# US 9,436,535 B2 · Integration based anomaly detection service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,535 B2 - Document ID: US9436535B2 - Status: Granted - Kind: B2 - Application number: 14/691,479 - Filed: 2015-04-20 - Published: 2015-08-13 - Granted: 2016-09-06 - Earliest claimed: 2011-08-31 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Mathias G. Ricken; Arthur Carré; Miles C. Kaufmann; Aaron T. Olds; Muhammad Ali Siddiqui; Sanjeev K. Verma; Kendra A. Yourtee - Web page: https://patentgrep.com/patent/US9436535B2 ## CPC - G06F 11/0754: {by exceeding limits} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0769: {Readable error formats, e.g. cross-platform generic formats, human understandable formats} - G06F 11/0772: {Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3065: {Monitoring arrangements determined by the means or processing involved in reporting the monitored data (error or fault reporting or logging G06F11/0766)} - G06F 11/3409: {for performance assessment} - G06F 11/3495: {for systems} - G16Z 99/00: Subject matter not provided for in other main groups of this subclass - H04L 43/045: for graphical visualisation of monitoring data - G06F 11/3433: {for load management (allocation of a server based on load conditions G06F9/505; load rebalancing G06F9/5083; redistributing the load in a network by a load balancer H04L67/1029)} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 2201/81: Threshold - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G16Z: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are provided for analyzing operating metrics of monitored metric sources. Aspects of the present disclosure may present for display information associated with the monitored metric source and the analysis of its operating metrics. Analysis comprises determination of reference values and tolerance levels which represent allowable deviations from the reference values. Input data includes a measurement of an operating parameter and a time stamp. Input data may be saved to a data store for using in future analysis of other input data. When input data is determined to be outside the tolerance level, notifications may be issued to alert administrators or systems of the anomaly. ## Claims ### Claim 1 A system comprising: a memory storing computer-executable instructions; and a computer processor in communication with the memory, the computer processor programmed by the computer-executable instructions to at least: receive, from a monitored source, current input data regarding an operating parameter at a current time, wherein the operating parameter relates to performance of a computing system; analyze prior input data regarding the operating parameter to determine an expected change in the operating parameter, wherein the prior input data reflects a value of the operating parameter at each of a plurality of prior times; determine, based at least in part on the values of the operating parameter at each of the plurality of prior times, a particular time at which the expected change in the operating parameter is expected to occur; determine that the current time corresponds to the particular time; analyze the current input data and at least a portion of the prior input data to determine a current change in the operating parameter; determine, based at least in part on the values of the operating parameter at each of the plurality of prior times, a permitted relationship to the expected change; determine that the current change does not satisfy the permitted relationship with the expected change; in response to determining that the current change does not satisfy the permitted relationship, generate an anomaly notification; and cause display of a graphical interface presenting the anomaly notification, wherein the graphical interface is configured to obtain an indication that the anomaly notification is erroneous. ### Claim 2 (depends on 1) The system of claim 1, wherein the operating parameter comprises a numerical measurement of at least one of processor usage, memory usage, storage volume usage, network usage, latency, temperature, electrical consumption, logins, requests, or transactions. ### Claim 3 (depends on 1) The system of claim 1, wherein the computer-executable instructions that program the computer processor to analyze the prior input data further program the computer processor to at least determine a function approximating a change in the operating parameter with respect to time. ### Claim 4 (depends on 1) The system of claim 1, wherein the computer-executable instructions further program the computer processor to at least determine that a number of anomalies in a period of time exceeds a threshold, wherein the determining that the current change does not satisfy the permitted relationship corresponds to an anomaly of the number of anomalies, and wherein the anomaly notification is generated in response to determining that the current change does not satisfy the permitted relationship and determining that the number of anomalies in the period of time exceeds the threshold. ### Claim 5 A computer-implemented method comprising: under control of computing hardware configured to execute specific computer-executable instructions, determining a current change in an operating metric of a computing system based at least partly on current input data, wherein the current input data reflects a value of the operating metric at a current time, and wherein the operating metric relates to performance of the computing system; determining an expected change in the operating metric based at least partly on prior input data, wherein the prior input data reflects a value of the operating metric at a prior time; determining, based at least partly on the prior input data, a particular time at which the expected change in the operating metric is expected to occur; determining that the current time corresponds to the particular time; determining, based at least partly on the value of the operating metric at the prior time, a permitted relationship to the expected change; determining that the current change does not satisfy the permitted relationship to the expected change; and generating an anomaly notification. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, wherein the operating metric comprises a numerical measurement of at least one of processor usage, memory usage, storage volume usage, network usage, latency, temperature, electrical consumption, logins, requests, or transactions. ### Claim 7 (depends on 5) The computer-implemented method of claim 5, further comprising determining that a current value of the operating metric does not satisfy a second permitted relationship to a reference value for the operating metric, wherein the anomaly notification is generated in response to both (1) determining that the current change does not satisfy the permitted relationship to the expected change; and (2) determining that the current value of the operating metric does not satisfy the second permitted relationship to the reference value. ### Claim 8 (depends on 5) The computer-implemented method of claim 5, further comprising causing display of a graphical interface presenting the anomaly notification, wherein the graphical interface is configured to obtain input indicating the anomaly notification is erroneous. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising modifying the permitted relationship based at least partly on the input, obtained via the graphical interface, indicating the anomaly notification is erroneous. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, wherein the graphical interface is further configured to obtain input indicating that a change in the operating metric erroneously failed to cause generation of an anomaly notification. ### Claim 11 (depends on 5) The computer-implemented method of claim 5, wherein the permitted relationship comprises a number of standard deviations from the expected change. ### Claim 12 (depends on 5) The computer-implemented method of claim 5, wherein the computing system comprises one of a fleet of computing systems, wherein the determination that the current change does not satisfy the permitted relationship corresponds to a single anomaly, and wherein the anomaly notification is generated in response to determining that a number of anomalies for the fleet of computing systems exceeds a threshold. ### Claim 13 Non-transitory computer-readable storage having stored thereon an executable module configured to cause computing hardware to execute a process comprising: determining a current change in an operating metric of a computing system based at least partly on current input data, wherein the current input data reflects a value of the operating metric at a current time, and wherein the operating metric relates to performance of the computing system; determining an expected change in the operating metric based at least partly on prior input data, wherein the prior input data reflects a value of the operating metric at a prior time; determining, based at least partly on the prior input data, a particular time at which the expected change in the operating metric is expected to occur; determining that the current time corresponds to the particular time; determining a permitted relationship to the expected change; determining that the current change does not satisfy the permitted relationship to the expected change; and generating an anomaly notification. ### Claim 14 (depends on 13) The non-transitory computer-readable storage of claim 13, wherein the operating metric comprises a numerical measurement of at least one of processor usage, memory usage, storage volume usage, network usage, latency, temperature, electrical consumption, logins, requests, or transactions. ### Claim 15 (depends on 13) The non-transitory computer-readable storage of claim 13, wherein the process further comprises causing display of a graphical interface presenting the anomaly notification, wherein the graphical interface is configured to obtain input indicating the anomaly notification is erroneous. ### Claim 16 (depends on 15) The non-transitory computer-readable storage of claim 15, wherein the process further comprises modifying the permitted relationship based at least partly on the input, obtained via the graphical interface, indicating the anomaly notification is erroneous. ### Claim 17 (depends on 13) The non-transitory computer-readable storage of claim 13, wherein the process further comprises determining that a current value of the operating metric does not satisfy a second permitted relationship to a reference value for the operating parameter, wherein the anomaly notification is generated in response to both (1) determining that the current change does not satisfy the permitted relationship to the expected change and (2) determining that the current value of the operating metric does not satisfy the second permitted relationship to the reference value. ### Claim 18 (depends on 13) The non-transitory computer-readable storage of claim 13, wherein the permitted relationship comprises a number of standard deviations from the expected change. ### Claim 19 (depends on 13) The non-transitory computer-readable storage of claim 13, wherein the permitted relationship comprises a numerical difference from the expected change. ### Claim 20 (depends on 13) The non-transitory computer-readable storage of claim 13, wherein the computing system comprises one of a fleet of computing systems, wherein the determination that the current change does not satisfy the permitted relationship corresponds to a single anomaly, and wherein the anomaly notification is generated in response to determining that a number of anomalies for the fleet of computing exceeds a threshold.