Abstract: A method for detecting computer issues includes identifying a target computer system. A first set of data for a first time period relating an operating metric from the target computer system are received. The operating metric is stored. A second set of data for a second time period relating to the operating metric is received. The first and second sets of data are compared. A difference between the two sets of data is identified. If the difference between the two sets of data is within a range a warning notification is displayed in a graphical user interface. An input is received in the graphical user interface in response to the warning notification being displayed.

Abstract: Values are attributed to components of a data analytics-driven system by representing the system as a computational graph. The computational graph embodies a function that takes one or more inputs and produces an output, and each component of the system is represented as a subgraph of the computational graph. A usage metric is calculated for each component of the system by determining whether the output of the function of the system is affected by the component. A utility metric is also calculated for each component of the system. Based on the calculated component usage metrics and utility metrics, respective value are allocated to the system components.

Abstract: The present invention relates to methods and apparatuses for securing otherwise unsecured computer communications that addresses the above shortcomings among others. According to certain aspects, the invention relates to methods and apparatuses for implementing device snooping, in which some or all traffic passing between a host and a connected device is captured into memory and analyzed in real time by system software. According to other aspects, the invention relates to real time capture of certain types of traffic and communication of the captured traffic to a remote management system. According to still further aspects, the invention relates to detecting security threats in real time. Upon threat detection, possible actions are blocking individual devices or alerting a system administrator. According to certain additional aspects, the security functions performed by methods and apparatuses according to the invention can be logically transparent to the upstream host and to the downstream device.

Abstract: A disclosed circuit arrangement includes a bus interface circuit and a configuration storage circuit coupled to the bus interface circuit. The bus interface circuit stores first error data in the configuration storage circuit in response to detection of an error condition. A second storage circuit provides storage of data, and an error re-logging circuit is coupled to the configuration storage circuit and to the second storage circuit. The error re-logging circuit polls the configuration storage circuit for the first error data signaling detection of an error, and in response to the first error data signaling detection of an error, stores the first error data in the second storage circuit, and clears the first error data from the configuration storage circuit to remove the signaling of the detection of the error.

Abstract: Embodiments of a device and method are disclosed. In an embodiment, a network interface device is disclosed. The device includes a network interface configured to provide an interface to a network, a functional component interface configured to provide an interface to a functional component, and distributed test logic located in a path between the network interface and the functional component interface and configured to manage test information related to testing of the functional component and to communicate test information between the network interface and the distributed test logic and between the functional component interface and the distributed test logic.

Abstract: Transaction operations may be graphed in order to determine performance compliance of transactions. An event to analyze transactions may be detected. Transactions to analyze for the event may be identified and a description of transaction operations for the identified transactions may be obtained. A graph of the transaction operations may be generated to indicate the dependencies between transactions and an evaluation of the graph may be performed to determine whether the transactions were performed with serializable isolation.

Abstract: Statistically significant event patterns predict the timing for performing entity maintenance. Event patterns are determined based on a target variable having an undesired value for a given entity when the event pattern occurs. Event patterns are filtered based on distributions of the event patterns across multiple entities and distributions of event patterns during desired operation of the entities and undesired operation of the entities. A predictive maintenance process is established having significant event patterns as the basis for maintenance tasks.

Abstract: Statistically significant event patterns predict the timing for performing entity maintenance. Event patterns are determined based on a target variable having an undesired value for a given entity when the event pattern occurs. Event patterns are filtered based on distributions of the event patterns across multiple entities and distributions of event patterns during desired operation of the entities and undesired operation of the entities. A predictive maintenance process is established having significant event patterns as the basis for maintenance tasks.

Abstract: This disclosure describes, in part, techniques for determining device groupings, or clusters, for multiple voice-enabled devices. The device clusters may be determined based on metadata data for audio signals (or audio data) generated by each of the multiple voice-enabled devices. For example, a remote system may analyze timestamp data for the audio signals received from the devices, and determine that the devices detected the same voice command of a user based on the timestamp data indicating that the audio signals were received within a threshold period of time from each other. Additionally, the remote system may analyze other metadata of the audio data, such as signal-to-noise (SNR) values, and determine that the SNR values are within a threshold value. The remote system may determine device clusters for the voice-enabled devices of a user based on these, and potentially other, types of metadata of the audio signals.

Abstract: A virtual machine hosting environment executing on a physical machine is operable to instantiate a virtual machine that is capable of initiating I/O operations directed to a remote storage. The virtual machine hosting environment is operable to determine when an unavailability condition exists with respect to the remote storage and when such unavailability condition no longer exists. The virtual machine hosting environment is further operable to suspend the virtual machine based at least on the determination that the unavailability condition exists and to resume the virtual machine based at least on the determination that the unavailability condition no longer exists. The virtual machine hosting environment may be still further operable to save one or more pending I/O requests generated by the virtual machine in conjunction with pausing the virtual machine and to send the pending I/O request(s) to the remote storage in conjunction with resuming the virtual machine.

Abstract: Techniques are provided for load balancing for IP failover. A backend address of a first node is identified as a routing destination to which a request is to be routed by a load balancer based upon a load balancer rule mapping a frontend address, specified by the request as a request destination, to the backend address of the first node. The request is routed to a primary network interface of the first node using the backend address. The first node has a loopback interface with an address matching the frontend address for routing the request to a destination data structure based upon the request maintaining the frontend address as the request destination. Health probes are used by the load balancer for detecting a failure of the first node in order to failover to routing requests to a second backend address of a second node.

Abstract: A computer security system includes a test management system and associated communication architecture that enables creation of customized tests of computer security application features. A server stores a test script in a custom scripting language. The test script includes a set of control statements that may be organized in a decision tree to control facilitation of the test. Clients poll the server to independently obtain and execute the control statements. Execution of the control statements control which clients participate in a test, which feature will be tested in the test, and what telemetry data will be collected from the clients to evaluate the test. The server evaluates the telemetry data to determine an outcome of the test and determines whether to further distribute or roll back the tested feature based on the test outcome. The testing can be utilized to rapidly and robustly deploy features that will enhance computer security.

Abstract: Dominant sequences that are representative of logged events can be artificially created. Initially, a graph comprising multiple nodes and edges between pairs of nodes is generated from logged information. The weights, or values, associated with edges are incremented as the log data reveals a temporal relationship between two nodes. Subsequently, a set of candidate trajectories, with each candidate trajectory representing a sequence of events, are generated by repeatedly traversing the generated graph in a random manner by commencing at randomly selected nodes and then proceeding in a random manner to subsequent nodes in accordance with the edge values, for a random quantity of steps. The candidate trajectories are filtered to eliminate those that are impossible or improbable based on a comparison between individual candidate trajectories and the quantity of occurrences within the logs. Scoring is based both on a quantity of occurrences as well as a quantity of steps.

Abstract: In a case where a job associated with a user has not been successfully stored in a job processing apparatus, it is not possible to exclusively notify the user that the job has not been successfully stored. A control method in a job processing apparatus includes storing a job such that the job is associated with a user, storing, identification information for identifying the user associated with a job that has not been successfully stored, and notifying the user that the job has not been stored according to login to the job processing apparatus, by the user, in a case where identification information for identifying the user having logged in to the job processing apparatus has been stored.

Abstract: Methods, systems, and computer-readable media for resource configuration based on dynamic group membership are disclosed. An association between a group of computing resources and an intended state is stored. The intended state represents a computing resource configuration. During operation of a computing resource, whether the computing resource belongs to the group of computing resources is determined based at least in part on analysis of one or more attributes associated with the computing resource. Based at least in part on determining that the computing resource belongs to the group of computing resources, one or more actions are caused be performed to bring the computing resource into the intended state. The computing resource is executed while having the computing resource configuration represented by the intended state.

Abstract: A method for classifying warning messages generated by software developer tools includes receiving a first data set. The first data set includes a first plurality of data entries, where each data entry is associated with a warning message generated based on a first set of software codes, includes indications for a plurality of features, and is associated with one of a plurality of class labels. A second data set is generated by sampling the first data set. Based on the second data set, at least one feature is selected from the plurality of features. A third data set is generated by filtering the second data set with the selected at least one feature. A machine learning classifier is determined based on the third data set. The machine learning classifier is used to classify a second warning message generated based on a second set of software codes to one of the plurality of class labels.

Abstract: Methods and apparatus consistent with the invention provide the ability to organize and build understandings of machine data generated by a variety of information-processing environments. Machine data is a product of information-processing systems (e.g., activity logs, configuration files, messages, database records) and represents the evidence of particular events that have taken place and been recorded in raw data format. In one embodiment, machine data is turned into a machine data web by organizing machine data into events and then linking events together.

Abstract: Embodiments include systems, methods, and computer program products for using a multi-tier hang buster for detecting and breaking out of hang conditions in a processor. One method includes determining a plurality of actions available at each of a plurality of tiers used for breaking out of the hang condition in the processor. The method also includes, after detecting the hang condition on a first thread of the processor, performing one or more actions available at a first tier of the plurality of tiers to break out of the hang condition. The method further includes, after performing the one or more actions at the first tier and determining that the hang condition is still present, performing one or more actions available at one or more second tiers of the plurality of tiers to break out of the hang condition.

Abstract: Conventional internet routing is handled using routing protocols such as the Border Gateway Protocol (BGP). However, simple BGP does not account for latency, packet loss, or cost. To address this problem, smart routing systems that route traffic fast and in a cost-effective manner are implemented. In one approach, smart routing systems measure, compare, and analyze round-trip latencies and other metrics between a customer premises and one or more endpoints. Optimal inbound and outbound transit providers are selected for each endpoint based on these measurements. Other smart routing systems collect and analyze Real User Monitoring (RUM) data to predict latency performance of different content origins for serving data to a particular client based on the client's IP address and the content origins' IP addresses, which are ranked by performance.

Abstract: A method is provided for collecting trace data items generated by a plurality of trace points, the method comprising: allocating a ring buffer in a first memory, the ring buffer including a plurality of trace buffers; when any of the trace points is executed, storing a trace data item generated by the trace point in one of the plurality of trace buffers that is identified by a given value of a ring pointer; retrieving the trace data item from the trace buffer based on at least one of: (i) a first timestamp that is generated when the trace data item is stored in the trace buffer, and (ii) a second timestamp indicating a time when the ring pointer was assigned the given value; and storing the retrieved trace data item in a second memory device.

Abstract: In one embodiment, a network device, includes at least one network interface port to serve as at least one ingress port for receiving network packets from a network and as at least one egress port for forwarding network packets to the network, a memory, control circuitry configured to monitor respective events in the network device, the respective events having respective event timestamps, and burst estimator logic to track respective rates of occurrence of ones of the events over respective time periods responsively to respective ones of the event timestamps, follow a maximum one of the rates of occurrence, store, in the memory, the maximum rate of occurrence, and find a measure of burstiness of the events responsively to the followed maximum rate of occurrence.

Abstract: The present disclosure provides for a system that dynamically adjusts how the system distributes messages to a set of consumers. The system measures a quantity of consumers in communication with the system. The system also measures performance metrics of each respective consumer of the set of consumers. In response to a change in the quantity of consumers, or to one or more performance metrics of an individual consumers meeting, or failing to meet, a respective predetermined threshold, the system may adjust a cache size the system attributes to the individual consumer and accordingly may adjust how the system distributes messages to the individual consumer. For instance, the system may distribute more or less messages to the individual consumer. The individual consumer may also communicate a maximum cache limit it is able to receive in messages from the system.

Abstract: In accordance with an embodiment, described herein are systems and methods for supporting slowly changing dimensions and metadata versioning in a multidimensional database, comprising. A system can comprise a computer that includes one or more microprocessors, and a multidimensional database server executing on the computer, wherein the multidimensional database server supports at least one hierarchical structure of data dimensions. A data dimension can slowly change over time. When such changes occur, metadata associated with the data dimension can be updated. Advantageously, a current snapshot of the data structure can allow searching of previous changes to the slowly changing dimension based upon the metadata.

Abstract: Technical solutions are described for hazard detection of out-of-order execution of load and store instructions without using real addresses in a processing unit. An example includes an out-of-order load-store unit (LSU) for transferring data between memory and registers. The LSU detects a store-hit-load (SHL) in an out-of-order execution of instructions based only on effective addresses by: determining an effective address associated with a store instruction; determining whether a load instruction entry using said effective address is present in a load reorder queue; and indicating that a SHL has been detected based at least in part on determining that load instruction entry using said effective address is present in the load reorder queue. The LSU, in response to detecting the SHL, flushes instructions starting from a load instruction corresponding to the load instruction entry.

Abstract: A building management system includes building equipment configured to operate in accordance with an input to alter a variable state or condition of a building, a feedback controller configured to generate the input as a function of a measured state of the building equipment, and an analytics circuit. The analytics circuit is configured to obtain and store a dataset comprising the measured state and the input for a plurality of time steps, determine, based on at least a portion of the dataset, a self-optimizing control function that defines a self-optimizing control variable as a function of the measured state, calculate a value of the self-optimizing control variable using the self-optimizing control function and the measured state, monitor the value of the self-optimizing control variable over time, and generate an indication of performance of the building equipment relative to optimal performance based on the value of the self-optimizing control variable.

Abstract: The disclosure describes a novel method and apparatus for improving interposers to include embedded monitoring instruments for real time monitoring digital signals, analog signals, voltage signals and temperature sensors located in the interposer. An embedded monitor trigger unit controls the starting and stopping of the real time monitoring operations. The embedded monitoring instruments are accessible via an 1149.1 TAP interface on the interposer.

Abstract: Approaches for post-synthesis insertion of debug cores include a programmed processor inputting data that identify signals of a synthesized circuit design to be probed and determining whether or not debug cores and interfaces needed to probe the signals are absent from the circuit design. The programmed processor creates, in response to determining that the debug cores and interfaces are absent, the debug cores and interfaces in the circuit design. The programmed processor couples the debug cores and interfaces to the signals in the circuit design and synthesizes the debug cores and interfaces created in the circuit design to create a modified circuit design. The method includes generating a circuit definition from the modified circuit design by the programmed processor, and implementing a circuit that operates according to the circuit definition.

Abstract: Systems, methods, and computer-readable media are provided for a multi-tenant collaborative learning environment, where information from all tenants in a multi-tenant system is collected and used to provide individual tenants with code fixes and/or optimization recommendations based on the collected information. Other embodiments may be described and/or claimed.

Abstract: A method of and system for identifying one or more outlier anomalies in a computer environment is carried out by collecting data from a computing environment, identifying a plurality of anomalies in the computing environment based in part on the collected data, grouping the plurality of anomalies into one or more clusters, and classifying each of the one or more clusters based on a plurality of dimensions. The method may also include assigning a weight to each dimension of the plurality of dimensions for each of the one or more clusters, aggregating the weights assigned to each dimension to calculate a score for each of the one or more clusters, and generating a ranking for each of the one or more clusters base in part on the calculated score. After the rankings are generated, one of the clusters may be identified as an outlier anomaly based on the rankings. The plurality of dimensions and the weights assigned to each dimension may be selected by employing machine-learning models.

Abstract: In an embodiment, a computer implemented method comprises at an internetworking device that is logically located in an edge position with respect to an internet protocol network and a plurality of industrial devices, receiving packet and frame data from a first computing device that is associated with an industrial system and communicates using a device-level Ethernet data communication protocol that does not define a management layer; at the internetworking device, generating an Operations, Administration, Management (OAM) header using, at least in part, the packet and frame data, wherein the OAM header comprises a device identifier, a data type, and a variable; encapsulating the packet and frame data with the OAM header to generate encapsulated packet and frame data; storing the encapsulated packet and frame data in a database; sending the encapsulated packet and frame data to a second internetworking device that is associated with the industrial system and communicates using the device-level Ethernet data

Abstract: A storage device and a method of operating the storage device are provided. The storage device includes a non-volatile memory including a plurality of non-volatile memory cells, a processor configured to control an operation of storing data received from a host in the non-volatile memory, a host interface configured to transmit and receive the data and control signals to and from the host, and a trace module. The trace module is configured to generate trace data for the processor or the host interface during an operation of the processor or the host interface and the trace module is configured to provide the trace data to the non-volatile memory.

Abstract: A system may collect, from a wireless network, first data pertaining to nodes in the wireless network. Each datum of the first data belongs to one of two or more categories/For each of the nodes, for each of the categories, and for each datum belonging to the category, the system may determine if the datum is outside of a first range of values, and if the datum is inside the first range, the system may calculate a first base network performance health (NPH) score that is a function of the nodes, the categories, the data, and time. The system may also apply first deep learning to a first neural network among a plurality of neural networks to update first coefficients for correlating the first base NPH score to a mean opinion score, for each of the categories.

Abstract: A semiconductor memory device and an operation method thereof that can accurately read setting information from a memory cell array when a power supply is turned on are provided. The flash memory includes a memory cell array, a detecting portion, a ROM and a control portion. The detecting portion detects that the power supply is turned on. The ROM stores at least a code for performing a reading operation of the memory cell array and stores a special code in a specific address. The control portion controls the reading of the ROM. When the detecting portion detects the power-on of the power supply, the control portion reads the special code from the ROM and determines whether the read special code is correct or not, reads the code if the determination is correct and again reads the special code if the determination is incorrect.

Abstract: Embodiments of the present disclosure relate to dynamically maintaining alarm thresholds for software application performance management. Other embodiments may be described and/or claimed.

Abstract: A method and apparatus for a mechanism of disaster recovery and instance refresh in an event recordation system are described. A first request for events associated with a first topic is received. A first set of events associated with the first topic are retrieved from a primary event recordation system. Each event from the first set of events includes a first commit identifier indicating the order with which each event is stored in the primary event recordation system. For each event from the first set of events a first replay identifier is determined based on the first commit identifier and a first value of a low commit identifier. The first replay identifier is exposed to event consumers for identifying the event. In response to the first request each event from the first set of events is transmitted with the replay identifier.

Abstract: Large batches of social media communications may be automatically annotated. This provides techniques to create large labeled datasets without the assistance of human labelers. For instance, social media communications may be fetched and annotated as actionable or noise for a given account (e.g., a brand handle on Twitter®) without human review. Social media communications from users who are attempting to engage with a brand or entity on a social media platform may be annotated as actionable, whereas other communications may be labeled as noise.

Abstract: A method and system or monitoring a resource consumption of an application running on a computer. A first metric describes the resource consumption of the application as a first function of time. A wavelet analysis of the first function of time is performed. A discontinuity in the first function is detected at a first time at which a coefficient determined from the wavelet analysis exceeds a specified threshold. A cross-correlation of the first metric and a second metric describing the resource consumption of the application as a second function of time are calculated. A diagnostic level associated with the discontinuity in the first function is adjusted based on the calculated cross-correlation. In response to adjusting the diagnostic level, a debugging function on the application is started in response to the cross correlation having a value indicative of an anomaly within the application.

Abstract: A method to diagnosis an electro-mechanical part on an image forming device comprising: determining an incident count for a first time interval for the electro-mechanical part; determining a first threshold level for the first time interval; monitoring the electro-mechanical part for a second time interval, wherein the second time interval is a plurality of first time intervals; determining if the incident count for a first portion of the second time interval for the electro-mechanical part equal to or less than the first threshold; determining if the incident count for a second portion of the second time interval for the electro-mechanical part is equal to or less than the first threshold when the incident count for the first portion of the second time interval fails to exceed the first threshold for the electro-mechanical part; determining a maximum incident count for the second portion of the second time interval when the incident count for the second portion of the second time interval exceeds the first t

Abstract: In some implementations, a computing device can determine the similarity of binary executables. For example, the computing device can receive an application, including a binary executable. The computing device can generate function signatures for the functions called within the binary executable. The computing device can generate a locality sensitive hash value for the application based on the function signatures. The computing device can group applications based on the locality sensitive hash value generated for each application. The computing device can compare the function signatures of the binary executables of the applications within a group to determine the similarity of the applications. If two applications have binary executables that are over a threshold percentage of similarity, the two applications can be identified as clones of each other.

Abstract: This disclosure describes, in part, techniques for determining device groupings, or clusters, for multiple voice-enabled devices. The device clusters may be determined based on metadata data for audio signals (or audio data) generated by each of the multiple voice-enabled devices. For example, a remote system may analyze timestamp data for the audio signals received from the devices, and determine that the devices detected the same voice command of a user based on the timestamp data indicating that the audio signals were received within a threshold period of time from each other. Additionally, the remote system may analyze other metadata of the audio data, such as signal-to-noise (SNR) values, and determine that the SNR values are within a threshold value. The remote system may determine device clusters for the voice-enabled devices of a user based on these, and potentially other, types of metadata of the audio signals.

Abstract: A system and computer-implemented method to manage alerts, wherein the method includes receiving anomaly triggers associated with detected anomalies, associating an anomaly trigger of the received anomaly triggers with an alert, tracking the alert using a state machine, determining whether to change a state of the state machine if a subsequent anomaly trigger associated with the alert is received or if a predetermined amount of time passes without receiving trigger information, and generating an alarm based on the state of the state machine.

Abstract: A system, method and program product for managing incidents in a complex IT environment. A system is described that includes: a discovery module that analyzes an IT infrastructure and generates a topology of components and users; a monitoring module that compares ongoing activities of the IT infrastructure with a pattern repository to identify potential problems; a relationship manager that generates relationship maps of components and users based on the topology, determines whether an identified potential problem comprises an incident, and in response to detecting an incident: correlates the incident with a root cause, and determines a responsible admin and set of impacted users based on the relationship maps; and an operation engine that notifies the responsible admin and set of impacted users of the incident.

Abstract: Runtime system statistics logging is dynamically controlled at code and application levels, based on user reviews. Logging of specific code components in specific application instances, identified based on user reviews, is automatically turned on, based on the user reviews indicating defects. Logging for other components or application instances, however, remains off or is automatically turned off.

Abstract: Methods and systems for optimizing a build order of component source modules comprises creating a dependency graph based on dependency information. Historical build information associated with previous build failures is then used to calculate relative failure factors for paths of the dependency graph; and the relative failure factors are used to determine an order of traversal of the dependency graph during a build process in which component binary modules are built from the component source modules.

Abstract: A method of data transfer in a cyber-protected system includes inserting a removable media device into a removable media interface of a Secure Media Exchange (SMX) kiosk running a cyber-checking algorithm. The SMX kiosk includes a user interface, physical controls, input and output ports. An enclosure for physical protection prevents access to the physical controls, input and output ports configured with openings revealing the removable media interface and user interface. The cyber-checking algorithm inspects the removable media device for threats and adds encryption to the removable media device only if passing inspecting. The cyber-protected system includes networked devices coupled to communicate over a communications network including at least one SMX protected machine at a protected system node having a SMX algorithm and an encryption key. The SMX algorithm allows reading information from the removable media device on the SMX protected machine only if the encryption is confirmed.

Abstract: Runtime system statistics logging is dynamically controlled at code and application levels, based on user reviews. Logging of specific code components in specific application instances, identified based on user reviews, is automatically turned on, based on the user reviews indicating defects. Logging for other components or application instances, however, remains off or is automatically turned off.

Abstract: Some embodiments of the invention provide a novel architecture for debugging devices. This architecture includes numerous devices that without user intervention automatically detect and report bug events to a set of servers that aggregate and process the bug events. When a device detects a potential bug event, the device in some embodiments generates a description of the potential bug event, and sends the generated description to the server set through a network. In addition to generating such a description, the device in some embodiments directs one or more of its modules to gather and store a collection of one or more data sets that are relevant to the potential bug event, in case the event has to be further analyzed by the server set. In the discussion below, the generated bug-event description is referred to as the event signature, while the gathered collection of data sets for an event is referred to as the event's data archive.

Abstract: A method of temporarily boosting knowledge record metrics in a knowledge management system during external event intervals may include receiving an event notification. The event notification may be associated with a time interval, and the event notification may be associated with an event. The method may also include identifying a record in a knowledge database. The record may be identified based on relevance to the event, the record may be associated with a metric, and the metric may be used to determine if the record is responsive to queries received by the knowledge management system. The method may additionally include adjusting the metric during the time interval such that the record is more likely to be responsive to user queries.

Abstract: The disclosed computer-implemented method for labeling automatically generated reports may include (i) identifying incident reports that describe incidents that each involve at least one computing system and that comprise automatically collected information about the incidents and a manually analyzed subset of incident reports that comprise manually generated information, (ii) assigning at least one label to at least one incident report in the manually analyzed subset based on applying a machine learning model to the manually generated information, (iii) deriving, from the automatically collected information, a set of features that describe incident reports, (iv) propagating at least one label from a labeled incident report to an incident report that is not in the manually analyzed subset and that comprises similar features with the labeled incident report, and (v) performing an action related to the label on the incident report. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method, system, and computer program product are provided for anomaly detection in a power system. The method includes receiving, by a processor-device, a plurality of measurements from a plurality of meters throughout the power system. The method also includes generating, by the processor-device, temporal causal networks based on pair-wise relationships between the plurality of measurements from the plurality of meters over time. The method additionally includes determining, by the processor-device, invariant relationships for the plurality of meters between the temporal causal networks. The method further includes predicting, by the processor-device, an anomaly from the invariant relationships for the plurality of meters with a residual anomaly threshold. The method also includes disabling one of the plurality of meters that originated the anomaly.