# US 10,503,575 B2 · Computer systems monitoring using beat frequency analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,575 B2 - Document ID: US10503575B2 - Status: Granted - Kind: B2 - Application number: 15/414,491 - Filed: 2017-01-24 - Published: 2017-05-11 - Granted: 2019-12-10 - Earliest claimed: 2015-06-26 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Jon Arron McClintock; Tushaar Sethi; George Nikolaos Stathakopoulos - Web page: https://patentgrep.com/patent/US10503575B2 ## CPC - G06F 11/0757: {by exceeding a time limit, i.e. time-out, e.g. watchdogs} - G06F 11/00: Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00) - G06F 11/0706: {the processing taking place on a specific hardware platform or in a specific software environment} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0721: {within a central processing unit [CPU]} - G06F 11/0754: {by exceeding limits} - G06F 11/0775: {Content or structure details of the error report, e.g. specific table structure, specific error fields} - G06F 11/3003: {Monitoring arrangements specially adapted to the computing system or computing system component being monitored} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3065: {Monitoring arrangements determined by the means or processing involved in reporting the monitored data (error or fault reporting or logging G06F11/0766)} - G06F 11/34: Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation {; Recording or statistical evaluation of user activity, e.g. usability assessment} - G06F 11/3419: {by assessing time} - G06F 11/3452: {Performance evaluation by statistical analysis} - H04L 67/303: Terminal profiles - G06F 11/3051: {Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247)} - G06F 11/3068: {where the reporting involves data format conversion} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A monitoring service receives, from a variety of hardware components of a set of computer systems, binary signals indicative of operation of these components. The monitoring service determines, based at least in part on these signals, a set of beat frequencies for pairings of hardware components of the set of computer systems. The monitoring service uses this set of beat frequencies, as well as information included in a profile for the set of computer systems, to determine whether there is any indication of anomalous behavior in operation of the set of computer systems. If so, the monitoring service generates one or more alerts indicating the anomalous behavior. ## Claims ### Claim 1 A computer-implemented method, comprising: accessing signal information generated based at least in part on a plurality of signals resulting from operation of a computer system; determining, based at least in part on the accessed signal information, a set of beat frequencies; obtaining a profile of the computer system, the profile indicating a plurality of reference beat frequencies associated with the computer system; determining, based at least in part on the set of beat frequencies and the plurality of reference beat frequencies, that the set of beat frequencies fail to satisfy a set of criteria to indicate anomalous behavior; and updating the profile of the computer system to incorporate the set of beat frequencies with the plurality of reference beat frequencies for detection of anomalies in operation of the computer system. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the plurality of signals resulting from the operation of the computer system correspond to hardware components of the computer system. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: obtaining, from the profile, a first set of patterns for the plurality of reference beat frequencies; determining, for the set of beat frequencies, a second set of patterns corresponding to the set of beat frequencies; and performing pattern matching of the first set of patterns with the second set of patterns to determine that the set of beat frequencies fail to satisfy the set of criteria to indicate the anomalous behavior. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: calculating, for the plurality of signals, a plurality of peak frequencies; and utilizing the plurality of peak frequencies to calculate the set of beat frequencies. ### Claim 5 A system, comprising at least one computing device with a processor, the at least one computing device configured to implement one or more services, wherein the one or more services are configured to: access signal information generated based at least in part on a plurality of signals resulting from operation of a computer system; determine, based at least in part on the signal information, a set of beat frequencies; obtain, from a profile of the computer system, a plurality of reference beat frequencies associated with the computer system; determine, based at least in part on the set of beat frequencies and the plurality of reference beat frequencies, that the set of beat frequencies fail to satisfy a set of criteria to indicate anomalous behavior; and update the profile of the computer system to incorporate the set of beat frequencies with the plurality of reference beat frequencies, resulting in an updated profile of the computer system. ### Claim 6 (depends on 5) The system of claim 5, wherein the plurality of signals correspond to a plurality of different hardware components of the computer system, wherein individual hardware components of the plurality of hardware components generate individual signals of the plurality of signals. ### Claim 7 (depends on 5) The system of claim 5, wherein the one or more services are further configured to: access second signal information corresponding to operation of the computer system; determine, based at least in part on the second signal information, a second set of beat frequencies; obtain the updated profile; determine, based at least in part on the updated profile and the second set of beat frequencies, that one or more anomalies have been identified; and generate an alert specifying an indication of the one or more anomalies. ### Claim 8 (depends on 5) The system of claim 5, wherein the one or more services are further configured to perform a Fourier transform on the signal information to obtain a set of frequencies usable to determine the set of beat frequencies. ### Claim 9 (depends on 5) The system of claim 5, wherein the one or more services are further configured to perform a comparison of individual beat frequencies of the set of beat frequencies with the plurality of reference beat frequencies to determine that the set of beat frequencies fail to satisfy the set of criteria to indicate anomalous behavior. ### Claim 10 (depends on 5) The system of claim 5, wherein the one or more services are further configured to: obtain, from the profile, information specifying a first set of patterns associated with the plurality of reference beat frequencies; identify, for the set of beat frequencies, a second set of patterns associated with the set of beat frequencies; and analyze the first set of patterns and the second set of patterns to determine that the set of beat frequencies fail to satisfy the set of criteria to indicate anomalous behavior. ### Claim 11 (depends on 5) The system of claim 5, wherein the one or more services are further configured to: obtain, from the profile, statistical data for the plurality of reference beat frequencies; and analyze the set of beat frequencies using the statistical data to determine that the set of beat frequencies fail to satisfy the set of criteria to indicate anomalous behavior. ### Claim 12 (depends on 5) The system of claim 5, wherein the one or more services are further configured to: determine, based at least in part on the plurality of signals, a set of characteristic frequencies for the computer system; and use the set of characteristic frequencies to determine the set of beat frequencies. ### Claim 13 A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least: obtain signal information based at least in part on a plurality of signals resulting from a second computer system; determine, based at least in part on the obtained signal information, a set of beat frequencies; determine, based at least in part on the set of beat frequencies, that there are no anomalies in operation of the second computer system; and update a profile of the second computer system to incorporate the set of beat frequencies for detection of anomalies in operation of the second computer system. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to: obtain, from the profile, reference beat frequencies associated with the second computer system; and compare the set of beat frequencies with the reference beat frequencies to determine that there are no anomalies. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions further cause the computer system to: identify, from the profile, one or more patterns associated with the reference beat frequencies; and determine that there are no anomalies in response to a determination that the set of beat frequencies comport with the one or more patterns. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions further cause the computer system to: identify, from the profile, statistical data generated based at least in part on the reference beat frequencies; and determine that there are no anomalies based at least in part on an analysis of the set of beat frequencies using the statistical data. ### Claim 17 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the instructions further cause the computer system to use the set of beat frequencies to update the statistical data. ### Claim 18 (depends on 16) The non-transitory computer-readable storage medium of claim 16, wherein the statistical data includes standard deviation values for the reference beat frequencies, variance values for the reference beat frequencies, and mean values for the reference beat frequencies. ### Claim 19 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to: perform Fourier analyses on the signal information to obtain a set of frequencies; calculate, based at least in part on the set of frequencies, a set of average frequencies for the plurality of signals; and calculate, based at least in part on the set of average frequencies, the set of beat frequencies. ### Claim 20 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to: obtain second signal information corresponding to operation of the second computer system; determine, based at least in part on the second signal information, a second set of beat frequencies; obtain the profile; determine, based at least in part on the profile and the second set of beat frequencies, that one or more anomalies have been identified; and generate an alert specifying an indication of the one or more anomalies.