Anomaly detection with impact assessment
AssigneeInternational Business Machines Corporation
InventorsYuk L. Chan, Anuja Deedwaniya, Robert M. Abrams
Life of this patent
Estimating the term…
Abstract
Examples described herein provide a computer-implemented method that includes detecting an anomaly associated with an object of a computer system and determining an importance classification of the object. An object relationship of the object is determined with respect to one or more other objects of the computer system. An impact score of the anomaly is determined based on the importance classification and the object relationship. An anomaly report is output with the impact score.
Claims17
A computer-implemented method comprising:
- analyzing a plurality of jobs configured to execute on a computer system;
- determining one or more objects associated with execution of the jobs;
- constructing a relationship graph comprising a plurality of nodes that link the jobs with the one or more objects;
- detecting an anomaly associated with an object of the computer system;
- determining an importance classification of the object;
- determining an object relationship of the object with respect to one or more other objects of the computer system based on the relationship graph;
- determining an impact score of the anomaly based on the importance classification and the object relationship;
- and
- outputting an anomaly report with the impact score.
A system comprising:
- a memory comprising computer readable instructions;
- and
- a processing device for executing the computer readable instructions, the computer readable instructions controlling the processing device to perform operations comprising:
- analyzing a plurality of jobs configured to execute on a computer system;
- determining one or more objects associated with execution of the jobs;
- constructing a relationship graph comprising a plurality of nodes that link the jobs with the one or more objects;
- detecting an anomaly associated with an object of the computer system;
- determining an importance classification of the object;
- determining an object relationship of the object with respect to one or more other objects of the computer system based on the relationship graph;
- determining an impact score of the anomaly based on the importance classification and the object relationship;
- and
- outputting an anomaly report with the impact score.
A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:
- analyzing a plurality of jobs configured to execute on a computer system;
- determining one or more objects associated with execution of the jobs;
- constructing a relationship graph comprising a plurality of nodes that link the jobs with the one or more objects;
- detecting an anomaly associated with an object of the computer system;
- determining an importance classification of the object;
- determining an object relationship of the object with respect to one or more other objects of the computer system based on the relationship graph;
- determining an impact score an impact score of the anomaly based on the importance classification and the object relationship;
- and
- outputting an anomaly report with the impact score.
Dependencies are inferred from the claim text.