# US 11,307,953 B2 · Block-based anomaly detection in computing environments

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,307,953 B2
- Document ID: US11307953B2
- Status: Granted
- Kind: B2
- Application number: 16/591,856
- Filed: 2019-10-03
- Published: 2021-04-08
- Granted: 2022-04-19
- Earliest claimed: 2019-10-03
- Assignees: Oracle International Corporation
- Applicants: Oracle International Corporation
- Inventors: Fa Wang; Raymond Michael Ofiaza Ordona; Mei Yuan; Xintao He; Campbell Webb
- Web page: https://patentgrep.com/patent/US11307953B2

## CPC

- G06F 11/3075: {the data filtering being achieved in order to maintain consistency among the monitored data, e.g. ensuring that the monitored data belong to the same timeframe, to the same system or component}
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)}
- G06F 11/0778: {Dumping, i.e. gathering error/state information after a fault for later diagnosis}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.

## Claims

### Claim 1

A method for identifying anomalies in computing environments, the method comprising:
receiving log data from a plurality of nodes in a computing environment, wherein the log data comprises a sequence of information indicative of log messages produced by the plurality of nodes;
identifying, in the sequence of information, dominant patterns representative of non-anomalous blocks of the log messages, wherein identifying the dominant patterns within the sequence of information comprises:
identifying potential patterns within the sequence of information; and
selecting the dominant patterns from the potential patterns based at least on a scoring function applied to one or more of the potential patterns, wherein the scoring function promotes a subset of the potential patterns that occur frequently within the sequence of information relative to a different subset of the potential patterns that occur less frequently within the sequence of information;
extracting the non-anomalous blocks from the log data based on the dominant patterns to reveal anomalous blocks that do not fit the dominant patterns;
generating anomaly vectors based at least on the anomalous blocks; and
distributing anomaly data to at least one of the plurality of nodes to detect the anomalies, wherein the anomaly data includes the anomaly vectors.

### Claim 2 (depends on 1)

The method of claim 1 wherein the scoring function determines, for each potential pattern of the potential patterns, a relative dominance of the potential pattern based on a description length of the sequence of information when encoded with a compressed representation of the potential pattern.

### Claim 3 (depends on 2)

The method of claim 2 wherein the sequence of information comprises a sequence of log codes and wherein each log code of the sequence of log codes comprises a symbolic representation of a possible hash value, and wherein the log data includes a code book that maps each unique log code to a different one of a set of possible hash values.

### Claim 4 (depends on 3)

The method of claim 3 wherein each anomaly vector of the anomaly vectors comprises a string of numbers that correspond by position to a set of possible log codes.

### Claim 5 (depends on 4)

The method of claim 4 wherein generating the anomaly vectors based at least on the anomaly blocks comprises, for each one of the anomaly vectors, setting a value of each number in the string of numbers to indicate a presence, or lack thereof, of a corresponding one of the set of possible log codes in an anomaly block represented by the anomaly vector.

### Claim 6

A method for identifying anomalies, the method comprising:
receiving log data from one or more nodes in a cloud computing environment, wherein the log data comprises a sequence of log codes generated by the one or more nodes;
identifying code blocks within the sequence of log codes,
wherein identifying the code blocks within the sequence of log codes comprises:
identifying potential code blocks within the sequence of log codes; and
selecting the code blocks from the potential code blocks based at least on a scoring function applied to one or more of the potential code blocks,
wherein the scoring function promotes dominant sub-sequences of log codes within the sequence of log codes relative to non-dominant sub-sequences of log codes;
separating the code blocks into at least normal blocks and anomaly blocks;
generating anomaly vectors based at least on the anomaly blocks; and
distributing anomaly data to the one or more nodes to detect the anomalies, wherein the anomaly data includes the anomaly vectors.

### Claim 7 (depends on 6)

The method of claim 6 wherein separating the code blocks into at least the normal blocks and the anomaly blocks comprises:
identifying, as the normal blocks, a subset of the code blocks that occur frequently within the sequence of log codes; and
identifying, as the anomaly blocks, a different subset of the code blocks that occur rarely within the sequence of log codes.

### Claim 8 (depends on 7)

The method of claim 7 wherein the scoring function determines, for each potential code block of the potential code blocks, a relative dominance of the potential code block based on a description length of the sequence of log codes when encoded with a compressed representation of the potential code block.

### Claim 9 (depends on 8)

The method of claim 8 wherein each log code in the sequence of log codes comprises a symbolic representation of a possible hash value, and wherein the log data includes a code book that maps each unique log code to a different one of a set of possible hash values.

### Claim 10 (depends on 9)

The method of claim 9 wherein:
each anomaly vector of the anomaly vectors comprises a string of numbers that correspond by position to a set of possible log codes; and
generating the anomaly vectors based at least on the anomaly blocks comprises setting a value of each number in the string of numbers to indicate a presence, or lack thereof, of a corresponding one of the set of possible log codes in an anomaly block represented by the anomaly vector.

### Claim 11

A computing apparatus comprising:
one or more computer-readable storage media;
one or more processors operatively coupled with the one or more computer-readable storage media; and
program instructions stored on the one or more computer-readable storage media that, when executed by the one or more processors, direct the computing apparatus to at least:
receive log data from a plurality of nodes in a computing environment, wherein the log data comprises a sequence of information indicative of log messages produced by the plurality of nodes;
identify, in the sequence of information, dominant patterns representative of non-anomalous blocks of the log messages,
wherein to identify the dominant patterns within the sequence of information, the program instructions, when executed by the one or more processors, direct the computing apparatus to at least:
identify potential patterns within the sequence of information; and
select the dominant patterns from the potential patterns based at least on a scoring function applied to one or more of the potential patterns,
wherein the scoring function promotes a subset of the potential patterns that occur frequently within the sequence of information relative to a different subset of the potential patterns that occur less frequently within the sequence of information;
extract the non-anomalous blocks from the log data based on the dominant patterns to reveal anomalous blocks that do not fit the dominant patterns;
generate anomaly vectors based at least on the anomalous blocks; and
distribute anomaly data to at least one of the plurality of nodes to detect the anomalies, wherein the anomaly data includes the anomaly vectors.

### Claim 12 (depends on 11)

The computing apparatus of claim 11 wherein the scoring function determines, for each potential pattern of the potential patterns, a relative dominance of the potential pattern based on a description length of the sequence of information when encoded with a compressed representation of the potential pattern.

### Claim 13 (depends on 12)

The computing apparatus of claim 12 wherein the sequence of information comprises a sequence of log codes and wherein each log code of the sequence of log codes comprises a symbolic representation of a possible hash value, and wherein the log data includes a code book that maps each unique log code to a different one of a set of possible hash values.

### Claim 14 (depends on 13)

The computing apparatus of claim 13 wherein each anomaly vector of the anomaly vectors comprises a string of numbers that correspond by position to a set of possible log codes.

### Claim 15 (depends on 14)

The computing apparatus of claim 14 wherein to generate the anomaly vectors based at least on the anomaly block, the program instructions, when executed by the one or more processors, direct the computing apparatus to at least, for each one of the anomaly vectors, set a value of each number in the string of numbers to indicate a presence, or lack thereof, of a corresponding one of the set of possible log codes in an anomaly block represented by the anomaly vector.