Self-learning method and system for detecting abnormalities

One or more computer storage media having computer-useable instructions embodied thereon for performing a method for detecting abnormalities occurring during a process based upon a continuously updated signature representative of the process, the method comprising:

• creating a signature representative of the process;
• continuously updating the created signature with a weighting scheme;
• continuously monitoring a system parameter;
• computing a normal range of values for the system parameter based on the continuously updated signature;
• determining if the monitored system parameter is within the normal range;
• and
• indicating existence of an abnormality if the monitored system parameter is outside of the normal range,
• wherein the process is related to usage of networked computing devices in a datacenter,
• wherein the weighting scheme consists of a first weighting factor that represents a continuously updated signature weight and a second weighting factor that represents a current data weight,
• wherein creating a signature comprises accelerated learning through setting a learning responsiveness ratio and incrementally increasing the learning responsiveness ratio until the learning responsiveness ratio reaches a desired value, and
• wherein the learning responsiveness ratio is equated to the second weighting factor divided by the first weighting factor.

One or more computer storage media having computer-useable instructions embodied thereon for performing a method for creating a signature useful for detecting abnormalities in a computing system environment, the method comprising:

• setting a learning responsiveness ratio;
• monitoring a system parameter;
• adjusting the learning responsiveness ratio at fixed intervals until a desired value is reached;
• calculating an average and standard deviation for each interval;
• and
• using the average, standard deviation and learning responsiveness ratio to create the signature,
• wherein the learning responsiveness ratio is equated to a weighting factor that represents current data divided by a weighting factor that represents the signature,
• wherein the abnormalities in the computing system environment relate to usage of networked computing devices in a datacenter, and
• wherein the signature includes information related to time-sensitive averaging that accounts for variation in a business cycle.

A computerized system including one or more computer storage media for detecting abnormal activity in a computerized environment, the system comprising:

• monitoring tools stored on the computer storage media for continuously monitoring a system parameter;
• and
• a continuously updated signature representative of typical values of the system parameter
• an abnormality indicator calculated based on the continuously updated signature, the abnormality indicator including a range of typical values for the system parameter,
• wherein the signature is continuously updated with a weighting scheme,
• wherein the weighting scheme consists of a first weighting factor representing the weight of the continuously updated signature and a second weighting factor representing the weight of current data,
• wherein the abnormal activity is related to abnormal usage of networked computing devices in a datacenter,
• wherein the signature includes information related to time-sensitive averaging that accounts for variation in a business cycle,
• wherein the signature is created by accelerated learning through setting a learning responsiveness ratio and incrementally increasing the learning responsiveness ratio until the learning responsiveness ratio reaches a desired value, and
• wherein the learning responsiveness ratio is equated to the second weighting factor divided by the first weighting factor.

A computerized monitoring system including one or more computer storage media for monitoring a process, the monitoring system comprising:

• a signature creation module, stored on the one or more computer storage Media, for creating a signature representative of the process;
• a signature updating module, stored on the one or more computer storage Media, for continuously updating the created signature;
• and
• an abnormality detection module, stored on the one or more computer storage media, for detecting abnormalities based upon deviations from the updated signature,
• wherein the signature is continuously updated with a weighting scheme,
• wherein the weighting scheme consists of a first weighting factor that represents a continuously updated signature weight and a second weighting factor that represents a current data weight,
• wherein the signature creation module comprises tools for performing accelerated learning through incrementally increasing a learning responsiveness ratio until the learning responsiveness ratio reaches a desired value,
• wherein the learning responsiveness ratio is equated to the second weighting factor divided by the first weighting factor,
• wherein the process is carried out on a computer and is related to usage of networked computing devices in a datacenter, and
• wherein the signature includes information related to time-sensitive averaging that accounts for variation in a business cycle.

One or more computer storage media having computer-useable instructions embodied thereon for performing a method for distinguishing between normal and abnormal behavior during a process, the method comprising:

• creating a signature representative of the process;
• continuously updating the created signature with a weighting scheme;
• monitoring a system parameter;
• converting a numeric data stream representative of the monitored system parameter to a state for the process;
• and
• distinguishing between normal and abnormal behavior based on the state,
• wherein the process is related to usage of networked computing devices in a datacenter,
• wherein the weighting scheme consists of a first weighting factor that represents a continuously updated signature weight and a second weighting factor that represents a current data weight,
• wherein the system parameter includes at least one of a usage variable, utilization, an error, and turnaround time,
• wherein distinguishing between normal and abnormal behavior includes utilizing time-sensitive averaging to account for variation in a business cycle,
• wherein the signature is created by accelerated learning through setting a learning responsiveness ratio and incrementally increasing the learning responsiveness ratio until the learning responsiveness ratio reaches a desired value, and
• wherein the learning responsiveness ratio is equated to the second weighting factor divided by the first weighting factor.