Interactive detection of system anomalies

A method comprising:

• receiving, by a processor, input data related to a series of events, each event in the series of events being associated with a respective event type in a reference group of event types;
• generating, by the processor, for each event type in the reference group of event types, a respective component anomaly score based on a number of the event types in the series of events and a rarity of the event type with respect to other event types in the reference group of event types;
• generating, by the processor, an anomaly score based on the respective component anomaly score generated for each event type in the reference group of events types;
• generating, by the processor, an output data stream based on system anomalies detected based on the anomaly score and other anomaly scores;
• generating, by the processor, to be displayed via an interactive graphical user interface, the output data stream including an attribute associated with the output data stream;
• receiving, by the processor, from the interactive graphical user interface, feedback data indicative of selection of a system anomaly;
• processing, by the processor, the feedback data to modify the output data stream;
• providing, by the processor, via the interactive graphical user interface, an interactive analysis interface for operations analytics based on the selected system anomaly;
• comparing, by the processor, a second system anomaly to the selected system anomaly;
• determining, by the processor, that the second system anomaly is of potential interest based on the comparison;
• and
• displaying, by the processor, via the interactive graphical user interface, the second system anomaly.

A non-transitory computer readable medium comprising executable instructions that when executed by a processor cause the processor to:

• receive input data related to a series of events, each event in the series of events being associated with a respective event type in a reference group of event types;
• generate an anomaly score based on a number of each event type in the series of events and a rarity of each event type with respect to other event types in the reference group of event types;
• detect a system anomaly based on the anomaly score;
• generate an output data stream based on the detected system anomaly;
• provide the output data stream to be displayed via an interactive graphical user interface;
• facilitate operations analytics of the series of events based on feedback data indicative of interactions with the output data stream, the interactions including selection of the system anomaly;
• compare a second system anomaly to the selected system anomaly;
• determine that the second system anomaly is of potential interest based on the comparison;
• and
• display, via the interactive graphical user interface, the second system anomaly.

The non-transitory computer readable medium of 15, wherein the input data comprises a plurality of unstructured messages related to the series of events, each of the unstructured messages having a corresponding format such that the input data has heterogeneous data formats, and wherein to detect the system anomaly, the instructions when executed by the processor further cause the processor to:

• determine a set of structured message types and parameters based on the plurality of unstructured messages;
• generate a regular expression for matching each of the plurality of unstructured messages based on the set of structured message types and parameters;
• and
• identify an event type for each of the plurality of unstructured messages based on the regular expression.

The non-transitory computer readable medium of 17, wherein the instructions when executed by the processor further cause the processor to:

• generate an anomaly fingerprint based on the identified subset of the series of events;
• store the anomaly fingerprint;
• generate a second anomaly fingerprint based on a second subset of the series of events, the second anomaly fingerprint being associated with the second system anomaly,
• wherein the comparison of the second system anomaly to the selected system anomaly is based on a comparison of the anomaly fingerprint with the second anomaly fingerprint;
• and
• determine that the second system anomaly is similar to the selected system anomaly based on the comparison, wherein the determination that the second system anomaly is of potential interest is based on the determination that the second system anomaly is similar to the selected system anomaly.

The non-transitory computer readable medium of 15, wherein the instructions when executed by the processor further cause the processor to:

• assign a second anomaly score to the second system anomaly, the second anomaly score indicative of a level of potential interest of the second system anomaly;
• determine that the selected system anomaly was interacted with to obtain further information relating to the selected system anomaly;
• and
• adjust the second anomaly score to indicate that the second system anomaly is of greater interest than before the determination that the selected system anomaly was interacted with to obtain further information relating to the selected system anomaly.

The non-transitory computer readable medium of 19, wherein the instructions when executed by the processor further cause the processor to:

• detect a third system anomaly based on the input data;
• compare the third system anomaly to a set of previous system anomalies;
• determine that the set of previous system anomalies were presented to users and that interactions with the set of previous system anomalies were not received from the users;
• and
• determine that the third system anomaly is not of potential interest based on the comparison of the third system anomaly to the set of previous system anomalies and the determination that the set of previous system anomalies were presented to users and that interactions with the set of previous system anomalies were not received from the users.