US 2003/0139905 A1Published application

Method and system for analyzing and predicting the behavior of systems

AssigneeNetuitive, Inc.

InventorsDavid Helsper, Jean-Francois Huard, David Homoki, Amanda Rasmussen, Robert Jannarone

Life of this patent

Estimating the term…

Loading patent…

Abstract

A monitoring system including a baseline model that automatically captures and models normal system behavior, a correlation model that employs multivariate autoregression analysis to detect abnormal system behavior, and an alarm service that weights and scores a variety of alerts to determine an alarm status and implement appropriate response actions. The baseline model decomposes the input variables into a number of components representing relatively predictable behaviors so that the erratic component e(t) may be isolated for further processing. These components include a global trend component, a cyclical component, and a seasonal component. Modeling and continually updating these components separately permits a more accurate identification of the erratic component of the input variable, which typically reflects abnormal patterns when they occur.

Claims43

Dependent claims

A method for analyzing and predicting the behavior of a system, comprising the steps of:

continually receiving measurements defining signatures for a plurality of input variables reflecting the behavior of the system, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial;
computing a time-based baseline mean and variance for a selected input variable based on the historical measurements for the selected input variable;
computing an erratic component for the selected input variable by comparing the measurement for the selected input value for the current time trial to the time-based baseline mean for the selected input variable;
computing an imputed estimate for the selected input variable based on erratic components computed for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables;
and
determining an alert status for the imputed estimate based on the imputed estimate and the erratic component for the input variable for the current time trial.

3 more elements

A method for analyzing and predicting the behavior of a system, comprising the steps of:

continually receiving measurements defining signatures for a plurality of input variables reflecting the behavior of the system, each signature comprising a time series of measurements including historical measurements for past time trials and a current measurement for a current time trial;
computing a time-based baseline mean and variance for a selected input variable based on the historical measurements for the selected input variable;
computing an erratic component for the selected input variable by comparing the measurement for the selected input value for the current time trial to the baseline mean for the selected input variable;
computing an imputed estimate for the selected input variable based on erratic components computed for other input variables for the current time trial and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables;
determining an alert status for the imputed estimate based on the imputed estimate and the erratic component for the input variable for the current time trial;
computing a forecast estimate for the selected input variable based on erratic components computed for other input variables and learned parameters reflecting observed relationships between the erratic component for the selected input variable and the erratic components for the other input variables;
and
determining an alert status for the forecast estimate.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 10/324,641Filed 19 Dec 2002
Priority: 19 Dec 2001
Published: 24 Jul 2003
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

G06F 11/3082
Where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting: the data…
G06F 11/3006
Monitoring arrangements specially adapted to the computing system or computing system component being monitored: where the computing system is…
G06F 11/3055
Monitoring: monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the…
G06F 11/327
Display of status information: alarm or error message display