Patent ID: 7818418
Filing Date: 2010-10-19
Classification: H04L

Abstract:
1. A computer-implemented method for detecting anomalous behavior in a distributed system, comprising the following computer-implemented steps: in response to a plurality of subsystems in the distributed system performing processing for a plurality of execution paths: receiving first data which provides metrics for one level of a hierarchy of metrics, and receiving second data which provides metrics for another level of the hierarchy of metrics, lower than the one level, where the first and second data include identifiers of: (a) the plurality of execution paths and (b) components of the plurality of execution paths, including components which are software components of an application, where the software components include software components which execute at a single host computer, and the first and second data include data obtained from instrumentation at the single host computer; processing the first data to determine if the metrics for the one level contain an anomaly; and in response to determining that the metrics for the one level contain an anomaly: