Back to results
US 12,061,465 B2Granted
Automatic system anomaly detection
AssigneeBank of America Corporation
InventorsVasuki Anand, Prashant Khare
Life of this patent
Estimating the term…
Abstract
A system includes a production computing environment including a plurality of components, a centralized data repository that receives and stores data feeds relating to one or more components as a data log and at least one processor configured to obtain the data log of each component, generate a current state vector for the component based on the data log, compare the current state vector to a normal state vector of the component, determine that the current state vector deviates from the normal state vector, and in response, predict an anomaly associated with the component using an iterative machine learning method. The at least one processor may be configured to correct the predicted anomaly by taking at least one pre-configured action corresponding to the predicted anomaly.
Claims20
A system comprising:
- a production computing environment comprising a plurality of components including at least one hardware component and at least one software component, wherein the at least one hardware component comprises a hardware device and the at least one software component comprises a software application;
- and
- a centralized data repository that receives and stores a data feed relating to one or more of the plurality of components as a data log and wherein the data feed received for each component includes information relating to performance of the component;
- at least one processor communicatively coupled to the centralized data repository and configured to:
- obtain from the centralized data repository, the data log relating to the one or more components;
- for each component:
- generate a current state vector based on the respective data log relating to the component, wherein the current state vector represents a current performance of the component;
- compare the current state vector of the component with a normal state vector of the component, wherein the normal state vector represents normal performance of the component;
- determine that the current state vector of the component deviates, at least in part, from the normal state vector of the component;
- in response to detecting the deviation, predict an anomaly associated with the component using an iterative machine learning method based at least on the data log of the component and the determined deviation, wherein the iterative machine learning method uses a plurality of machine learning models to predict the anomaly and iteratively updates training of each of the machine learning models using at least the most current data feed received for the component;
- identify a system configuration needed to run a current workload associated with the component, wherein the current workload includes processing at least one software application;
- search each of a plurality of cloud infrastructures for a cloud instance that can support the identified system configuration;
- identify, based on the search, a cloud instance of a cloud infrastructure that can support the identified system configuration;
- switch the current workload from an original system running the current workload to the identified cloud instance;
- correct the anomaly by taking at least one pre-configured action corresponding to the predicted anomaly;
- and
- after correcting the anomaly, switch back the current workload from the identified cloud instance to the original system.
14 more elements
A method for managing anomalies in a production computing environment, comprising:
- receiving a data feed relating to one or more of a plurality of components of the production computing environment, wherein the data feed received for each component includes information relating to performance of the component, wherein the plurality of components includes at least one hardware component and at least one software component, wherein the at least one hardware component comprises a hardware device and the at least one software component comprises a software application;
- storing the data feed received for each component in a centralized data repository as a data log;
- for each component:
- generating a current state vector based on the respective data log relating to the component, wherein the current state vector represents a current performance of the component;
- comparing the current state vector of the component with a normal state vector of the component, wherein the normal state vector represents normal performance of the component;
- determining that the current state vector of the component deviates, at least in part, from the normal state vector of the component;
- in response to detecting the deviation, predicting an anomaly associated with the component using an iterative machine learning method based at least on the data log of the component and the determined deviation, wherein the iterative machine learning method uses a plurality of machine learning models to predict the anomaly and iteratively updates training of each of the machine learning models using at least the most current data feed received for the component;
- identifying a system configuration needed to run a current workload associated with the component, wherein the current workload includes processing at least one software application;
- searching each of a plurality of cloud infrastructures for a cloud instance that can support the identified system configuration;
- identifying, based on the search, a cloud instance of a cloud infrastructure that can support the identified system configuration;
- switching the current workload from an original system running the current workload to the identified cloud instance;
- correcting the anomaly by taking at least one pre-configured action corresponding to the predicted anomaly;
- and
- after correcting the anomaly, switching back the current workload from the identified cloud instance to the original system.
11 more elements
A non-transitory computer-readable medium for managing anomalies in a production computing environment, wherein the non-transitory computer-readable medium stores instructions which when executed by a processor performs a method comprising:
- receiving a data feed relating to one or more of a plurality of components of the production computing environment, wherein the data feed received for each component includes information relating to performance of the component, wherein the plurality of components includes at least one hardware component and at least one software component, wherein the at least one hardware component comprises a hardware device and the at least one software component comprises a software application;
- storing the data feed received for each component in a centralized data repository as a data log;
- for each component:
- generating a current state vector based on the respective data log relating to the component, wherein the current state vector represents a current performance of the component;
- comparing the current state vector of the component with a normal state vector of the component, wherein the normal state vector represents normal performance of the component;
- determining that the current state vector of the component deviates, at least in part, from the normal state vector of the component;
- in response to detecting the deviation, predicting an anomaly associated with the component using an iterative machine learning method based at least on the data log of the component and the determined deviation, wherein the iterative machine learning method uses a plurality of machine learning models to predict the anomaly and iteratively updates training of each of the machine learning models using at least the most current data feed received from the component;
- identifying a system configuration needed to run a current workload associated with the component, wherein the current workload includes processing at least one software application;
- searching each of a plurality of cloud infrastructures for a cloud instance that can support the identified system configuration;
- identifying, based on the search, a cloud instance of a cloud infrastructure that can support the identified system configuration;
- switching the current workload from an original system running the current workload to the identified cloud instance;
- correcting the anomaly by taking at least one pre-configured action corresponding to the predicted anomaly;
- and
- after correcting the anomaly, switching back the current workload from the identified cloud instance to the original system.
11 more elements
Dependencies are inferred from the claim text.