# US 11,307,916 B2 · Method and device for determining an estimated time before a technical incident in a computing infrastructure from values of performance indicators > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,307,916 B2 - Document ID: US11307916B2 - Status: Granted - Kind: B2 - Application number: 16/927,162 - Filed: 2020-07-13 - Published: 2021-01-28 - Granted: 2022-04-19 - Earliest claimed: 2019-07-15 - Assignees: Bull SAS - Applicants: Bull SAS - Inventors: Jean-François Roy; Kaoutar Sghiouer; Guillaume Porcher; Pierre Seroul - Web page: https://patentgrep.com/patent/US11307916B2 ## CPC - G06F 11/0757: {by exceeding a time limit, i.e. time-out, e.g. watchdogs} - G06Q 10/20: Administration of product repair or maintenance - G05B 23/0283: {Predictive maintenance, e.g. involving the monitoring of a system and, based on the monitoring results, taking decisions on the maintenance schedule of the monitored system; Estimating remaining useful life [RUL] (preventive maintenance, i.e. planning maintenance according to the available resources without monitoring the system G06Q10/06)} - G06F 11/0778: {Dumping, i.e. gathering error/state information after a fault for later diagnosis} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3419: {by assessing time} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) ## Abstract A method for determining an estimated duration before a technical incident in a computing infrastructure, executed by a computing device. The computing device including a data processing module, a storage module that stores in memory at least one correlation base between performance indicators, wherein the correlation base includes values of duration before becoming anomalous between correlated performance indicators, and a collection module. The method includes receiving performance indicator values, identifying anomalous performance indicators, identifying first and other at-risk indicators. The method includes determining an estimated duration before a technical incident including a calculation, from the anomalous indicators and at-risk indicators, a shorter path leading to a risk of technical incident, and a calculation of an estimated duration before a technical incident. The estimated duration is calculated from the values of duration before becoming anomalous between correlated performance indicators for each of the performance indicators constituting the shortest path calculated. ## Claims ### Claim 1 A method for determining an estimated duration before a technical incident in a computing infrastructure, said method being executed by a computing device, said computing device comprising a data processing module, a storage module configured to store in memory at least one correlation base between performance indicators, said at least one correlation base comprising values of duration before becoming anomalous between said performance indicators that are correlated, and a collection module, said method comprising: receiving, by the collection module, performance indicator values of a computing infrastructure, identifying anomalous performance indicators, by the data processing module, said identifying anomalous performance indicators comprising an analysis of the performance indicator values to identify abnormal values and performance indicators associated with these abnormal values, identifying first at-risk indicators, by the data processing module from the at least one correlation base, said first at-risk indicators being performance indicators that are correlated with the anomalous performance indicators that are identified, identifying other at-risk indicators, by the data processing module from the at least one correlation base, said other at-risk indicators being performance indicators that are directly or indirectly correlated with the first at-risk indicators identified, and determining, by the data processing module, an estimated duration before a technical incident in the computing infrastructure to predict failures from weak signals, said estimated duration before a technical incident being calculated from the values of duration before becoming anomalous of the at least one correlation base for the first at-risk indicators that are identified and the other at-risk indicators that are identified, wherein the values of duration before becoming anomalous corresponds to the duration between an occurrence of an abnormal value for a performance indicator in question and an occurrence of an abnormal value for a performance indicator correlated with the performance indicator in question, wherein the determining the estimated duration comprises a calculation, from the first at-risk indicators that are identified and the other at-risk indicators that are identified, of several paths leading to a risk of technical incident, such that the estimated duration before a technical incident of the computing infrastructure is selected from several alternatives as said several paths, a calculation, from the first at-risk indicators that are identified and the other at-risk indicators that are identified, of a shortest path from said several paths leading to a risk of technical incident, such that a potential sequence of anomalies which will most quickly lead to failure of the computing infrastructure is identified as said shortest path, and converting the shortest path of said several paths into a chain of temporal values which, when added together, identify the estimated duration before technical incident. ### Claim 2 (depends on 1) The method according to claim 1, wherein the identifying anomalous performance indicators is preceded by a step of processing the performance indicator values, said step of processing the performance indicator values comprising a deletion of a normal component. ### Claim 3 (depends on 1) The method according to claim 1, wherein the identify of abnormal values is carried out by a statistical method making it possible to generate values of distance to normality. ### Claim 4 (depends on 1) The method according to claim 1, wherein the identifying of anomalous performance indicators of the computing infrastructure that are correlated with the anomalous performance indicators that are identified is carried out based on inter-performance indicator causal correlations. ### Claim 5 (depends on 1) The method according to claim 1, further comprising calculating a technical incident risk value. ### Claim 6 (depends on 1) The method according to claim 1, further comprising determining, by the data processing module, an anomaly prediction performance index value comprising: receiving new performance indicator values; identifying new confirmed anomalous indicators, said identifying new confirmed anomalous indicators comprising an analysis of the new performance indicator values so as to identify abnormal values and performance indicators associated with these abnormal values, and comparing the first at-risk indicators and the other at-risk indicators that are identified to the new confirmed anomalous indicators to generate a performance index value. ### Claim 7 (depends on 6) The method according to claim 6, further comprising generating updated values of duration before becoming anomalous, a value of duration before becoming anomalous corresponding to a duration between an occurrence of an abnormal value for a performance indicator in question and an occurrence of an abnormal value for a performance indicator correlated with the performance indicator in question. ### Claim 8 (depends on 7) The method according to claim 7, wherein the at least one correlation base comprises values of durations before becoming anomalous between performance indicators, and in that the method further comprises a step of modifying the values of duration before becoming anomalous between the performance indicators that are stored in the memory in the at least one correlation base, based on the updated values of duration before becoming anomalous. ### Claim 9 (depends on 1) The method according to claim 1, further comprising storing in the memory, for each performance indicator: a unique identifier and at least one unique identifier of another performance indicator correlated therewith, with a value of duration before becoming anomalous of said another performance indicator. ### Claim 10 A non-transitory computer program product for determining an estimated duration before a technical incident in a computing infrastructure comprising program code instructions for execution, on a computing device, of a method for determining an estimated duration before a technical incident in a computing infrastructure, said computing device comprising a data processing module, a storage module configured to store in memory at least one correlation base between performance indicators, said at least one correlation base comprising values of duration before becoming anomalous between said performance indicators that are correlated, and a collection module, said method comprising: receiving, by the collection module, performance indicator values of a computing infrastructure, identifying anomalous performance indicators, by the data processing module, said identifying anomalous performance indicators comprising an analysis of the performance indicator values to identify abnormal values and performance indicators associated with these abnormal values, identifying first at-risk indicators, by the data processing module from the at least one correlation base, said first at-risk indicators being performance indicators that are correlated with the anomalous performance indicators that are identified, identifying other at-risk indicators, by the data processing module from the at least one correlation base, said other at-risk indicators being performance indicators that are directly or indirectly correlated with the first at-risk indicators that are identified, and determining, by the data processing module, an estimated duration before a technical incident in the computing infrastructure to predict failures from weak signals, said estimated duration before a technical incident being calculated from the values of duration before becoming anomalous of the at least one correlation base for the first at-risk indicators that are identified and the other at-risk indicators that are identified, wherein the values of duration before becoming anomalous corresponds to the duration between an occurrence of an abnormal value for a performance indicator in question and an occurrence of an abnormal value for a performance indicator correlated with the performance indicator in question, wherein the determining the estimated duration comprises a calculation, from the first at-risk indicators that are identified and the other at-risk indicators that are identified, of several paths leading to a risk of technical incident, such that the estimated duration before a technical incident of the computing infrastructure is selected from several alternatives as said several paths, a calculation, from the first at-risk indicators that are identified and the other at-risk indicators that are identified, of a shortest path from said several paths leading to a risk of technical incident, such that a potential sequence of anomalies which will most quickly lead to failure of the computing infrastructure is identified as said shortest path, and converting the shortest path of said several paths into a chain of temporal values which, when added together, identify the estimated duration before technical incident. ### Claim 11 (depends on 10) The non-transitory computer program product of claim 10, further comprising a computer-readable storage medium on which the computer program code instructions is stored. ### Claim 12 A computing device for determining an estimated duration before a technical incident in a computing infrastructure, said computing device comprising: a data processing module, a storage module configured to store in memory at least one correlation base between performance indicators, said at least one correlation base comprising values of duration before becoming anomalous between said performance indicators, and a collection module, said collection module configured to receive performance indicator values of the computing infrastructure, wherein said data processing module is configured to identify anomalous performance indicators, said identify anomalous performance indicators comprising an analysis of the performance indicator values to identify abnormal values and performance indicators associated with these abnormal values, identify first at-risk indicators, from the at least one correlation base, said first at-risk indicators being performance indicators that are correlated with the anomalous performance indicators that are identified, identify other at-risk indicators, from the at least one correlation base, said other at-risk indicators being performance indicators that are directly or indirectly correlated with the first at-risk indicators that are identified, and determine an estimated duration before a technical incident, said estimated duration before a technical incident being calculated from values of duration before becoming anomalous of the at least one correlation base for the first at-risk indicators that are identified and the other at-risk indicators that are identified, wherein the values of duration before becoming anomalous corresponds to the duration between an occurrence of an abnormal value for a performance indicator in question and an occurrence of an abnormal value for a performance indicator correlated with the performance indicator in question, wherein the determining the estimated duration comprises a calculation, from the first at-risk indicators identified and the other at-risk indicators identified, of several paths leading to a risk of technical incident, such that the estimated duration before a technical incident of the computing infrastructure is selected from several alternatives as said several paths, a calculation, from the first at-risk indicators identified and the other at-risk indicators identified, of a shortest path from said several paths leading to a risk of technical incident, such that a potential sequence of anomalies which will most quickly lead to failure of the computing infrastructure is identified as said shortest path, and converting the shortest path of said several paths into a chain of temporal values which, when added together, identify the estimated duration before technical incident.