract: Determining term scores based on a modified inverse domain frequency is disclosed. One example is a system including a data processing engine, an evaluator, and a data analytics module. The data processing engine identifies a key term associated with a system, and a sub-plurality of a plurality of documents, the sub-plurality of documents associated with the event. The evaluator determines, based on the presence or absence of the key term, a first distribution related to the sub-plurality of documents, and a second distribution related to the plurality of documents, and evaluates, for the key term, a term score based on the first distribution and the second distribution, the term score indicative of a modified inverse domain frequency based on the sub-plurality of documents. The data analytics module includes the key term in a word cloud when the term score for the key term satisfies a threshold.

Abstract: An interactive system to detect malware is provided to interactively analyze web proxy log data. The log data is progressively processed to compute analytics for different context settings. The system has a context module, an interaction module and a plurality of analytics modules. When a change of the context setting (filter, weights etc.) is requested, the processing and calculation of analytics for the current context setting is paused and subsequently restarted for the now changed context setting. An analytics interface provided via a graphical user interface is updated upon the change of context settings.

Abstract: A signal from a system, such as a reactive system, that reflects health indicators of the system may be selected. A signal analyzer may extract the health indicators from the signal and conduct a diagnostics of the health of the system based on the health indicators.

Abstract: A designer-adaptive visual code (32, 32?, 32?) includes a user-selected set glyphs (36, 36?, 36?, 36??), a user-selected set of allowable glyph orientations relative to a user-selected reference angle, and a user-selected spatial arrangement of the glyphs (36, 36?, 36?, 36??). The user-selected set of glyphs (36, 36?, 36?, 36??) has a size sufficient to recover geometric characteristics of at least one repeating code portion so as to generate an analyzable image when captured via a camera-equipped mobile device (26). The user-selected spatial arrangement of the glyphs (36, 36?, 36?, 36??) includes the at least one repeating code portion (34) to be visible on a surface from at least two different areas of the surface.

Abstract: A signal from a system, such as a reactive system, that reflects health indicators of the system may be selected. A signal analyzer may extract the health indicators from the signal and conduct a diagnostics of the health of the system based on the health indicators.

Abstract: Data streams that can be related to operation tracing and/or performance indications, for example, may be monitored. The data streams can have different dynamic statistical characteristics including static signal distributions and non-static signal distributions with respect to time. The data streams may be analyzed independent of any predetermined assumptions on statistical behavior and on changes in the statistical behavior. Data may be transformed into a set of key performance indicators and performance-change indicators that are adaptive to instantaneous statistical changes.