# US 10,120,746 B1 · Throttling system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,120,746 B1
- Document ID: US10120746B1
- Status: Granted
- Kind: B1
- Application number: 15/182,439
- Filed: 2016-06-14
- Granted: 2018-11-06
- Earliest claimed: 2016-06-14
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Nima Sharifi Mehr
- Web page: https://patentgrep.com/patent/US10120746B1

## CPC

- G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)}
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/076: {by exceeding a count or rate limit, e.g. word- or bit count limit}
- G06F 11/0778: {Dumping, i.e. gathering error/state information after a fault for later diagnosis}
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- G06F 11/0781: {Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The flow of events though an event-analysis system is controlled by a number of event throttles which filter events, prioritize events and control the rate at which events are provided to event-processing components of the event-analysis system. Incoming events to the event-analysis system are associated with a profile, and a metrics engine generates metrics based on the incoming events for each profile. The flow of events to the metrics engine is controlled on a per profile basis, so that excessive generation of new metrics and new profiles is limited. If the system from which the events originate is compromised, metrics associated with compromised profiles may be frozen to avoid corrupting existing metrics. Processing of events and anomalies by analysis engines within the event-analysis system may be delayed to allow the accumulation of metrics necessary for accurate analysis.

## Claims

### Claim 1

A computer-implemented method, comprising:
receiving an event stream from a system being monitored;
providing, to a metrics engine, an event from the event stream via an event queue;
identifying a profile associated with the event;
generating, based at least in part on the event, a new metric associated with the profile;
determining whether a number of existing metrics associated with the profile exceeds a threshold number of metrics for the profile;
as a result of determining that the number of existing metrics associated with the profile does not exceed a threshold number of metrics for the profile, retaining the new metric in association with the profile;
combining the event with an additional event from the event queue to produce a combined event, the combined event including an occurrence count;
replacing the event and the additional event with the combined event; and
providing the combined event to the metrics engine.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising:
providing an additional event from the event stream to an analysis engine; and
identifying an anomaly based at least in part on the additional event and metrics provided by the metrics engine, the metrics associated with a profile which is associated with the additional event.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, further comprising:
assigning a priority to the events in the event stream;
placing the events in the event stream into a priority queue; and
selecting the additional event from the priority queue based at least in part on the priority of the additional event.

### Claim 4

A system, comprising at least one computing device configured to implement one or more services, wherein the one or more services:
selects an event generated by a system being monitored;
identifies a profile associated with the event, the profile having an associated collection of metrics;
generates, based at least in part on the event, one or more additional metrics;
determines whether adding the additional metrics to the collection of metrics would exceed a limitation associated with the profile;
as a result of having determined that the limitation would be exceeded, does not add at least one of the additional metrics to the collection of metrics associated with the profile;
as a result of having determined that the limitation would not be exceeded, adds the additional metrics to the collection of metrics associated with the profile;
combines the event with an additional event to produce a combined event that includes an occurrence count;
replaces the event and additional event with the combined event; and
provides the combined event to a metrics engine.

### Claim 5 (depends on 4)

The system of claim 4, wherein the one or more services further:
identifies an additional profile associated with the event, the additional profile being associated with a second collection of metrics;
generates, based at least in part on the event, a second set of additional metrics;
determines that adding the second set of additional metrics to the second collection of metrics does not exceed a limitation associated with the additional profile; and
as a result of having determined that the limitation associated with the additional profile is not exceeded, adding the second set of additional metrics to the second collection of metrics associated with the additional profile.

### Claim 6 (depends on 4)

The system of claim 4, wherein the limitation associated with the profile is an amount of storage space allocated to the profile.

### Claim 7 (depends on 4)

The system of claim 4, wherein the limitation associated with the profile is a level of confidence associated with the profile, the level of confidence based at least in part on a standard deviation of a metric associated with the profile.

### Claim 8 (depends on 4)

The system of claim 4, wherein the one or more services further:
determines that the collection of metrics are based at least in part on at least a threshold number of events; and
as a result of having determined that the collection of metrics are based at least in part on at least a threshold number of events, providing the event to an analysis engine, the analysis engine determining whether the event indicates an anomaly based at least in part on the collection of metrics.

### Claim 9 (depends on 4)

The system of claim 4, wherein the one or more services further:
receives, from an analysis engine, an indication that a critical anomaly has been detected in association with the profile; and
as a result of receiving the indication, preventing changes to the collection of metrics associated with the profile.

### Claim 10 (depends on 9)

The system of claim 9, wherein the one or more services further as a result of receiving the indication, deletes the collection of metrics associated with the profile.

### Claim 11 (depends on 4)

The system of claim 4, wherein the one or more services further:
determines that the event originates from a trusted source; and
as a result of determining that the event originates from a trusted source, discards the event.

### Claim 12

A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
acquire an event record from an event source;
identify a number of profiles from a profile hierarchy that are applicable to the event record;
produce metrics corresponding to a profile of the number of profiles, the production of metrics corresponding to the profile subject to a limitation associated with the corresponding profile; and
present an interface to a user that allows the user to:
select a particular profile from a number of profile collections, wherein a profile collection of the number of profile collections is associated with a particular type of escalation, anomaly, or threat; and
select a parent-profile control element to change the selected profile to a parent profile of the particular profile within the profile hierarchy.

### Claim 13 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein the instructions that cause the computer system to acquire an event record from an event source further include instructions that cause the computer system to:
receive a first event and a second event from the event source;
determine that the first event and the second event are combinable; and
combine the first event and the second event to acquire the event record.

### Claim 14 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein:
the event source is an event queue maintained by the computer system; and
the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to the computer system maintains a minimum number of events in the event queue.

### Claim 15 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to:
maintain a burst bucket in association with a particular profile in the profile hierarchy, the burst bucket having an associated bucket level adjusted in response to metrics produced in association with the particular profile; and
the limitation associated with the particular profile based at least in part on the bucket level of the burst bucket.

### Claim 16 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to identify, based at least in part on metrics associated with the number of profiles, a collection of escalations, a collection of anomalies, and a collection threats.

### Claim 17 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to as a result of a user selecting the particular profile from the number of profile collections, presenting a daily history of anomalies, escalations, and threats for the particular profile.

### Claim 18 (depends on 17)

The non-transitory computer-readable storage medium of claim 17, wherein:
the daily history is presented as a bar chart with a number of bars, the number of bars representing different time periods, and the number of bars having one or more corresponding sub bars;
the corresponding sub bars associated with a particular bar represent different types of escalation, anomaly or threat; and
the one or more corresponding sub bars that represent a particular type of escalation, anomaly, or threat are scaled to a constant value.