# US 2019/0171516 A1 · Data stream processor and method to counteract anomalies in data streams transiting a distributed computing system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0171516 A1 - Document ID: US20190171516A1 - Status: Published application - Kind: A1 - Application number: 16/166,593 - Filed: 2018-10-22 - Published: 2019-06-06 - Earliest claimed: 2015-11-06 - Assignees: HomeAway.com, Inc. - Applicants: HomeAway.com, Inc. - Inventors: Rene X. Parra - Web page: https://patentgrep.com/patent/US20190171516A1 ## CPC - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/3409: {for performance assessment} - G06F 11/3428: {Benchmarking} - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 41/5006: Creating or negotiating SLA contracts, guarantees or penalties - H04L 43/16: Threshold monitoring - G06F 11/34: Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation {; Recording or statistical evaluation of user activity, e.g. usability assessment} - G06F 2201/87: Monitoring of transactions - G06N 20/00: Machine learning - H04L 43/0823: Errors, e.g. transmission errors - H04L 43/0852: Delays - H04L 43/0888: Throughput - H04L 43/50: Testing arrangements - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Various embodiments relate generally to electrical and electronic hardware, computer software and systems for controlling a data stream processor configured to detect and/or resolve anomalies in data streams including message data. In particular, a system, a device and a method may be configured to access multiple data streams and to detect an anomaly, in real-time or in substantially real-time, that is associated with at least one of the data streams accessed by a data stream processor. In some examples, a method can include one or more of receiving message data to facilitate a computerized rental of property, classifying subset of messages, fetching the classified messages to form multiple data streams, accessing the data stream to indemnity a stream characteristic, detecting an anomaly based on an identified stream characteristic, and generating anomaly resolution data to counteract the detected anomaly. ## Claims ### Claim at position 1 -20. (canceled) ### Claim 21 A computer-implemented method comprising: as performed by a computing system comprising one or more computer processors configured to execute specific instructions, classifying a set of messages into a plurality of subsets of messages, wherein a message in a first subset of messages of the plurality of subsets of messages represents a programmatic call; monitoring transmission of a plurality of data streams between computing devices, wherein the plurality of data streams includes a first data stream, and wherein the first data stream comprises messages in the first subset of messages; determining a first stream characteristic of the first data stream based at least partly on monitoring transmission of the first data stream; determining an anomaly threshold associated with the first stream characteristic based at least partly on an analysis of messages in the first subset of messages; detecting an anomaly associated with the first data stream based at least partly on the first stream characteristic and the anomaly threshold; and generating anomaly resolution data regarding the anomaly. ### Claim 22 (depends on 21) The computer-implemented method of claim 21, wherein determining the anomaly threshold associated with the first stream characteristic comprises determining an updated value of the anomaly threshold to replace a prior value of the anomaly threshold, wherein the prior value of the anomaly threshold is based at least partly on a prior analysis of messages in the first subset of messages. ### Claim 23 (depends on 21) The computer-implemented method of claim 21, wherein the analysis of messages in the first subset of messages comprises analyzing messages in the first subset of messages in comparison with messages in a second subset of messages. ### Claim 24 (depends on 21) The computer-implemented method of claim 21, wherein the analysis of messages in the first subset of messages comprises: analyzing messages in the first subset of messages over a period of time; and identifying a parametric value associated with an anomaly occurring during the period of time. ### Claim 25 (depends on 21) The computer-implemented method of claim 21, wherein the analysis of messages in the first subset of messages comprises: determining a plurality of parametric values associated with the first data stream, wherein a first parametric value of the plurality of parametric values represents a value of the first stream characteristic, and wherein a second parametric value of the plurality of parametric values represents a value of a second stream characteristic; determining a correlated subset of the plurality of parametric values; and determining that the correlated subset of the plurality parametric values are non-anomalous. ### Claim 26 (depends on 25) The computer-implemented method of claim 25, wherein determining the anomaly threshold associated with the first stream characteristic comprises determining the anomaly threshold based at least partly on the analysis of messages in the first subset of messages and the correlated subset of the plurality of parametric values. ### Claim 27 (depends on 25) The computer-implemented method of claim 25, wherein determining the plurality of parametric values comprises identifying, in the first data stream, parametric data regarding one or more of: a computer identifier, a transit time, or a message type. ### Claim 28 (depends on 25) The computer-implemented method of claim 25, further comprising training a machine learning model using the correlated subset of the plurality of parametric values, wherein determining that the correlated subset of the plurality of parametric values are non-anomalous comprises classifying the correlated subset of the plurality of parametric values using the machine learning model. ### Claim 29 (depends on 21) The computer-implemented method of claim 21, wherein the determining the first stream characteristic is performed in real-time as data in the first data stream transits between a data store storing the plurality of subsets of messages and a consumer device configured to consume data in the first data stream. ### Claim 30 (depends on 21) The computer-implemented method of claim 21, wherein generating the anomaly resolution data comprises generating at least one of: alert data or corrective action data. ### Claim 31 A system comprising: computer-readable storage storing executable instructions; and one or more processors in communication with the computer-readable storage and configured by the executable instructions to at least: classify a set of messages into a plurality of subsets of messages, wherein a message in a first subset of messages of the plurality of subsets of messages represents a programmatic call; monitor transmission of a plurality of data streams between computing devices, wherein the plurality of data streams includes a first data stream, and wherein the first data stream comprises messages in the first subset of messages; determine a first stream characteristic of the first data stream based at least partly on monitoring transmission of the first data stream; determine an anomaly threshold associated with the first stream characteristic based at least partly on messages in the first subset of messages; detect an anomaly associated with the first data stream based at least partly on the first stream characteristic and the anomaly threshold; and generate anomaly resolution data regarding the anomaly. ### Claim 32 (depends on 31) The system of claim 31, wherein to determine the anomaly threshold associated with the first stream characteristic, the one or more processors are further configured by the executable instructions to at least: determine an updated value of the anomaly threshold to replace a prior value of the anomaly threshold, wherein the prior value of the anomaly threshold is determined based at least partly on a prior analysis of messages in the first subset of messages. ### Claim 33 (depends on 31) The system of claim 31, wherein to determine the anomaly threshold associated with the first stream characteristic, the one or more processors are further configured by the executable instructions to at least analyze the messages in the first subset of messages in comparison with messages in a second subset of messages. ### Claim 34 (depends on 31) The system of claim 31, wherein to determine the anomaly threshold associated with the first stream characteristic, the one or more processors are further configured by the executable instructions to at least: analyze the messages in the first subset of messages over a period of time; and identify a parametric value associated with an anomaly occurring during the period of time. ### Claim 35 (depends on 31) The system of claim 31, wherein the one or more processors are further configured by the executable instructions to at least: determine a plurality of parametric values associated with the first data stream, wherein a first parametric value of the plurality of parametric values represents a value of the first stream characteristic, and wherein a second parametric value of the plurality of parametric values represents a value of a second stream characteristic; determine a correlated subset of the plurality of parametric values; and determine that the correlated subset of the plurality parametric values are non-anomalous. ### Claim 36 (depends on 35) The system of claim 35, wherein the one or more processors are further configured by the executable instructions to determine the anomaly threshold associated with the first stream characteristic based at least partly on the messages in the first subset of messages and the correlated subset of the plurality of parametric values. ### Claim 37 (depends on 35) The system of claim 35, wherein to determine the plurality of parametric values, the one or more processors are further configured by the executable instructions to identify, in the first data stream, parametric data regarding one or more of: a computer identifiers a transit time, or a message type. ### Claim 38 (depends on 35) The system of claim 35, wherein the one or more processors are further configured by the executable instructions to at least train a machine learning model using the correlated subset of the plurality of parametric values, and wherein to determine that the correlated subset of the plurality of parametric values are non-anomalous, the one or more processors are further configured by the executable instructions to at least classify the correlated subset of the plurality of parametric values using the machine learning model. ### Claim 39 (depends on 31) The system of claim 31, wherein to determine the first stream characteristic, the one or more processors are further configured by the executable instructions to at least determine the first stream characteristic in real-time as data in the first data stream transits between a data store storing the subsets of messages and a consumer device configured to consume data in the first data stream. ### Claim 40 (depends on 31) The system of claim 31, wherein to generate the anomaly resolution data, the one or more processors are further configured by the executable instructions to at least generate at least one of: alert data or corrective action data.