# US 8,543,689 B2 · Apparatus and method for analysing a computer infrastructure > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,689 B2 - Document ID: US8543689B2 - Status: Granted - Kind: B2 - Application number: 12/965,226 - Filed: 2010-12-10 - Published: 2011-06-16 - Granted: 2013-09-24 - Earliest claimed: 2009-12-10 - Assignees: Prelert Ltd. - Applicants: Stephen Dodson - Inventors: Stephen Dodson - Web page: https://patentgrep.com/patent/US8543689B2 ## CPC - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/2294: {by remote test} - H04L 41/142: using statistical or mathematical methods - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for analyzing a computer infrastructure. The system and method analyses messages sent and received within the computer infrastructure to determine a system model and exception data. ## Claims ### Claim 1 A method for identifying a malfunction in operation of a computer infrastructure comprising: collecting a first plurality of messages relating to the operation of a plurality of first devices belonging to the computer infrastructure; collecting a second plurality of messages relating to the operation of a plurality of second devices belonging to the computer infrastructure; storing, in a data store, the first plurality of messages and the second plurality of messages in a predefined period of time to form an historic data items stored in the data store, correlating, by an analytics engine, the first plurality of messages and the second plurality of messages and producing a system model of at least part of the computer infrastructure, wherein the analytics engine (50) is adapted to identify expected patterns associated within the historic system data items to produce the system model, generating a unified data stream from a third plurality of messages relating to the operation of the computer infrastructure; and comparing the unified data stream with the system model to generate an exception data indicative of a malfunction. ### Claim 2 An apparatus for identifying a malfunction in operation of a computer infrastructure comprising: a plurality of first devices belonging to the computer infrastructure and generating a first plurality of messages; a plurality of second devices belonging to the computer infrastructure and generating a second plurality of messages, a data store for storing the first plurality of messages and the second plurality of messages wherein the first plurality of messages and the second plurality of messages in a predefined period of time forms historic data items stored in the data store; and an analytics engine for correlating the first plurality of messages and the second plurality of messages and producing a system model of at least part of the computer infrastructure, wherein the analytics engine is adapted to identify expected patterns associated within the historic system data items to produce the system model and wherein the analytics engine is further adapted to generate a unified data stream from a third plurality of messages relating to the operation of the computer infrastructure and to compare the unified data stream with the system model to generate an exception data indicative of a malfunction. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the plurality of first devices is at least one of a server, a router, a peripheral device and a user terminal. ### Claim 4 (depends on 2) The apparatus of claim 2, wherein the plurality of first devices is at least one of a server, a router, a peripheral device and a user terminal. ### Claim 5 (depends on 2) The apparatus of claim 2, further comprising a plurality of third devices connected to the computer infrastructure and generating a third plurality of messages, wherein the plurality of third devices comprises at least one of a server, a router, a peripheral device and a user terminal and wherein the analytics engine is further adapted to analyze the messages from the plurality of third devices and correlating the messages from the plurality of third devices with the messages from at least one of the plurality of second devices and the plurality of first devices, thereby complementing the system model. ### Claim 6 (depends on 2) The apparatus of claim 2, further comprising an external data feed connected to the computer infrastructure. ### Claim 7 A computer storage medium storing non-transitory computer-executable instructions for performing method for identifying a malfunction in operation of a computer infrastructure comprising: collecting a first plurality of messages relating to the operation of a plurality of first devices belonging to the computer infrastructure; collecting a second plurality of messages relating to the operation of a plurality of second devices belonging to the computer infrastructure; storing, in a data store, the first plurality of messages and the second plurality of messages in a predefined period of time to form an historic data items stored in the data store; correlating, by an analytics engine, the first plurality of messages and the second plurality of messages and producing a system model of at least part of the computer infrastructure, wherein the analytics engine is adapted to identify expected patterns associated within the historic system data items to produce the system model; generating a unified data stream from a third plurality of messages relating to the operation of the computer infrastructure; and comparing the unified data stream with the system model to generate an exception data indicative of a malfunction.