US 9,071,535 B2 · Comparing node states to detect anomalies

Abstract

Methods, systems, and computer storage media for detecting anomalies within nodes of a data center are provided. A self-learning system is employed to proactively and automatically detect the anomalies using one or more locally hosted agents for pulling information that describes states of a plurality of nodes (e.g., computing devices of a cloud-computing infrastructure), respectively, and using at least one early-warning mechanism for implementing a comparison technique. The comparison technique involves individually comparing the state information of the plurality of the nodes against one another and, based upon the comparison, grouping one or more nodes of the plurality of nodes into clusters that exhibit substantially similar state information. Upon identifying the clusters that include low number of nodes grouped therein, with respect to a remainder of the clusters of nodes, the members of the identified clusters are designated as anomalous machines.

Claims20

Dependent claims

One or more computer storage media having computer-executable instructions embodied thereon that, when executed, perform a method for detecting and alerting of anomalies within a cloud-computing infrastructure, the method comprising:

pulling information that describes a state of a plurality of computing devices, respectively, wherein the plurality of computing devices represent nodes within the cloud-computing infrastructure;
individually comparing the state information of the plurality of computing devices against one another;
based upon the comparison, grouping one or more computer devices of the plurality of computing devices into clusters of nodes that exhibit substantially similar state information;
identifying clusters of nodes that include low number of computer devices grouped therein with respect to a remainder of the clusters of nodes;
designating the computing devices within the identified clusters of nodes as anomalous machines;
and
initiating a communication that notifies an administrator of the cloud-computing infrastructure of the anomalous machines.

4 more elements

A computerized method for discovering anomalies within nodes of a cloud-computing infrastructure based on a comparison technique, the method comprising:

identifying a subset of nodes within the cloud-computing infrastructure that host common program components;
accessing software characteristics of computing devices within the subset of nodes;
executing a clustering algorithm on the subset of nodes using the software characteristics, wherein executing the clustering algorithm comprises:
(a) quantifying software characteristics that are shared between a first computing device and a second computing device within the subset of nodes;
(b) when a number of shared software characteristics satisfy a predefined threshold, grouping the first and second computing devices into a common cluster;
and
(c) when a number of shared software characteristics fail to meet the predefined threshold, assigning the first computing device to a first cluster and the second computing devices to a second cluster;
comparing a number of computing devices grouped within the first cluster against a number of computing devices grouped within the second cluster to identify a cluster having a minimal number of computing devices assigned thereto;
storing a marker in association with the computing devices, respectively, grouped within the identified cluster that indicates there exist anomalies within the computing devices of the identified cluster.

6 more elements

A self-learning system for performing a method that extracts information from nodes to identify anomalies prior to the anomalies affecting functionality of a service application running on the nodes, the computer system comprising a processing unit coupled to a computer storage medium, the computer storage medium having stored thereon a plurality of computer software components executable by the processing unit, the computer software components comprising:

a first agent residing on a first node within a set of nodes, wherein the first agent is configured to monitor a state of the first node;
a second agent residing on a second node within the set of nodes, wherein the second agent is configured to monitor a state of the second node;
and
an early-warning mechanism that receives information describing the state of the first node from the first agent and information describing the state of the second node from the second agent, wherein the early-warning mechanism is further configured for comparing the state information of the first node against the state information of the second node, for grouping the first and second nodes into a single cluster when the state information of the first and second nodes is comparable, for assigning the first and second nodes into separate clusters, respectively, when the state information of the first and second nodes is dissimilar, and for targeting one of the clusters as including a fewest number of nodes grouped therein, with respect to a remainder of the clusters, for designation as including anomalous machines.

1 more element

Dependencies are inferred from the claim text.

Comparing node states to detect anomalies

Life of this patent

Comparing node states to detect anomalies

Life of this patent

Abstract

Claims20