Patent ID: 9692662
Date: 2017-06-27
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method, comprising: receiving a plurality of thread dump samples, each thread dump sample corresponding to a different time during an execution of a computing process, wherein each particular thread dump sample within the plurality of thread dump samples includes one or more stack traces corresponding to one or more threads, and wherein each of the one or more stack traces includes one or more stack frames; identifying a first stack segment corresponding to a first set of stack frames within each of the plurality of thread dump samples; calculating a first plurality of intensity values for the first stack segment, wherein each of the plurality of intensity values for the first stack segment corresponds to an intensity of a particular stack frame in the first set of stack frames; determining a stack segment classification for the first stack segment, based on the first plurality of intensity values calculated for the first stack segment; determining a plurality of stack frame subsets within the first set of stack frames corresponding to the first stack segment, each of the stack frame subsets having one or more constituent stack frames; for each particular stack frame subset of the plurality of stack frame subsets, calculating a plurality of intensity values, wherein each of the plurality of intensity values for the particular stack frame subset corresponds to an intensity of a particular constituent stack frame of the particular stack frame subset; analyzing the intensity values calculated for each of the plurality of stack frame subsets within the first set of stack segments, said analysis including determining whether the intensity values of the plurality of stack frame subsets are diverging over time beyond a threshold; in response to determining that the intensity values of the plurality of stack frame subsets are diverging over time, generating a plurality of new stack segments corresponding to the plurality of stack frame subsets, wherein each of the plurality of new stack segments is generated as a new constituent stack segment of the first stack segment; determining one or more intensity trends for one or more of the new constituent stack segments of the first stack segment; detecting an anomaly within the execution of the computing process, based on the one or more determined intensity trends for the constituent stack segments; and outputting an indication of the anomaly within the execution of the computing process, based on the detection of the anomaly.