Scalable predictive early warning system for data backup event log
AssigneeEMC IP Holding Company LLC
InventorsChunsheng Fang, Derek Lin
Life of this patent
Estimating the term…
Abstract
Techniques to detect backup-related anomalies are disclosed. In various embodiments, a processor is used to generate based at least in part on backup log data associated with a training period a predictive model. The predictive model is to detect, using the processor, anomalies in corresponding backup log data associated with a detection period.
Claims13
A method of detecting backup related anomalies, comprising:
- filtering backup log data associated with one or more backup clients during a training period into one or more sets of backup log data based on one or more attributes;
- extracting from a set of the one or more sets of backup log data a prescribed set of features;
- generating, using a processor, based at least in part on the extracted prescribed set of features, a predictive model;
- using, by the processor, the predictive model to detect anomalies in backup log data associated with the one or more backup clients during a detection period, wherein the anomalies at least includes data being erroneously deleted;
- computing a score for a detected anomaly;
- and
- performing one or more responsive actions based at least in part on a comparison between the computed score and a detection threshold, wherein a responsive action includes a processor using backup data stored at a prior time to restore the erroneously deleted data.
A system to detect backup related anomalies, comprising:
- a communication interface;
- and
- a processor coupled to the communication interface and configured to:
- receive via the communication interface backup log data associated with one or more backup clients during a training period;
- filter the backup log data associated with the one or more backup clients during the training period into one or more sets of backup log data based on one or more attributes;
- extracting from a set of the one or more sets of backup log data a prescribed set of features;
- generate a predictive model based at least in part on the extracted prescribed set of features;
- use the predictive model to detect anomalies in backup log data associated with the one or more clients during a detection period, wherein the anomalies at least includes data being erroneously deleted;
- compute a score for a detected anomaly;
- and
- perform one or more responsive actions based at least in part on a comparison between the computed score and a detection threshold, wherein a responsive action includes a processor using backup data stored at a prior time to restore the erroneously deleted data.
A computer program product to detect backup related anomalies, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- filtering backup log data associated with one or more backup clients during a training period into one or more sets of backup log data based on one or more attributes;
- extracting from a set of the one or more sets of backup log data a prescribed set of features;
- generating, using a processor, based at least in part on the extracted prescribed set of features, a predictive model;
- using, by the processor, the predictive model to detect anomalies in backup log data associated with the one or more backup clients during a detection period,
- wherein the anomalies at least includes data being erroneously deleted;
- computing a score for a detected anomaly;
- and
- performing one or more responsive actions based at least in part on a comparison between the computed score and a detection threshold, wherein a responsive action includes a processor using backup data stored at a prior time to restore the erroneously deleted data.
Dependencies are inferred from the claim text.