# US 2020/0396232 A1 · Generating data structures representing relationships among entities of a high-scale network infrastructure > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396232 A1 - Document ID: US20200396232A1 - Status: Published application - Kind: A1 - Application number: 16/442,192 - Filed: 2019-06-14 - Published: 2020-12-17 - Earliest claimed: 2019-06-14 - Assignees: Datadog, Inc. - Applicants: Datadog, Inc. - Inventors: Homin Lee - Web page: https://patentgrep.com/patent/US20200396232A1 ## CPC - G06F 11/323: {Visualisation of programs or trace data} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3051: {Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247)} - G06F 16/24578: {using ranking} - G06F 17/40: Data acquisition and logging (for input to computer G06F3/00) - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies} - H04L 41/069: using logs of notifications; Post-processing of notifications - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A data structure is provided that identifies relationships between entities of an infrastructure of a computing system and that is configured to update in response to changes in the infrastructure of the computing system. The data structure includes vertices and edges, where each vertex of the data structure represents an entity of the infrastructure, and where each edge of the data structure represents a relationship between entities of the infrastructure. When usage data are received, the usage data are analyzed to determine a correlation between a first operation specifying a first entity and a second operation specifying a second entity. An edge between the first entity specified by the first operation and the second entity specified by the second operation is generated. Event data comprising usage data specifying either the first entity or the second entity is generated. ## Claims ### Claim 1 A method for providing a data structure that identifies relationships between entities of an infrastructure of a computing system and that is configured to update in response to changes in the infrastructure of the computing system, the method comprising: receiving usage data representing a plurality of operations performed by the computing system, the usage data specifying, for each operation of the plurality, at least one entity of the infrastructure of the computing system that is related to that operation; retrieving the data structure comprising vertices and edges, wherein each vertex of the data structure represents an entity of the infrastructure, and wherein each edge of the data structure represents a relationship between entities of the infrastructure; analyzing the usage data to determine a correlation between a first operation specifying a first entity and a second operation specifying a second entity; generating an edge between the first entity specified by the first operation and the second entity specified by the second operation; and generating event data comprising usage data specifying either the first entity or the second entity, wherein a format of the event data corresponds to positions of the first entity and the second entity in the data structure. ### Claim 2 (depends on 1) The method of claim 1, wherein the event data is generated in response to receiving a receiving a query specifying at least one of the first entity and the second entity. ### Claim 3 (depends on 1) The method of claim 1, wherein the format of event data comprises a ranking of portions of the usage data specifying the first entity or the second entity, the ranking derived from traversing the data structure. ### Claim 4 (depends on 1) The method of claim 1, wherein the event data comprises a root cause analysis specifying a common source of anomalies related to the computing system, and wherein the root cause analysis comprises traversing the data structure from the first entity or second entity. ### Claim 5 (depends on 1) The method of claim 1, wherein the generated edge is associated with a confidence score that is derived from the correlation, and wherein the method further comprises: updating the confidence score of the generated edge of the data structure in response to receiving additional usage data representing additional operations that specify the first entity, the second entity, or both the first and second entities. ### Claim 6 (depends on 5) The method of claim 5, further comprising: selecting a given vertex representing a given entity of the infrastructure; and generating a cluster of entities including the given entity by traversing the data structure along the vertices and the edges, starting with the given vertex, wherein an additional entity is added to the cluster of entities when the confidence score associated with an edge connecting a vertex representing the additional entity to another vertex representing a clustered entity exceeds a threshold value. ### Claim 7 (depends on 5) The method of claim 5, wherein the confidence score of the generated edge is adjusted based on a comparison of an entity type associated with the first entity and the entity type associated with the second entity. ### Claim 8 (depends on 1) The method of claim 1, wherein analyzing the usage data to determine the correlation comprises determining that the first operation and the second operation each occur within a threshold period of time with respect to each other. ### Claim 9 (depends on 1) The method of claim 1, wherein analyzing the usage data to determine the correlation comprises determining that the first operation and the second operation were caused by a common user. ### Claim 10 (depends on 1) The method of claim 1, wherein analyzing the usage data to determine the correlation comprises analyzing network traffic to determine that the first operation is upstream of the second operation. ### Claim 11 (depends on 1) The method of claim 1, wherein the usage data specifies a new entity that is not represented in the data structure, and wherein the method further comprises: adding a new vertex representing the new entity to the data structure; determining that an existing entity is related to the new entity based on a relationship that is explicitly specified in the usage data; and adding a new edge relating the new vertex to an existing vertex of the data structure representing the existing entity. ### Claim 12 (depends on 1) The method of claim 1, further comprising: determining, based on the usage data, that a given entity of the infrastructure is not related to any operations of the plurality of operations for longer than a threshold period of time; and removing, in response to the determining, a given vertex representing the given entity from the data structure. ### Claim 13 (depends on 1) The method of claim 1, wherein the entity comprises one of a performance metric of the computing system, an alert specifying behavior of the computing system, a service responsive to a request received by the computing system, a team representing a plurality of users of the computing system, a tag, or a dashboard configured to report data about the computing system. ### Claim 14 (depends on 1) The method of claim 1, wherein the usage data includes at least one of a data log, an application trace, an alert, and a performance metric of the computing system. ### Claim 15 A method for processing data representing operations of an infrastructure of a computing system to identify relationships between entities of the infrastructure, the method comprising: receiving a request for event data that represents operations of the computing system that are related to a given entity of the infrastructure of the computing system; retrieving a data structure comprising vertices and edges, wherein each vertex of the data structure represents an entity of the infrastructure and wherein each edge of the data structure represents a relationship between entities of the infrastructure, wherein at least one edge represents a determined relationship between a first entity and a second entity based on an analysis of first operations specifying the first entity and second operations specifying the second entity; selecting a given vertex representing the given entity of the infrastructure; generating a set of entities including the given entity by traversing the data structure along the vertices and the edges, starting with the given vertex; retrieving usage data for each entity of the set; generating the event data by ordering the usage data in an order that is derived from traversing the data structure; and outputting the event data. ### Claim 16 (depends on 15) The method of claim 15, further comprising providing a prediction of a future anomaly of the computing system, the prediction derived from the order of the usage data in the event data. ### Claim 17 (depends on 15) The method of claim 15, wherein the event data comprises a root cause analysis for anomalies related to the computing system, the root cause analysis specifying a common source for the anomalies. ### Claim 18 (depends on 15) The method of claim 15, further comprising generating a message including at least one suggestion for remediation of at least one anomaly of the computing system. ### Claim 19 (depends on 15) The method of claim 15, wherein an additional entity is added to the set of entities when a confidence score associated with an edge connecting a vertex representing the additional entity to another vertex representing an entity of the set exceeds a threshold value. ### Claim 20 (depends on 15) The method of claim 15, wherein the entity comprises one of a performance metric of the computing system, an alert specifying behavior of the computing system, a service responsive to a request received by the computing system, a team representing a plurality of users of the computing system, a tag, or a dashboard configured to report data about the computing system. ### Claim 21 A system for providing a data structure that identifies relationships between entities of an infrastructure of a computing system and that is configured to update in response to changes in the infrastructure of the computing system, the computing system comprising: a memory configured for storing data structure data; and a data structure module configured to perform operations comprising: receiving usage data representing a plurality of operations performed by the computing system, the usage data specifying, for each operation of the plurality, at least one entity of the infrastructure of the computing system that is related to that operation; retrieving the data structure from the memory, the data structure comprising vertices and edges, wherein each vertex of the data structure represents an entity of the infrastructure, and wherein each edge of the data structure represents a relationship between entities of the infrastructure; analyzing the usage data to determine a correlation between a first operation specifying a first entity and a second operation specifying a second entity; generating an edge between the first entity specified by the first operation and the second entity specified by the second operation; and generating event data comprising usage data specifying either the first entity or the second entity, wherein a format of the event data corresponds to positions of the first entity and the second entity in the data structure. ### Claim 22 (depends on 21) The system of claim 21, wherein the event data is generated in response to receiving a receiving a query specifying at least one of the first entity and the second entity. ### Claim 23 (depends on 21) The system of claim 21, wherein the format of event data comprises a ranking of portions of the usage data specifying the first entity or the second entity, the ranking derived from traversing the data structure. ### Claim 24 (depends on 21) The system of claim 21, wherein the event data comprises a root cause analysis specifying a common source of anomalies related to the computing system, and wherein the root cause analysis comprises traversing the data structure from the first entity or second entity. ### Claim 25 (depends on 21) The system of claim 21, wherein the generated edge is associated with a confidence score that is derived from the correlation, and wherein the operations further comprise: updating the confidence score of the generated edge of the data structure in response to receiving additional usage data representing additional operations that specify the first entity, the second entity, or both the first and second entities. ### Claim 26 (depends on 25) The system of claim 25, wherein the operations further comprise: selecting a given vertex representing a given entity of the infrastructure; and generating a cluster of entities including the given entity by traversing the data structure along the vertices and the edges, starting with the given vertex, wherein an additional entity is added to the cluster of entities when the confidence score associated with an edge connecting a vertex representing the additional entity to another vertex representing a clustered entity exceeds a threshold value. ### Claim 27 (depends on 25) The system of claim 25, wherein the confidence score of the generated edge is adjusted based on a comparison of an entity type associated with the first entity and the entity type associated with the second entity. ### Claim 28 (depends on 21) The system of claim 21, wherein analyzing the usage data to determine the correlation comprises determining that the first operation and the second operation each occur within a threshold period of time with respect to each other. ### Claim 29 A system configured to process data representing operations of an infrastructure of a computing system to identify relationships between entities of the infrastructure, the computing system comprising: a memory configured for storing data structure data; and a query response module configured to perform operations comprising: receiving a request for event data that represents operations of the computing system that are related to a given entity of the infrastructure of the computing system; retrieving, from the memory, a data structure comprising vertices and edges, wherein each vertex of the data structure represents an entity of the infrastructure and wherein each edge of the data structure represents a relationship between entities of the infrastructure, wherein at least one edge represents a determined relationship between a first entity and a second entity based on an analysis of first operations specifying the first entity and second operations specifying the second entity; selecting a given vertex representing the given entity of the infrastructure; generating a set of entities including the given entity by traversing the data structure along the vertices and the edges, starting with the given vertex; retrieving usage data for each entity of the set; generating the event data by ordering the usage data in an order that is derived from traversing the data structure; and outputting the event data. ### Claim 30 (depends on 29) The system of claim 29, wherein the operations further comprise providing a prediction of a future anomaly of the computing system, the prediction derived from the order of the usage data in the event data. ### Claim 31 (depends on 29) The system of claim 29, wherein the event data comprises a root cause analysis of anomalies related to the computing system, the root cause analysis specifying a common source for the anomalies. ### Claim 32 (depends on 29) The system of claim 29, wherein the operations further comprise generating a message including at least one suggestion for remediation of at least one anomaly of the computing system. ### Claim 33 (depends on 29) The system of claim 29, wherein an additional entity is added to the set of entities when a confidence score associated with an edge connecting a vertex representing the additional entity to another vertex representing an entity of the set exceeds a threshold value. ### Claim 34 (depends on 29) The system of claim 29, wherein the entity comprises one of a performance metric of the computing system, an alert specifying behavior of the computing system, a service responsive to a request received by the computing system, a team representing a plurality of users of the computing system, a tag, or a dashboard configured to report data about the computing system. ### Claim 35 One or more non-transitory computer readable media storing instructions that are executable by one or more processors configured to perform operations comprising: receiving usage data representing a plurality of operations performed by a computing system, the usage data specifying, for each operation of the plurality, at least one entity of an infrastructure of the computing system that is related to that operation; retrieving the data structure comprising vertices and edges, wherein each vertex of the data structure represents an entity of the infrastructure, and wherein each edge of the data structure represents a relationship between entities of the infrastructure; analyzing the usage data to determine a correlation between a first operation specifying a first entity and a second operation specifying a second entity; generating an edge between the first entity specified by the first operation and the second entity specified by the second operation; and generating event data comprising usage data specifying either the first entity or the second entity, wherein a format of the event data corresponds to positions of the first entity and the second entity in the data structure. ### Claim 36 One or more non-transitory computer readable media storing instructions that are executable by one or more processors configured to perform operations comprising: receiving a request for event data that represents operations of a computing system that are related to a given entity of an infrastructure of the computing system; retrieving a data structure comprising vertices and edges, wherein each vertex of the data structure represents an entity of the infrastructure and wherein each edge of the data structure represents a relationship between entities of the infrastructure, wherein at least one edge represents a determined relationship between a first entity and a second entity based on an analysis of first operations specifying the first entity and second operations specifying the second entity; selecting a given vertex representing the given entity of the infrastructure; generating a set of entities including the given entity by traversing the data structure along the vertices and the edges, starting with the given vertex; retrieving usage data for each entity of the set; generating the event data by ordering the usage data in an order that is derived from traversing the data structure; and outputting the event data.