Abstract: A generic instrumentation framework comprises two primary systems: an instrumentation generation system, and a runtime system. The instrumentation generation system creates an instrumentation generator that is specific to the system or subsystem to be instrumented. Preferably, the instrumentation generator is created by an instrumentation generation engine, which receives as input a system descriptor. The system descriptor is a set of metadata that comprise an interface specification. The instrumentation generation engine reads the system descriptor, identifies the target system, and selects an appropriate instrumentation generator. Using the system descriptor, the instrumentation generator then creates an instrumentation “package” comprising the actual instrumentation code itself (an executable) together with an instrumentation descriptor, which describes a set of one or more instrumentation points in the target system. The target system is then available to be instrumented with the instrumentation code.

Abstract: A method of detecting an intrusion into (or an anomaly in a behavior of) a target software system begins by instrumenting the target software system to generate behavior data representing a current observation or observation aggregate. The method then determines whether the current observation or observation aggregate warrants a second level examination; preferably, this determination is made by processing the current observation or observation aggregate through a first level detection algorithm that provides a first, provisional indication of a possible intrusion. If a result of executing the first level detection algorithm indicates that the current observation or observation aggregate warrants a second level examination, the method continues by processing the current observation or observation aggregate through at least one or more second level detection algorithms to provide a second, more definite, fine grain indication of a possible intrusion.

Abstract: A system and method for summarizing metric data in a semantically correct way. The system preferably comprises a distributed computing environment, i.e., an enterprise, which comprises a plurality of interconnected computer systems. At least one of the computer systems is an agent computer system which collects raw data relating to one or more metrics, i.e., measurements of system resources on the agent computer system. A Universal Data Repository (UEDR) receives a set of data points representing metric data from one or more agent computer systems. The UDR summarizes the set of data points into a more compact yet meaningful form. In summarization, the UDR determines a data type of the set of data points, applies a summarization rule according to the data type, and then creates a summarized data structure which corresponds to the set of data points. The summarization rule varies according to the semantics of the data type.

Abstract: A system and method for summarizing metric data with a plurality of levels of varying granularity. The system preferably comprises a distributed computing environment, i.e., an enterprise, which comprises a plurality of interconnected computer systems. At least one of the computer systems is an agent computer system which collects raw data relating to one or more metrics, i.e., measurements of system resources on the agent computer system. A Universal Data Repository (UDR) receives raw metric data from one or more agents. The UDR summarizes the raw data into a more compact yet meaningful form. The UDR can summarize both raw data and data that has previously been summarized one or more times, thus creating a plurality of levels of summarization. With each successive summarization, metric data become more compact, yet the data retain information and meaning.