# US 10,372,524 B2 · Storage anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,524 B2 - Document ID: US10372524B2 - Status: Granted - Kind: B2 - Application number: 15/222,854 - Filed: 2016-07-28 - Published: 2018-02-01 - Granted: 2019-08-06 - Earliest claimed: 2016-07-28 - Assignees: Western Digital Technologies, Inc. - Applicants: HGST Netherlands B.V. - Inventors: Shivkumar Shivaji; Ryan Sudhakaran; Yong Bum Lee; Joel Barajas Zamora - Web page: https://patentgrep.com/patent/US10372524B2 ## CPC - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0727: {in a storage system, e.g. in a DASD or network based storage system (drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097)} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/3409: {for performance assessment} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The technology described in this document is, among other things, capable of efficiently monitoring storage device signal data for anomalies. In an example method, signal data for a plurality of non-transitory storage devices is collected. The method determines a hyper feature representation from the collected signal data and computes, using the hyper feature representation, scores for statistics associated with the non-transitory storage devices. The method further determines a reduced hyper feature representation aggregating the scores for each of the statistics associated with each of the non-transitory storage devices; generates, using the reduced hyper feature representation, storage device scores for the non-transitory storage devices of the plurality, respectively; and identifies one or more non-transitory storage devices from among the plurality of non-transitory storage devices exhibiting anomalous storage device behavior using the storage device scores. ## Claims ### Claim 1 A computer-implemented method comprising: collecting, at one or more computing devices, signal data for a plurality of non-transitory storage devices, the signal data including time series for statistics associated with each of the non-transitory storage devices; determining, using the one or more computing devices, a hyper feature representation from the collected signal data; computing, using the one or more computing devices and the hyper feature representation, scores for each of the statistics associated with each of the non-transitory storage devices; determining, using the one or more computing devices, a reduced hyper feature representation aggregating the scores for each of the statistics associated with each of the non-transitory storage devices; generating, using the one or more computing devices and the reduced hyper feature representation, storage device scores for the non-transitory storage devices of the plurality, respectively; and identifying, using the one or more computing devices, one or more non-transitory storage devices from among the plurality of non-transitory storage devices exhibiting anomalous storage device behavior using the storage device scores. ### Claim 2 A computer-implemented method comprising: determining, using one or more computing devices, a hyper feature representation aggregating scores for statistics associated with a plurality of non-transitory storage devices, wherein the hyper feature representation is a reduced hyper feature representation based on an initial hyper feature representation; generating, using the one or more computing devices and the hyper feature representation, storage device scores for the non-transitory storage devices of the plurality of non-transitory storage devices, respectively; and identifying, using the one or more computing devices, one or more non-transitory storage devices from among the plurality of non-transitory storage devices exhibiting anomalous storage device behavior using the storage device scores. ### Claim 3 A system comprising: one or more processors; one or more memories; and an analyzer configured to perform operations including: determining a hyper feature representation aggregating scores for statistics associated with a plurality of non-transitory storage devices, wherein the hyper feature representation is a reduced hyper feature representation based on an initial hyper feature representation; generating, using the hyper feature representation, storage device scores for the non-transitory storage devices of the plurality of non-transitory storage devices, respectively; and identifying one or more non-transitory storage devices from among the plurality of non-transitory storage devices exhibiting anomalous storage device behavior using the storage device scores. ### Claim 4 (depends on 2) The computer-implemented method of claim 2, further comprising: ranking the non-transitory storage devices using the storage device scores. ### Claim 5 (depends on 2) The computer-implemented method of claim 2, further comprising: generating analytics identifying regions of interest for each of the non-transitory storage devices; and providing the analytics for presentation by a client device of a stakeholder. ### Claim 6 (depends on 2) The computer-implemented method of claim 2, further comprising: computing, using the one or more computing devices and the initial hyper feature representation, the scores for the statistics associated with the plurality of non-transitory storage devices, wherein: the initial hyper feature representation is a two-dimensional matrix including a time series for the statistics associated with the non-transitory storage devices. ### Claim 7 (depends on 2) The computer-implemented method of claim 2, wherein the storage device scores are feature vectors having dimensions equal to a number of statistics used to determine the scores. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein each feature vector of the feature vectors includes a ranking of the statistics corresponding to that feature vector. ### Claim 9 (depends on 2) The computer-implemented method of claim 2, further comprising: computing the scores for the statistics associated with the plurality of non-transitory storage devices, wherein computing the scores for the statistics includes performing hierarchical clustering to determine statistical significance of statistical values of the statistics. ### Claim 10 (depends on 2) The computer-implemented method of claim 2, further comprising: computing the scores for the statistics associated with the plurality of non-transitory storage devices, wherein computing the scores for the statistics includes fitting a multivariate t distribution to the scores. ### Claim 11 (depends on 2) The computer-implemented method of claim 2, further comprising: computing, using the one or more computing devices and the initial hyper feature representation, the scores for the statistics associated with the plurality of non-transitory storage devices, wherein the initial hyper feature representation is determined using principal component analysis while preserving a time series of the statistics associated the plurality of non-transitory storage devices. ### Claim 12 (depends on 2) The computer-implemented method of claim 2, wherein the hyper feature representation is determined using principal component analysis. ### Claim 13 A system comprising: one or more processors; and one or more memories storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising: collecting signal data for a plurality of non-transitory storage devices, the signal data including time series for statistics associated with each of the non-transitory storage devices; determining a hyper feature representation from the collected signal data; computing, using the hyper feature representation, scores for each of the statistics associated with each of the non-transitory storage devices; determining a reduced hyper feature representation aggregating the scores for each of the statistics associated with each of the non-transitory storage devices; generating, using the reduced hyper feature representation, storage device scores for the non-transitory storage devices of the plurality, respectively; and identifying one or more non-transitory storage devices from among the plurality of non-transitory storage devices exhibiting anomalous storage device behavior using the storage device scores. ### Claim 14 (depends on 3) The system of claim 3, wherein the analyzer is further configured to perform operations comprising: ranking the non-transitory storage devices using the storage device scores. ### Claim 15 (depends on 3) The system of claim 3, wherein the analyzer is further configured to perform operations comprising: generating analytics identifying regions of interest for each of the non-transitory storage devices; and providing the analytics for presentation by a client device of a stakeholder. ### Claim 16 (depends on 3) The system of claim 3, wherein the analyzer is further configured to perform operations comprising: computing, using the initial hyper feature representation, the scores for the statistics associated with the plurality of non-transitory storage devices, wherein the initial hyper feature representation is a two-dimensional matrix including a time series for the statistics associated with the non-transitory storage devices. ### Claim 17 (depends on 3) The system of claim 3, wherein the storage device scores are feature vectors having dimensions equal to a number of statistics used to determine the scores. ### Claim 18 (depends on 17) The system of claim 17, wherein each feature vector of the feature vectors includes a ranking of the statistics corresponding to that feature vector. ### Claim 19 (depends on 3) The system of claim 3, wherein the analyzer is further configured to perform operations comprising: computing the scores for the statistics associated with the plurality of non-transitory storage devices, wherein computing the scores for the statistics includes performing hierarchical clustering to determine statistical significance of statistical values of the statistics. ### Claim 20 (depends on 3) The system of claim 3, wherein the analyzer is further configured to perform operations comprising: computing the scores for the statistics associated with the plurality of non-transitory storage devices, wherein computing the scores for the statistics includes fitting a multivariate t distribution to the scores. ### Claim 21 (depends on 3) The system of claim 3, wherein the analyzer is further configured to perform operations comprising: computing, using the initial hyper feature representation, the scores for the statistics associated with the plurality of non-transitory storage devices, wherein the initial hyper feature representation is determined using principal component analysis while preserving a time series of the statistics associated the plurality of non-transitory storage devices. ### Claim 22 (depends on 3) The system of claim 3, wherein the hyper feature representation is determined using principal component analysis. ### Claim 23 A system comprising: one or more processors; one or more memories; means for collecting signal data for a plurality of non-transitory storage devices, the signal data including time series for statistics associated with each of the non-transitory storage devices; means for determining a hyper feature representation from the collected signal data; means for computing, using the hyper feature representation, scores for each of the statistics associated with each of the non-transitory storage devices; means for determining a reduced hyper feature representation aggregating the scores for each of the statistics associated with each of the non-transitory storage devices; means for generating, using the reduced hyper feature representation, storage device scores for the non-transitory storage devices of the plurality, respectively; and means for identifying one or more non-transitory storage devices from among the plurality of non-transitory storage devices exhibiting anomalous storage device behavior using the storage device scores.