US 11,080,160 B1 · Self-learning and best-practice profiling and alerting with relative and absolute capacity

Abstract

For example, as indicated in the Incorporated Disclosures, rapid change from relatively little use of network bandwidth, to heavy overuse of network bandwidth (combined with a large number of endpoints attempting to access that network bandwidth) can often indicate an email virus or other maladjusted use of the system. In such cases, it could be appropriate to generate an alert, and bring the change to the attention of a human expert, or otherwise escalate the problem. In this Application, the phrase “best practices,” and variants thereof, can generally refer to business preferences (and to business rules imposed by management, or law or regulation), such as high utilization preferences often expressed by management. In such cases, one or more operators can enter descriptors of rules the system that it is desired the system follow, such as “processor cycle utilization >90%.” When these best practices are not followed, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In this Application, the phrase “profiling and alerting,” and variants thereof, can generally refer to maintaining a profile of how the system normally behaves, absent stressors, and to identify any substantial changes from that profile. When a profile is seriously violated, it could be appropriate to generate an alert, bring the change to the attention of a human expert, or otherwise escalate the problem. In such cases, it can be appropriate to escalate the severity of the alert with increased severity of violation, increased time duration of the violation, and increased trajectory in the direction of further violation. In this Application, the phrase “absolute capacity,” and variants thereof, can refer to an objective measure of system capacity, such as whether the system has 1 TB or 4 TB of memory. The phrase “relative capacity,” and variants thereof, can refer to a subjective measure of system capacity, such as when the system has 4 TB of physical memory, but 3.5 TB of that memory are allocated to a high-priority task whose interruption or pause would be untoward.

Claims18

Dependent claims

An apparatus including:

a network monitoring device responsive to network status data from one or more reporting devices coupled to a distributed network monitoring environment, the one or more reporting devices providing the network status data with respect to more than one function to be performed by network devices, the distributed network monitoring environment including a plurality of endpoints coupled thereto and disposed to access resources available using the distributed network monitoring environment;
the network monitoring device including one or more automated processes that provide, in response to the network status data, a profile of normal activity of the distributed network monitoring environment, wherein a deviation from normal activity of the distributed network monitoring environment provides a reliable indicator of changes in use of the distributed network monitoring environment, the automated processes providing the profile of normal activity of the distributed network monitoring environment using self-learning in response to the network status data;
the network monitoring device being coupled to business rules defining a set of best practices of operation of the distributed network monitoring environment, wherein the business rules are described by a scripting language in response to management;
and
the network monitoring device providing an alert to one or more operators in response to the network status data indicating either or both (a) that the distributed network monitoring environment falls outside the profile of normal activity, either with respect to a total capacity of the distributed network monitoring environment, or with respect to a relative capacity of the distributed network monitoring environment, or (b) that the distributed network monitoring environment falls outside the set of best practices of operation, either with respect to the total capacity of the distributed network monitoring environment, or with respect to the relative capacity of the distributed network monitoring environment.

2 more elements

A method of operating a network monitoring device, the method including steps of:

coupling the network monitoring device to network status data from one or more reporting devices coupled to a distributed network monitoring environment, the one or more reporting devices providing the network status data with respect to more than one function to be performed by network devices, the distributed network monitoring environment including a plurality of endpoints coupled thereto and disposed to access resources available using the distributed network monitoring environment;
performing, by the network monitoring device, one or more automated processes that provide, in response to the network status data, a profile of normal activity of the distributed network monitoring environment, wherein a deviation from normal activity of the distributed network monitoring environment provides a reliable indicator of changes in use of the distributed network monitoring environment, the automated processes providing the profile of normal activity of the distributed network monitoring environment using self-learning in response to the network status data;
coupling the network monitoring device to business rules defining a set of best practices of operation of the distributed network monitoring environment, wherein the business rules are described by a scripting language in response to management;
and
providing an alert to one or more operators in response to the network status data indicating either or both (a) that the distributed network monitoring environment falls outside the profile of normal activity, either with respect to a total capacity of the distributed network monitoring environment, or with respect to a relative capacity of the distributed network monitoring environment, or (b) that the distributed network monitoring environment falls outside the set of best practices of operation, either with respect to the total capacity of the distributed network monitoring environment, or with respect to the relative capacity of the distributed network monitoring environment.

2 more elements

A network monitoring method, comprising:

exchanging packets between at least one network monitoring device and reporting devices in a distributed network, the packets providing network status data;
performing, by the at least one network monitoring device, one or more automated processes that provide, in response to the network status data, a profile of normal activity of the distributed network, wherein a deviation from normal activity of the distributed network provides a reliable indicator of changes in use of the distributed network, the automated processes providing the profile of normal activity of the distributed network using self-learning in response to the network status data;
coupling the at least one network monitoring device to business rules defining a set of best practices of operation of the distributed network, wherein the business rules are described by a scripting language in response to management;
and
providing an alert to one or more operators in response to the network status data indicating either or both (a) that the distributed network falls outside the profile of normal activity, either with respect to a total capacity of the distributed network, or with respect to a relative capacity of the distributed network, or (b) that the distributed network falls outside the set of best practices of operation, either with respect to the total capacity of the distributed network, or with respect to the relative capacity of the distributed network.

2 more elements

Dependencies are inferred from the claim text.

Self-learning and best-practice profiling and alerting with relative and absolute capacity

Life of this patent

Self-learning and best-practice profiling and alerting with relative and absolute capacity

Life of this patent

Abstract

Claims18