Patent ID: 7788198
Filing Date: 2010-08-31
Classification: G06F

Abstract:
1. A computerized method for detecting anomalies in a data processing environment, the computerized method comprising: receiving training performance data from a counter of the data processing environment, wherein the counter records operational performance data; receiving an annotation that identifies an anomalous instance in the training performance data and a type of anomaly to thereby provide annotation data; receiving hint information from the user and storing the hint information in a hint store; deriving parameter information based on the training performance data, the hint information and annotation data by computing a size of a short window, computing a size of a long window, determining whether there is an anomaly by comparing a ratio of the size of the short window to the size of the long window against an anomaly threshold, and selecting the size of the short window and the size of the long window when the comparing indicates an anomaly, wherein the short window and the long window are time intervals; receiving operational performance data from the counter of the data processing environment; receiving the hint information from the hint store, the hint information indicating a type of the counter which produced the operational performance data and a failure mode associated with the counter, which, in turn, identifies the type of behavior considered normal and anomalous for the counter; analyzing the operational performance data based on the parameter information by using the selected size of the short window and the selected size of the long window and the anomaly threshold to search for anomalies in the operational performance data; based on the hint information, identifying a type of source of the operational performance data, a type of performance counter, the failure mode associated with the performance counter and a respective characteristic of the type of sources of the training performance data and operational performance data; and determining whether the operational performance data reveals the occurrence of at least one anomaly in the data processing environment, wherein the analyzing incorporates, by virtue of the parameter information, a desired degree of both sensitivity and responsiveness, wherein responsiveness is dependent on the size of the short window and the size of the long window, and wherein sensitivity determines how inclusive the operational performance data is in defining the anomalies.