Back to results
US 9,940,190 B2Granted
System for automated computer support
AssigneeTriumfant, Inc.
InventorDavid Eugene Hooks
Life of this patent
Estimating the term…
Abstract
Systems and methods for providing automated computer support are described herein. One described method comprises receiving a plurality of snapshots from a plurality of computers, storing the plurality of snapshots in a data store, and creating an adaptive reference model based at least in part on the plurality of snapshots. The described method further comprises comparing at least one of the plurality of snapshots to the adaptive reference model, and identifying at least one anomaly based on the comparison.
Claims19
A method of detecting abnormal system states in computers, comprising:
- receiving snapshots from a plurality of software agents respectively residing on a plurality of computers within a population of computers, the snapshots including data indicating the state of assets including registry information in respective ones of the plurality of computers, wherein each registry information corresponds to a key and a unique indentifier;
- generating a hash for a normalizing the unique indentifier, wherein generating the hash includes:
- for each computer, indentifying a grouping of the registry information corresponding to unique indentifiers that are not duplicated across the population of computers,
- sorting the registry information within the grouping according to key names and the non-duplicated unique indentifiers for indentifying a relationship among multiple keys within each of the computers, and
- generating the hash based on the sorted instance of the registry information, wherein the hash is a substitute for the unique indentifier in generating the adaptive reference model;
- automatically generating an adaptive reference model comprising a rule set customized to characteristics of the population of computers, the rule set being developed by identifying patterns among the snapshots from the plurality of computers;
- and
- comparing a snapshot from at least one of the computers to the adaptive reference model to determine whether an anomaly is present in the state of the at least one of the computers.
5 more elements
A non-transitory computer readable medium storing instructions, that when executed by a computer, cause the computer to perform functions of:
- receiving snapshots from a plurality of software agents respectively residing on a plurality of computers within a population of computers, the snapshots including data indicating the state of assets including registry information in respective ones of the plurality of computers, wherein each registry information corresponds to a key and a unique indentifier;
- generating a hash for normalizing the unique indentifier, wherein generating the hash includes:
- for each computer, identifying a grouping of the registry information corresponding to unique indenitifers that are not duplicated across the population of computers,
- sorting the registry information within the grouping according to key names and the non-duplicated unique indentifiers for indentifying a relationship among multiple keys within each of the computers, and
- generating the hash based on the sorted instance of the registry information, wherein the hash is a substitute for the unique indentifier in generating the adaptive reference model;
- automatically generating an adaptive reference model comprising a rule set customized to characteristics of the population of computers, the rule set being developed by identifying patterns among the snapshots from the plurality of computers;
- and
- comparing a snapshot from at least one of the computers to the adaptive reference model to determine whether an anomaly is present in the state of the at least one of the computers.
5 more elements
A system for detecting abnormal system states in computers, comprising:
- a collector component configured to receive a plurality of snapshots from a plurality of software agents respectively residing on a plurality of computers within a population of computers, the snapshots including data indicating the state of assets including registry information in respective ones of the plurality of computers, wherein each registry information corresponds to a key and a unique indentifier;
- and
- an analytic component operable to:
- generate a hash for normalizing the unique indentifier based on:
- for each computer, indentifying a grouping of the registry information corresponding to unique identifiers that are not duplicated across the population of computers,
- sorting the registry information within the grouping according to key names and the non-duplicated unique identifiers for indentifying a relationship among multiple keys within each of the computers, and
- generating the hash based on the sorted instance of the registry information, wherein the hash is a substitute for the unique indentifier in generating the adaptive reference model;
- and
- automatically generate an adaptive reference model comprising a rule set customized to characteristics of the population of computers, the rule set being developed by identifying patterns among the snapshots from the plurality of computers, wherein the analytic component compares a snapshot from at least one of the computers to the adaptive reference model to determine whether an anomaly is present in the state of the least one of the computers.
6 more elements
Dependencies are inferred from the claim text.