Abstract: Techniques for artificial intelligence driven configuration management are described herein. In some embodiments, a machine-learning process determines a feature set for a plurality of deployments of a software resource. Based on varying values in the feature set, the process clusters each of the plurality of deployments into a cluster of a plurality of clusters. Each cluster of the plurality of clusters comprises one or more nodes and each node of the one or more nodes corresponds to at least a subset of values of the feature set that are detected in at least one deployment of the plurality of deployments of the software resource. The process determines a representative node for each cluster of the plurality of clusters. An operation may be performed based on the representative node for at least one cluster.

Abstract: Systems and methods for performing unsupervised baselining and anomaly detection using time-series data are described. In one or more embodiments, a baselining and anomaly detection system receives a set of time-series data. Based on the set of time-series, the system generates a first interval that represents a first distribution of sample values associated with the first seasonal pattern and a second interval that represents a second distribution of sample values associated with the second seasonal pattern. The system then monitors a time-series signals using the first interval during a first time period and the second interval during a second time period. In response to detecting an anomaly in the first seasonal pattern or the second seasonal pattern, the system generates an alert.

Abstract: Techniques for machine-learning of long-term seasonal patterns are disclosed. In some embodiments, a network service receives a set of time-series data that tracks metric values of at least one computing resource over time. Responsive to receiving the time-series data, the network service detects a subset of metric values that are outliers and associated with a plurality of timestamps. The network service maps the plurality of timestamps to one or more encodings of at least one encoding space that defines a plurality of encodings for different seasonal patterns. Based on the mapped encodings, the network service generates a representation of a seasonal pattern. Based on the representation of the seasonal pattern, the network service may perform one or more operations in association with the at least one computing resource.

Abstract: Systems and methods are described for efficiently detecting an optimal number of behaviors to model software system performance data and the aspects of the software systems that best separate the behaviors. The behaviors may be ranked according to how well fitting functions partition the performance data.

Abstract: Techniques for training and evaluating seasonal forecasting models are disclosed. In some embodiments, a network service generates, in memory, a set of data structures that separate sample values by season type and season space. The set of data structures may include a first set of clusters corresponding to different season types in the first season space and a second set of clusters corresponding to different season types in the second season space. The network service merges two or more clusters the first set and/or second set of clusters. Clusters from the first set are not merged with clusters from the second set. After merging the clusters, the network serves determines a trend pattern for each of the remaining clusters in the first and second set of clusters. The network service then generates a forecast for a metric of a computing resource based on the trend patterns for each remaining cluster.

Abstract: Generating persistent multifaceted statistical distributions of event data associated with computing nodes is disclosed. From a data stream, events are identified that occur during a first time interval. Characteristics associated with the events are determined. Based on a primary characteristic, it is determined that an event corresponds to an event cluster. The event count for that cluster is incremented. It is determined that the characteristics correspond to an event descriptor of events in the cluster. Responsive to requests to view the event cluster, information about descriptors from the cluster are displayed indicating events having a particular event descriptor, or a summary of characteristics that distinguish the descriptor from other event descriptors.

Abstract: Techniques are described herein for scalable clustering of target resources by parameter set. In some embodiments, a plurality of parameter sets of varying length are received, where a parameter set identifies attributes of a target resource. A plurality of signature vectors are generated based on the plurality of parameter sets such that the signature vectors have equal lengths. A signature vector may map to one or more parameter sets of the plurality of parameter sets. A plurality of clusters are generated based on the similarity between signature vectors. Operations may be performed on a target resource based on one or more nodes in the plurality of clusters.

Abstract: Techniques for efficiently generating aggregate distribution approximations are disclosed. In some embodiments, a system receives a plurality of piecewise approximations that represent different distributions of a set of values on at least one computing resource. Based on the plurality of piecewise approximations, a set of clusters are generated, within volatile or non-volatile memory, that approximate an aggregate distribution of the set of metric values on the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to an aggregate piecewise approximation of a function for the set of metric values on the at least one computing resource.

Abstract: Systems and methods for performing unsupervised baselining and anomaly detection using time-series data are described. In one or more embodiments, a baselining and anomaly detection system receives a set of time-series data. Based on the set of time-series, the system generates a first interval that represents a first distribution of sample values associated with the first seasonal pattern and a second interval that represents a second distribution of sample values associated with the second seasonal pattern. The system then monitors a time-series signals using the first interval during a first time period and the second interval during a second time period. In response to detecting an anomaly in the first seasonal pattern or the second seasonal pattern, the system performs a responsive action, such as generating an alert.

Abstract: The present disclosure describes a flexible technique to learn patterns in time series data that recur over time. The patterns may be used for simulation, predicting future behavior, or detecting anomalies in a system in which the data is collected. The technique incrementally detects daily, weekly, monthly, and yearly patterns. Each pattern is built over time instead of requiring all the data to be available at the beginning of the analysis. Instead of modeling each pattern explicitly, each pattern is described in the context of a day and formed based on time series data collected over an entire day. An example use of the technique is detecting load patterns in a computer system. A metric of system load such as CPU utilization may be collected periodically over a day. The techniques presented herein capture multiple daily models, each representing a different load pattern.

Abstract: Techniques for generating distribution approximations with low memory footprints are disclosed. In some embodiments, a system receives a first set of values that measure one or more metrics of at least one computing resource. A set of clusters are generated, within volatile or non-volatile memory, that approximate a distribution of the first set of values measuring the one or more metrics of the at least one computing resource. The set of clusters is transformed, within volatile or non-volatile memory, to a piecewise approximation of a function for the first set of values.

Abstract: Techniques are described herein for scalable clustering of target resources by parameter set. In some embodiments, a plurality of parameter sets of varying length are received, where a parameter set identifies attributes of a target resource. A plurality of signature vectors are generated based on the plurality of parameter sets such that the signature vectors have equal lengths. A signature vector may map to one or more parameter sets of the plurality of parameter sets. A plurality of clusters are generated based on the similarity between signature vectors. Operations may be performed on a target resource based on one or more nodes in the plurality of clusters.

Abstract: Techniques are described herein for scalable clustering of target resources by parameter set. In some embodiments, a plurality of parameter sets of varying length are received, where a parameter set identifies attributes of a target resource. A plurality of signature vectors are generated based on the plurality of parameter sets such that the signature vectors have equal lengths. A signature vector may map to one or more parameter sets of the plurality of parameter sets. A plurality of clusters are generated based on the similarity between signature vectors. Operations may be performed on a target resource based on one or more nodes in the plurality of clusters.

Abstract: Techniques for analyzing, understanding, and remediating differences in configurations among many software resources are described herein. Machine learning processes are applied to determine a small feature set of parameters from among the complete set of parameters configured for each software resource. The feature set of parameters is selected to optimally cluster configuration instances for each of the software resources. Once clustered based on the values of the feature set of parameters, a graph is generated for each cluster of configuration instances that depicts the differences among the configuration instances within the cluster. An interactive visualization tool renders the graph in a user interface, and a management tool allows changes to the graph and changes to the configuration of one or more software resources.

Abstract: Techniques are described herein for scalable clustering of target resources by parameter set. In some embodiments, a plurality of parameter sets of varying length are received, where a parameter set identifies attributes of a target resource. A plurality of signature vectors are generated based on the plurality of parameter sets such that the signature vectors have equal lengths. A signature vector may map to one or more parameter sets of the plurality of parameter sets. A plurality of clusters are generated based on the similarity between signature vectors. Operations may be performed on a target resource based on one or more nodes in the plurality of clusters.

Abstract: Techniques for artificial intelligence driven configuration management are described herein. In some embodiments, a machine-learning process determines a feature set for a plurality of deployments of a software resource. Based on varying values in the feature set, the process clusters each of the plurality of deployments into a cluster of a plurality of clusters. Each cluster of the plurality of clusters comprises one or more nodes and each node of the one or more nodes corresponds to at least a subset of values of the feature set that are detected in at least one deployment of the plurality of deployments of the software resource. The process determines a representative node for each cluster of the plurality of clusters. An operation may be performed based on the representative node for at least one cluster.

Abstract: Techniques are described for applying what-f analytics to simulate performance of computing resources in cloud and other computing environments. In one or more embodiments, a plurality of time-series datasets are received including time-series datasets representing a plurality of demands on a resource and datasets representing performance metrics for a resource. Based on the datasets at least one demand propagation model and at least one resource prediction model are trained. Responsive to receiving an adjustment to a first set of one or more values associated with a first demand: (a) a second adjustment is generated for a second set of one or more values associated with a second demand; and (b) a third adjustment is generated for a third set of one or more values that is associated with the resource performance metric.

Abstract: Techniques are described for generating predictive alerts. In one or more embodiments, a seasonal model is generated, the seasonal model representing one or more seasonal patterns within a first set of time-series data, the first set of time-series data comprising data points from a first range of time. A trend-based model is also generated to represent trending patterns within a second set of time-series data comprising data points from a second range of time that is different than the first range of time. A set of forecasted values is generated based on the seasonal model and the trend-based model. Responsive to determining that a set of alerting thresholds has been satisfied based on the set of forecasted values, an alert is generated.

Abstract: Techniques are described for optimizing scalability of analytics that use time-series models. In one or more embodiments, a stored time-series model includes a plurality of data points representing seasonal behavior in a training set of time-series data for at least one season. A target time for evaluating the time-series model is then determined, and the target time or one or more times relative to the target time are mapped to a subset of the plurality of data points. Based on the mapping, a trimmed version of the time-series model is generated by loading the subset of the plurality of data points into a cache, the subset of data points representing seasonal behavior in the training set of time-series data for a portion of the at least one season. A target set of time-series data may be evaluated suing the trimmed version of the time-series in the cache.

Abstract: Systems and methods for performing unsupervised baselining and anomaly detection using time-series data are described. In one or more embodiments, a baselining and anomaly detection system receives a set of time-series data. Based on the set of time-series, the system generates a first interval that represents a first distribution of sample values associated with the first seasonal pattern and a second interval that represents a second distribution of sample values associated with the second seasonal pattern. The system then monitors a time-series signals using the first interval during a first time period and the second interval during a second time period. In response to detecting an anomaly in the first seasonal pattern or the second seasonal pattern, the system generates an alert.