# US 12,603,906 B2 · Alert monitoring of data based on recommended attribute values > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,906 B2 - Document ID: US12603906B2 - Status: Granted - Kind: B2 - Application number: 18/369,718 - Filed: 2023-09-18 - Published: 2024-10-24 - Granted: 2026-04-14 - Earliest claimed: 2023-04-24 - Assignees: StarTree, Inc. - Applicants: StarTree, Inc. - Inventors: Kishore Gopalakrishna; Madhumita Mantri; Suvodeep Pyne; Cyril De Catheu - Web page: https://patentgrep.com/patent/US12603906B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various embodiments described herein support or provide for alert monitoring of data (e.g., metric data) based on one or more recommended attribute values (e.g. dimension values), which can facilitate generation of alerts for the data based on detected anomalies. In particular, an embodiment can determine one or more recommended attribute values associated with data being analyzed for anomalies (e.g., metric data), select (or facilitate selection of) one or more of the recommended attribute values, configure alert monitoring for the data based on one or more selected attribute values, and enable the alert monitoring. Once enabled, the alert monitoring can trigger an alert in response to detecting one or more anomalies in the metric data associated with the one or more selected attribute values. ## Claims ### Claim 1 A system comprising: a memory storing instructions; and one or more hardware processors communicatively coupled to the memory and configured by the instructions to perform operations comprising: accessing current time series data that comprises a time series of measurement values for a metric over a period of time, the time series comprising a set of attribute values associated with each measurement value in the time series; performing a graph-based process on the time series of measurement values to determine a plurality of candidate attribute value sets for anomaly alert monitoring of the metric based on sets of attribute values associated with the time series of measurement values, the performing of the graph-based process comprising: generating a tree that comprises: a root node associated with all measurement values in the time series; a plurality of children nodes, each child node of the plurality of children nodes being associated with a different attribute value set; and a plurality of connections, each connection of the plurality of connections from a parent node to a child node being associated with a weight determined based on: an individual count of measurement values that are in a portion of the time series and that are associated with an individual attribute value set associated with the child node; and a total count of measurement values in the time series; and traversing the tree to determine the plurality of candidate attribute value sets based on weights of one or more connections of the plurality of connections; selecting, from the plurality of candidate attribute value sets, a set of select attributes values based on at least one of user selection or automatic selection according to a set of criteria; configuring a new anomaly alert monitor based on the set of select attributes values; based on the new anomaly alert monitor, using a set of trained models to monitor new time series data for the metric based on the set of select attributes values and to detect whether any value anomalies exist in the new time series data; and causing an alert to be triggered, based on the new anomaly alert monitor, in response to detecting at least one value anomaly in the new time series data. ### Claim 2 (depends on 1) The system of claim 1, wherein the selecting of the set of select attributes values based on the user selection comprises: obtaining the user selection by causing at least a portion of the plurality of candidate attribute value sets to be presented on one or more displays. ### Claim 3 (depends on 1) The system of claim 1, wherein the selecting of the set of select attributes values based on the user selection comprises: obtaining the user selection by causing at least a portion of the plurality of candidate attribute value sets to be presented on one or more displays with respective weights. ### Claim 4 (depends on 1) The system of claim 1, wherein an individual weight of an individual weighted connection from a first node to a second node is determined based on the total count of measurement values and an individual count of measurement values that are in a portion of the time series and that are associated with an individual attribute value set of the different attribute value set, the second node being associated with the individual attribute value set. ### Claim 5 (depends on 1) The system of claim 1, wherein the weight is determined by dividing the individual count of measurement values by the total count of measurement values in the time series. ### Claim 6 (depends on 1) The system of claim 1, wherein the performing of the graph-based process on the time series of measurement values to determine the plurality of candidate attribute value sets is further based on a time window. ### Claim 7 (depends on 1) The system of claim 1, wherein the performing of the graph-based process on the time series of measurement values to determine the plurality of candidate attribute value sets is further based on a search depth. ### Claim 8 (depends on 1) The system of claim 1, wherein the performing of the graph-based process on the time series of measurement values to determine the plurality of candidate attribute value sets is further based on a threshold value. ### Claim 9 (depends on 1) The system of claim 1, wherein the performing of the graph-based process on the time series of measurement values to determine the plurality of candidate attribute value sets is further based on a database filter. ### Claim 10 (depends on 1) The system of claim 1, wherein the performing of the graph-based process on the time series of measurement values to determine the plurality of candidate attribute value sets is further based on a select set of attributes. ### Claim 11 A non-transitory computer-readable medium comprising instructions that, when executed by a hardware processor of a device, cause the device to perform operations comprising: accessing current time series data that comprises a time series of measurement values for a metric over a period of time, the time series comprising a set of attribute values associated with each measurement value in the time series; performing a graph-based process on the time series of measurement values to determine a plurality of candidate attribute value sets for anomaly alert monitoring of the metric based on sets of attribute values associated with the time series of measurement values, the performing of the graph-based process comprising: generating a tree that comprises: a root node associated with all measurement values in the time series; a plurality of children nodes, each child node of the plurality of children nodes being associated with a different attribute value set; and a plurality of connections, each connection of the plurality of connections from a parent node to a child node being associated with a weight determined based on: an individual count of measurement values that are in a portion of the time series and that are associated with an individual attribute value set associated with the child node; and a total count of measurement values in the time series; and traversing the tree to determine the plurality of candidate attribute value sets based on weights of one or more connections of the plurality of connections; selecting, from the plurality of candidate attribute value sets, a set of select attributes values based on at least one of user selection or automatic selection according to a set of criteria; configuring a new anomaly alert monitor based on the set of select attributes values; based on the new anomaly alert monitor, using a set of trained models to monitor new time series data for the metric based on the set of select attributes values and to detect whether any value anomalies exist in the new time series data; and causing an alert to be triggered, based on the new anomaly alert monitor, in response to detecting at least one value anomaly in the new time series data. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the selecting of the set of select attributes values based on the user selection comprises: obtaining the user selection by causing at least a portion of the plurality of candidate attribute value sets to be presented on one or more displays. ### Claim 13 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the selecting of the set of select attributes values based on the user selection comprises: obtaining the user selection by causing at least a portion of the plurality of candidate attribute value sets to be presented on one or more displays with respective weights. ### Claim 14 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein an individual weight of an individual weighted connection from a first node to a second node is determined based on the total count of measurement values and an individual count of measurement values that are in a portion of the time series and that are associated with an individual attribute value set of the different attribute value set, the second node being associated with the individual attribute value set. ### Claim 15 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the weight is determined by dividing the individual count of measurement values by the total count of measurement values in the time series. ### Claim 16 A method comprising: accessing, by one or more hardware processors, current time series data that comprises a time series of measurement values for a metric over a period of time, the time series comprising a set of attribute values associated with each measurement value in the time series; performing, by the one or more hardware processors, a graph-based process on the time series of measurement values to determine a plurality of candidate attribute value sets for anomaly alert monitoring of the metric based on sets of attribute values associated with the time series of measurement values, the performing of the graph-based process comprising: generating a tree that comprises: a root node associated with all measurement values in the time series; a plurality of children nodes, each child node of the plurality of children nodes being associated with a different attribute value set; and a plurality of connections, each connection of the plurality of connections from a parent node to a child node being associated with a weight determined based on: an individual count of measurement values that are in a portion of the time series and that are associated with an individual attribute value set associated with the child node; and a total count of measurement values in the time series; and traversing the tree to determine the plurality of candidate attribute value sets based on weights of one or more connections of the plurality of connections; selecting, by the one or more hardware processors and from the plurality of candidate attribute value sets, a set of select attributes values based on at least one of user selection or automatic selection according to a set of criteria; configuring, by the one or more hardware processors, a new anomaly alert monitor based on the set of select attributes values; based on the new anomaly alert monitor, using a set of trained models by the one or more hardware processors to monitor new time series data for the metric based on the set of select attributes values and to detect whether any value anomalies exist in the new time series data; and causing, by the one or more hardware processors, an alert to be triggered in response to detecting at least one value anomaly in the new time series data. ### Claim 17 (depends on 16) The method of claim 16, wherein the selecting of the set of select attributes values based on the user selection comprises: obtaining the user selection by causing at least a portion of the plurality of candidate attribute value sets to be presented on one or more displays. ### Claim 18 (depends on 16) The method of claim 16, wherein the selecting of the set of select attributes values based on the user selection comprises: obtaining the user selection by causing at least a portion of the plurality of candidate attribute value sets to be presented on one or more displays with respective weights. ### Claim 19 (depends on 16) The method of claim 16, wherein an individual weight of an individual weighted connection from a first node to a second node is determined based on the total count of measurement values and an individual count of measurement values that are in a portion of the time series and that are associated with an individual attribute value set of the different attribute value set, the second node being associated with the individual attribute value set. ### Claim 20 (depends on 16) The method of claim 16, wherein the weight is determined by dividing the individual count of measurement values by the total count of measurement values in the time series.