# US 12,009,965 B2 · Methods and systems for discovering incidents through clustering of alert occurring in a data center

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,009,965 B2
- Document ID: US12009965B2
- Status: Granted
- Kind: B2
- Application number: 17/867,353
- Filed: 2022-07-18
- Published: 2024-01-18
- Granted: 2024-06-11
- Earliest claimed: 2022-07-18
- Assignees: VMware, Inc.
- Applicants: VMware LLC
- Inventors: Ashot Nshan Harutyunyan; Arnak Poghosyan; Naira Movses Grigoryan; Artur Grigoryan; Tigran Bunarjyan; Karen Aghajanyan; Vahan Tadevosyan; Tigran Avagimyants
- Web page: https://patentgrep.com/patent/US12009965B2

## CPC

- H04L 41/0609: {based on severity or priority}
- G06F 7/08: Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry (by merging two or more sets of carriers in ordered sequence G06F7/16)
- G06F 9/451: Execution arrangements for user interfaces
- G06F 16/285: {Clustering or classification}
- H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 41/12: Discovery or management of network topologies
- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Automated computer-implemented methods and systems for discovering clusters of alerts triggered by abnormal events occurring with objects in a data center are described. In one aspect, alerts with start times in a sliding run-time window are retrieved from an alerts database. Each alert corresponds to a run-time event occurring with an object of the data center. Clusters of alerts in the sliding run-time window are detected based on the start times of the alerts and topological proximity of the objects. High priority alerts in the clusters of alerts are determined based on alert types. The events associated with discovered clusters of alerts and high priority alerts are displayed in a graphical user interface (“GUI”). Time evolution clustering of alerts and coverage evolution of alerts are over time based on the start times of the alerts and topological proximity of objects exhibiting abnormal behavior in the data center.

## Claims

### Claim 1

An automated computer-implemented method for discovering incidents through clusters of alerts occurring with objects executing in a data center, the method comprising:
getting alerts with start times in a sliding run-time window from an alerts database, each alert corresponding to a run-time event occurring with an object executing in the data center;
detecting clusters of alerts in the sliding run-time window based on start times of the alerts and topological proximity of objects, each cluster of alerts corresponding to an incident occurring with objects executing in the data center,
determining high priority alerts in the clusters of alerts based on types of alerts; and
displaying discovered incidents associated with the clusters of alerts, events associated with the clusters of alerts, and high priority events in a graphical user interface (“GUI”).

### Claim 2 (depends on 1)

The method of claim 1 further comprising:
comparing run-time metric values of metrics of the data center to corresponding thresholds;
detecting run-time violations of the corresponding thresholds; and
recording alerts associate with each of the run-time violations in the alerts database.

### Claim 3 (depends on 1)

The method of claim 1 further comprising:
determining incident descriptions of the alerts of the clusters of alerts based on a hierarchy of the objects in a topological hierarchy of the data center; and
displaying the incident descriptions in the GUI.

### Claim 4 (depends on 1)

The method of claim 1 wherein detecting clusters of alerts in the sliding run-time window comprises:
partitioning the sliding run-time window into four equal duration time intervals, including an earliest interval, a second earliest interval, a third earliest interval, and a fourth earliest interval;
detecting core alerts with start times in a second earliest interval of the time intervals based on time and topological proximity of alerts in the second earliest interval;
assigning cluster identification (“ID”) to each core alert in the second earliest interval;
assigning cluster IDs of core alerts to border alerts in the earliest interval, based on the border alerts lying with neighborhoods of the core alerts;
detecting border alerts in the second earliest interval; and
advancing the sliding run-time window by the duration of the time intervals.

### Claim 5 (depends on 4)

The method of claim 4 wherein assigning cluster identification (“ID”) to each core alert in the second earliest interval comprises:
for each core alert,
in response to the core alert having two or more core alerts with different cluster IDs, assigning to the core alert the cluster ID of the cluster with a largest number core alerts,
in response to the core alert having a core alert with a cluster ID, assigning to the core alert the cluster ID, and
assigning the core alert a new cluster ID when the core alert does not contain a core alert with a cluster ID.

### Claim 6 (depends on 1)

The method of claim 1 wherein determining priorities of the alerts in the clusters of alerts based on alert types.

### Claim 7 (depends on 1)

The method of claim 1 further comprising:
sorting alerts based on start time recorded in a historical time interval;
identifying an alert as corresponding to an incident; and
for each subsequent alert,
determining whether the alert is in time and topological proximity with each alert in a cluster of alerts associated with the incident,
adding the alert to the cluster of alerts in response to the alert being in time and topological proximity with each of the alerts in the cluster, and
stating a new incident for the alert in response to the alert not being in time and topological proximity with each of the alerts in the cluster.

### Claim 8 (depends on 1)

The method of claim 1 further comprising:
for each alert recorded in a historical time period, determining a number of alerts that are within a neighborhood of the alert:
forming a first cluster of alerts from the alerts that are within a neighborhood with the largest number of alerts; and
forming a second cluster of alerts from the alerts that are within a neighborhood with the second largest number of alerts and excluded alerts in the first cluster of alerts.

### Claim 9

A computer system for discovering incidents through clusters of alerts occurring with objects executing in a data center, the computer system comprising:
one or more processors;
one or more data-storage devices; and
machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors control the system to performance operations comprising:
getting alerts with start times in a sliding run-time window from an alerts database, each alert corresponding to a run-time event occurring with an object executing in the data center;
detecting clusters of alerts in the sliding run-time window based on start times of the alerts and topological proximity of objects, each cluster of alerts corresponding to an incident occurring with objects executing in the data center;
determining high priority alerts in the clusters of alerts based on types of alerts; and
displaying discovered incidents associated with the clusters of alerts, events associated with the clusters of alerts, and high priority events in a graphical user interface (“GUI”).

### Claim 10 (depends on 9)

The computer system of claim 9 further comprising:
comparing run-time metric values of metrics of the data center to corresponding thresholds;
detecting run-time violations of the corresponding thresholds; and
recording alerts associate with each of the run-time violations in the alerts database.

### Claim 11 (depends on 9)

The computer system of claim 9 further comprising:
determining incident descriptions of the alerts of the clusters of alerts based on a hierarchy of the objects in a topological hierarchy of the data center; and
displaying the incident descriptions in the GUI.

### Claim 12 (depends on 9)

The computer system of claim 9 wherein detecting clusters of alerts in the sliding run-time window comprises:
partitioning the sliding run-time window into four equal duration time intervals, including an earliest interval, a second earliest interval, a third earliest interval, and a fourth earliest interval:
detecting core alerts with start times in a second earliest interval of the time intervals based on time and topological proximity of alerts in the second earliest interval:
assigning cluster identification (“ID”) to each core alert in the second earliest interval;
assigning cluster IDs of core alerts to border alerts in the earliest interval, based on the border alerts lying with neighborhoods of the core alerts;
detecting border alerts in the second earliest interval; and
advancing the sliding run-time window by the duration of the time intervals.

### Claim 13 (depends on 12)

The computer system of claim 12 wherein assigning cluster identification (“ID”) to each core alert in the second earliest interval comprises:
for each core alert,
in response to the core alert having two or more core alerts with different cluster IDs, assigning to the core alert the cluster ID of the cluster with a largest number core alerts,
in response to the core alert having a core alert with a cluster ID, assigning to the core alert the cluster ID, and
assigning the core alert a new cluster ID when the core alert does not contain a core alert with a cluster ID.

### Claim 14 (depends on 9)

The computer system of claim 9 wherein determining priorities of the alerts in the clusters of alerts based on alert types.

### Claim 15 (depends on 9)

The computer system of claim 9 further comprising:
sorting alerts based on start time recorded in a historical time interval;
identifying an alert as corresponding to an incident; and
for each subsequent alert,
determining whether the alert is in time and topological proximity with each alert in a cluster of alerts associated with the incident,
adding the alert to the cluster of alerts in response to the alert being in time and topological proximity with each of the alerts in the cluster, and
stating a new incident for the alert in response to the alert not being in time and topological proximity with each of the alerts in the cluster.

### Claim 16 (depends on 9)

The computer system of claim 9 further comprising:
for each alert recorded in a historical time period, determining a number of alerts that are within a neighborhood of the alert;
forming a first cluster of alerts from the alerts that are within a neighborhood with the largest number of alerts; and
forming a second cluster of alerts from the alerts that are within a neighborhood with the second largest number of alerts and excluded alerts in the first cluster of alerts.

### Claim 17

A non-transitory computer-readable medium having instructions encoded thereon for enabling one or more processors of a computer system to perform operations comprising:
getting alerts with start times in a sliding run-time window from an alerts database, each alert corresponding to a run-time event occurring with an object executing in the data center;
detecting clusters of alerts in the sliding run-time window based on start times of the alerts and topological proximity of objects, each cluster of alerts corresponding to an incident occurring with objects executing in the data center;
determining high priority alerts in the clusters of alerts based on types of alerts; and
displaying discovered incidents associated with the clusters of alerts, events associated with the clusters of alerts, and high priority events in a graphical user interface (“GUI”).

### Claim 18 (depends on 17)

The medium of claim 17 further comprising:
comparing run-time metric values of metrics of the data center to corresponding thresholds;
detecting run-time violations of the corresponding thresholds; and
recording alerts associate with each of the run-time violations in the alerts database.

### Claim 19 (depends on 17)

The medium of claim 17 further comprising:
determining incident descriptions of the alerts of the clusters of alerts based on a hierarchy of the objects in a topological hierarchy of the data center; and
displaying the incident descriptions in the GUI.

### Claim 20 (depends on 17)

The medium of claim 17 wherein detecting clusters of alerts in the sliding run-time window comprises:
partitioning the sliding run-time window into four equal duration time intervals, including an earliest interval, a second earliest interval, a third earliest interval, and a fourth earliest interval:
detecting core alerts with start times in a second earliest interval of the time intervals based on time and topological proximity of alerts in the second earliest interval;
assigning cluster identification (“ID”) to each core alert in the second earliest interval;
assigning cluster IDs of core alerts to border alerts in the earliest interval, based on the border alerts lying with neighborhoods of the core alerts;
detecting border alerts in the second earliest interval; and
advancing the sliding run-time window by the duration of the time intervals.

### Claim 21 (depends on 20)

The medium of claim 20 wherein assigning cluster identification (“ID”) to each core alert in the second earliest interval comprises:
for each core alert,
in response to the core alert having two or more core alerts with different cluster IDs, assigning to the core alert the cluster ID of the cluster with a largest number core alerts,
in response to the core alert having a core alert with a cluster ID, assigning to the core alert the cluster ID, and
assigning the core alert a new cluster ID when the core alert does not contain a core alert with a cluster ID.

### Claim 22 (depends on 17)

The medium of claim 17 wherein determining priorities of the alerts in the clusters of alerts based on alert types.

### Claim 23 (depends on 17)

The medium of claim 17 further comprising discovering clusters of alerts using time evolution clustering based on the start times of the alerts and the topological proximity of the objects.

### Claim 24 (depends on 17)

The medium of claim 17 further comprising discovering clusters of alerts using coverage evolution of alerts based on the start times of the alerts and the topological proximity of the objects.

### Claim 25 (depends on 17)

The medium of claim 17 further comprising:
sorting alerts based on start time recorded in a historical time interval;
identifying an alert as corresponding to an incident; and
for each subsequent alert,
determining whether the alert is in time and topological proximity with each alert in a cluster of alerts associated with the incident,
adding the alert to the cluster of alerts in response to the alert being in time and topological proximity with each of the alerts in the cluster, and
stating a new incident for the alert in response to the alert not being in time and topological proximity with each of the alerts in the cluster.

### Claim 26 (depends on 17)

The medium of claim 17 further comprising:
for each alert recorded in a historical time period, determining a number of alerts that are within a neighborhood of the alert;
forming a first cluster of alerts from the alerts that are within a neighborhood with the largest number of alerts; and
forming a second cluster of alerts from the alerts that are within a neighborhood with the second largest number of alerts and excluded alerts in the first cluster of alerts.