Back to results
US 11,636,311 B2Granted
Anomaly detection based on predicted textual characters
AssigneeSplunk Inc.
InventorsAdam Oliner, Zidong Yang, Sinduja Sreshta
Life of this patent
Estimating the term…
Abstract
Described herein is a technology that facilitates the production of and the use of automated datagens for event-based systems. A datagen (i.e., data-generator or data generation system) is a component, module, or subsystem of computer systems that searches, monitors, and analyzes machine data. Existing datagens are not capable of detecting an anomaly in machine data. An anomaly is a variance in the input data stream that exceeds some acceptable amount of deviation from the norm (i.e., standard, expectation, etc.). An embodiment of datagen, in accordance with the technology described herein, detects anomalies in the input machine data.
Claims30
A computer-implemented method for detecting anomalies in event-based system, the method comprising:
- receiving a stream of events, each of the events having a portion of raw machine data comprising a sequence of textual characters and associated with a timestamp representing a time at which the raw machine data was received or generated, the raw machine data produced by a component within an information technology environment and relating to activities or operations in the information technology environment;
- determining, by inputting a particular sequence of textual characters of an event from the stream into a trained neural network, a prediction of a forthcoming group of one or more textual characters of a forthcoming new event of the stream;
- receiving an actual group of one or more textual characters of the forthcoming new event of the stream;
- determining a value based on a result of comparing the prediction of the forthcoming group of one or more textual characters of the forthcoming new event of the stream, determined via the trained neural network, with the actual group of one or more textual characters of the forthcoming new event of the stream, wherein the value is proportional to a degree of contrast between the prediction of the forthcoming group to the received actual group of textual characters;
- determining that the value is outside a range of defined acceptable values;
- and
- reporting an anomaly in response to the determining that the value is outside the range.
4 more elements
One or more computer-readable media storing instructions thereon that, when executed by one or more processors, direct the one or more processors to perform operations comprising:
- receiving a stream of events, each of the events having a portion of raw machine data comprising a sequence of textual characters and associated with a timestamp representing a time at which the raw machine data was received or generated, the raw machine data produced by a component within an information technology environment and relating to activities or operations in the information technology environment,
- determining, by inputting a particular sequence of textual characters of an event from the stream into a trained neural network, a prediction of a forthcoming group of one or more textual characters of a forthcoming new event of the stream;
- receiving an actual group of one or more textual characters of the forthcoming new event of the stream;
- determining a value based on a result of comparing the prediction of the forthcoming group of one or more textual characters of the forthcoming new event of the stream, determined via the trained neural network, with the actual group of one or more textual characters of the forthcoming new event of the stream, wherein the value is proportional to a degree of contrast between the prediction of the forthcoming group to the received actual group of textual characters;
- determining that the value is outside a range of defined acceptable values;
- and
- reporting an anomaly in response to the determining that the value is outside the range.
4 more elements
An automated data generation system comprising:
- one or more processors;
- and
- computer memory having instructions stored thereon, the instructions, when executed by the one or more processors causing the system to perform operations comprising:
- receiving a stream of events, each of the events having a portion of raw machine data comprising a sequence of textual characters and associated with a timestamp representing a time at which the raw machine data was received or generated, the raw machine data produced by a component within an information technology environment and relating to activities or operations in the information technology environment;
- determining, by inputting a particular sequence of textual characters of an event from the stream into a trained neural network, a prediction of a forthcoming group of one or more textual characters of a forthcoming new event of the stream;
- receiving an actual group of one or more textual characters of the forthcoming new event of the stream;
- determining a value based on a result of comparing the prediction of the forthcoming group of one or more textual characters of the forthcoming new event of the stream, determined via the trained neural network, with the actual group of one or more textual characters of the forthcoming new event of the stream, wherein the value is proportional to a degree of contrast between the prediction of the forthcoming group to the received actual group of textual characters;
- determining that the value is outside a range of defined acceptable values;
- and
- reporting an anomaly in response to the determining that the value is outside the range.
7 more elements
Dependencies are inferred from the claim text.