Outlier detection in databases

Various systems, methods, and processes for identifying outliers in a data set stored in a database are disclosed. A subset of data is extracted from a data set. Data descriptors are allocated to the subset of data. A model of the subset of data is created based on attributes of the data descriptors. An iteration of an outlier detection process based on the model is then executed. The outlier detection process evaluates the subset of data, and the outlier detection process evaluates the data set based on the results of the evaluation of the subset of data. The outlier detection process, which can implement and/or use a Random Sample Consensus (RANSAC) algorithm, identifies outliers in the data set stored in the database.

BACKGROUND OF THE INVENTION

Field of the Invention

This invention relates to data analysis and, more particularly, to outlier detection in databases.

Description of the Related Art

Many companies and organizations implement databases to manage their data. Such databases can often times store voluminous amounts of data. The data stored in a large database can be shared, used, modified, and/or updated by multiple users of the database. For example, different teams in a company can use data stored in a shared database to perform data analysis, modify, rewrite, and/or merge the shared data. Such actions, if performed repeatedly, can result in a reduction in data quality of the data stored in the database. Therefore, over time, “dirty” data can exist in the database.

Examples of “dirty” data in a database that can result in a reduction in data quality include, but are not limited to, duplicate entries, erroneous data, bad address information, data about customers and/or employees that is not updated, etc. Therefore, if multiple users constantly move data in and out of a database, maintaining an up to date master (or clean) copy of the data can be challenging.

Typically, data analysis to identify such “dirty” data requires prior knowledge and/or information about the target object stored in the database. For example, information such as the Internet Protocol (IP) address of the user performing changes to the data, the expiration date of data, etc. are required to identify “dirty” data. Moreover, prior knowledge of the data is also required if the data stored in the database is in a format that is not easily recognized by a database administrator (e.g., data in string, integer, or bytea formats).

SUMMARY OF THE INVENTION

Various systems, methods, and processes for identifying outliers in a data set stored in a database are disclosed. For example, one method involves extracting a subset of data from a data set. In this example, the data is a string. The method allocates data descriptors to the subset of data that describe the subset of data. The method then creates a model of the subset of data based on attributes of the data descriptors.

In one embodiment, the method executes an iteration of an outlier detection process based on the model. In this example, the outlier detection process performs at least two steps. First, the outlier detection process evaluates the subset of data, and second, the outlier detection process evaluates the data set based on the results of the evaluation of the subset of data. By doing so, the outlier detection process identifies outliers in the data set. In some embodiments, the outlier detection process is a Random Sample Consensus (RANSAC) algorithm.

In other embodiments, a clustering process is used to identify a filtering threshold of the subset of data based the model of the subset of data. The method then filters the data set based on the filtering threshold of the subset of data. The method then executes another iteration of the outlier detection process. Executing another iteration creates another model of the subset of data, and identifies a similarity threshold of the another subset of data based on the another model. In this example, the another subset of data is part of the data set.

In some embodiments, the method identifies outliers in the data set by comparing the model of the subset of data and the another model of the another subset of data. The method then filters the data set using a model with the higher similarity threshold.

In one embodiment, the data set is part of a database application. Identifying the outliers in the data set detects dirty data in the data set that is part of the database application. In some embodiments, the set of data descriptors describe a length, a character set, a co-occurrence, a frequency, an entropy, a similarity, or a segmentation of the subset of data.

In other embodiments, using the clustering process creates a fingerprint that associates the subset of data and the data set based on the data descriptors. In this example, the method determines a value distribution of the set of data descriptors based on the fingerprint created using the clustering process, and calculates the similarity between the subset of data and the data set based on the value distribution.

While the invention is susceptible to various modifications and alternative forms, specific embodiments of the invention are provided as examples in the drawings and detailed description. It should be understood that the drawings and detailed description are not intended to limit the invention to the particular form disclosed. Instead, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope of the invention as defined by the appended claims.

DETAILED DESCRIPTION

Introduction

FIG. 1is a block diagram of a system for performing data analysis. This system includes a computing device10and a storage device70. As shown, computing device10is coupled to storage device70. Computing device10can be any of a variety of different types of computing devices, including a server, personal computing device, laptop computer, net book, personal digital assistant, cellular phone, or the like.

Computing device10includes a processor20, and memory30. Computing device10also includes a data quality module40which implements a data analysis module50and a clustering module60. Storage device70stores a data set80which includes a subset of data90. It is noted that this is a simplified example, and that other embodiments can include far more complex organizational and configuration schemes than are shown here.

Computing device10is coupled to storage device70. In this example, storage device70stores data set80, but can also store data in other formats (not shown). Storage device70can be a persistent storage device and can include one or more of a variety of different storage devices, including hard disks, compact discs, digital versatile discs, solid state drive (SSD) memory such as flash memory, and the like, or one or more logical storage devices such as volumes implemented on one or more such physical storage devices.

Computing device10and storage device70can be integrated (e.g., where the storage device is coupled to the node's internal processing devices by an internal bus and is built within the same chassis as the rest of the node) or separate. If separate, computing device10and storage device70can be coupled by a local connection (e.g., using a technology such as Bluetooth™, Peripheral Component Interconnect (PCI), Small Computer System Interface (SCSI), or the like) or via one or more networks such as the Internet or a storage area network. Computing device10can be a client device or client system (as shown inFIG. 2) and can be used to perform outlier detection in data sets stored in a database.

FIG. 2is a block diagram of a system for evaluating data based on an outlier detection process. As shown inFIG. 2, storage device70can be coupled to a client210via network250. Data set80on storage device70includes subset of data90. String descriptors240are allocated to subset of data90. In this example, string descriptors240describe subset of data90. Client210includes data analysis module50and clustering module60. Data analysis module50implements an outlier detection module220. Outlier detection module220uses, or can implement, an outlier detection algorithm. Clustering module60uses, or can implement, a clustering algorithm.

Data descriptors, when used in conjunction with an iterative outlier detection algorithm such as the Random Sample Consensus (RANSAC) algorithm can be useful for performing automatic outlier detection in data sets stored in a database. Data descriptors and their use with the RANSAC algorithm is discussed below.

Data Descriptors

As noted above, identifying outliers in a data set stored in a database can be useful to maintain the data quality in the database. However, outlier detection can be challenging when the data stored in the database is in a text format, a string format, an integer format, or in a bytea format because the outliers in a data set that contains data in the aforementioned formats can be difficult to identify without prior knowledge of the target object. Therefore, a data set with string data, integer data, or bytea data has to be modeled based on data descriptors before it can be implemented for use with an outlier detection process.

In one embodiment, string descriptors, which are data descriptors used to describe string data (or simply a string), can be used in conjunction with an outlier detection algorithm to perform outlier detection. For example, string descriptors can describe a length, a character set, a co-occurrence, a frequency, an entropy, a similarity, or a segmentation of subset of data90. In this example, the aforementioned attributes of the string descriptors can be used to create a model of subset of data90. In some embodiments, this model can then be used by an outlier detection algorithm such as the Random Sample Consensus (RANSAC) algorithm to identify outliers in data set80.

In some embodiments, several features (or attributes) of string data are used to create a model that describes the string data. As noted above, these features or attributes can include a length, a character set, a co-occurrence, a frequency, an entropy, a similarity, or a segmentation of the data set (or a subset of data of the data set). In this example, in a length histogram, the length of string data can be represented on the X-axis, and the Y-axis can represent the number of strings. In an alternate example, different strings can contain different characters. Data sets with different usages can also contain different character sets. Therefore, the model can use character sets to describe the character attributes of the string(s) (e.g., by using an Unicode character table).

The frequency attribute describes the number of times a character appears in a string. For example, if a string is ‘aba,’ the character changes two times, so the frequency attribute of the string is 2/2, which is equal to 1. Similarly, if the string is ‘abbbb,’ the character changes once, so the frequency attribute of the string is 1. In some embodiments, these frequency attributes can be represented on the X-axis as the frequency value, and the Y-axis can represent the number of strings in a frequency histogram.

Entropy refers to the unpredictability of the contents of a data set. In the model, the X-axis represents the string length, and the Y-axis represents the string entropy multiplied by the string length. In an alternate example, the X-axis can represent the string entropy and the Y-axis can represent the number of strings. In one embodiment, the entropy-based attributes can be represented by an entropy histogram to be used in creating a model for evaluation (e.g., an outlier detection process and/or algorithm).

In other embodiments, co-occurrence of an element of string data can also be used to create the model. For example, if two string elements appear together in the data set, a co-occurrence can be declared and the model can group those string elements together to be used in creating the model. In alternate embodiments, some strings can be segmented by one or more symbols. For example, a string can be segmented based on a package name (e.g., segmentation histogram of package_name of data set80), Uniform Resource Locator (URL), and/or an IP address. In this example, the X-axis represents the number of segments and the Y-axis represents the number of strings in a segmentation histogram.

In some embodiments, a similarity attribute can be used to model subset of data90(in addition to one or more attributes). For example, one string may look like another string, and these strings may have a common subsequence. In this example, a longest common subsequence (LCS) can be used to describe the similarity attribute of the string(s) (e.g., to find the longest subsequence common to all sequences in a set of sequences).

Therefore, in this matter, features or attributes of string data can be used to describe the string data for the purpose of creating an evaluation model. To create the integrated model for evaluation by the outlier detection process, all available attributes are extracted from the string data, and the value of the attributes can be used to calculate the difference between two or more sets (or subsets) of data.

FIG. 3is a block diagram of a system for allocating string descriptors. Client210is a computing device that contains data analysis module50, clustering module60, and model comparison module305. Data analysis module50implements outlier detection module220. Client210is coupled to database330which contains column335(in addition to several additional columns which are not shown inFIG. 3). Sample340is a data sample (e.g., subset of data90) taken from column335. String descriptors240are allocated to sample340. As shown inFIG. 3, the attributes or features of string descriptors240include length345, character set350, co-occurrence355, frequency360, entropy365, similarity370, and segmentation375. It is noted that this is a simplified example, and that other embodiments can include additional data descriptors than are shown here.

As shown inFIG. 3, server310is coupled to client210and database330. Server310stores several models for comparison (e.g., by model comparison module305). For example, server310stores good model315associated with sample340(1), better model320associated with sample340(2), and best model325associated with sample340(3).

In one embodiment, column335is extracted from database330and sample340is extracted from column335. String descriptors240are allocated to sample340. The data distribution (or value distribution) of the features of the string descriptors (e.g., length345, character set350, co-occurrence355, frequency360, entropy365, similarity370, and segmentation375) is calculated using a clustering algorithm/process.

In other embodiments, data processed by a clustering algorithm (e.g., the attributes of string descriptors240) can be used to create a fingerprint. Each fingerprint has a fingerprint circle which represents a cluster edge, and the distance between fingerprint circles represent the amount of a class. Fingerprints present the data distribution feature (e.g., based on features and/or attributes of the data descriptors) and can be used to perform similarity comparison between data sets. In this example, the values of one feature (e.g., length or entropy) are calculated for sample340. A clustering process can then be used to divide the calculated values into two classes (e.g., using the Otsu's method) to determine a classification number (e.g., best_classification_number). The classification process is executed again based on the classification number.

In some embodiments, to compare two (or more) models which are produced from the subset of data and the data set, the clustering algorithm can also be used to cluster the data distribution of the attributes/features produced by the data descriptors to calculate the difference between the models. A high level of similarity between two models can be given a high score (e.g., a similarity score). As discussed below, executing a second or subsequent iteration of an outlier detection algorithm can create another model of the subset of data and can identify another threshold and thus, another similarity score of another subset of data based on another model. As noted above, upon comparison of the distribution of the attributes/features produced by the data descriptors (also called a fingerprint), a similarity score is produced. Similarity scores between two or more models can be compared, and the model with the higher similarly score can be filtered using a similarity threshold.

Some embodiments provide for at least two types of thresholds. The first type of threshold is a similarity threshold (discussed above), which is a threshold for a similarity score and can be used to stop or continue an interation of an outlier detection algorithm. The second type of threshold is a filtering threshold, which is a threshold for data filtering, and is created by the clustering algorithm. As discussed above, the clustering algorithm can be used to determine the threshold (e.g., an edge represented by the filtering threshold) of outliers, and can create fingerprints to compare different models because different sets of data distribution results will result in different clustering results. In other embodiments, an iteration of an outlier detection algorithm can be stopped if the similarity score meets (or exceeds) the similarity threshold. The clustering algorithm can then use the features/attributes of the data descriptors of the model and determine the cluster edge (e.g., the filtering threshold) to filter the data set.

In an alternate embodiment, the values of all features (or attributes) of the string descriptors allocated to sample340is separately calculated using a clustering algorithm or process. This results in at least seven fingerprints (e.g., based on the seven attributes of string descriptors240—length345, character set350, co-occurrence355, frequency360, entropy365, similarity370, and segmentation375). The seven fingerprints can represent sample340in a three-dimensional space and can be used to create a first model (e.g., good model315associated with sample340(1)). Good model315can then evaluated using an outlier detection process (e.g., the RANSAC algorithm) to determine whether other models are necessary (e.g., better model320associated with sample340(2), and best model325associated with sample340(3), etc.) for evaluation to identify an optimum number of outliers in the data set (e.g., based on a pre-determined threshold).

Data Analysis Using RANSAC

The RANSAC algorithm, which is an example of outlier detection algorithm and/or process, can be executed based on the models described above. The RANSAC algorithm is an iterative algorithm which is used, in some embodiments, to estimate parameters of the created models (e.g., good model315, better model320, best model325, etc.) from a set of observed data (e.g., samples380(1)-(3) associated with good model315, better model320, and best model325respectively). Because the RANSAC algorithm is a non-deterministic algorithm (e.g., the algorithm only produces results with a certain probability), multiple iterations of the RANSAC algorithm can be executed to increase the probability of detecting the optimum number of outliers in a data set (e.g., based on a similarity threshold).

The following is an example of the RANSAC algorithm, when the algorithm is applied to detecting outliers in a database based on data descriptors:best_model=Nonebest_value=0extract sample of datamodel=fit model with Data Descriptorvalue=evaluate the model with another sample (another model)if value>best_value:value=best_valuebest_model=model

FIG. 4is a flowchart that illustrates a process for identifying outliers in a data set. The process begins at405by accessing a database (e.g., database330). At410, the process determines if the data (e.g., data set80) in database330is string data, integer data, or bytea data. If the data in database330is not string data, integer data, or bytea data (e.g., if the data is image point data), the process ends. However, if the data in database330is string data, integer data, or bytea data, the process, at415, extracts a subset of data (e.g., subset of data90) from a data set stored on database330(e.g., data set80). At420, the process extracts built-in descriptors (e.g., string descriptors240) of the subset of data. At425, the process creates a model (also called first or evaluation model) of the subset of data based on the attributes of the extracted built-in descriptors (e.g., good model315as shown inFIG. 3).

At430, the process analyzes the model based on an outlier detection algorithm (e.g., an outlier detection process based on the RANSAC algorithm). If the process analyzes the model based on the RANSAC algorithm, an iteration of the RANSAC algorithm performs a two-step process. First, the iteration of the RANSAC algorithm evaluates the subset of data (e.g., sample340(1) based on the good model315). Second, the same iteration of RANSAC algorithm evaluates the entire data set (e.g., data set80) based on the results of evaluating the subset of data. The process ends at435by identifying outliers in the data set.

As noted above, after an iteration of the RANSAC algorithm is complete, a model (e.g., good model315based on sample340(1)) can be evaluated to determine whether the model identifies an optimum number of outliers in a data set. This evaluation of the optimum number can be based on a pre-determined threshold. If the first iteration of the RANSAC algorithm does not identify an optimum number of outliers, another sample can be evaluated using the process described inFIG. 4to create a model based on another subset of data to identify a greater number of outliers (e.g., better model320based on sample340(2), and if better model320is not satisfactory, best model325based on sample340(3), etc.).

FIG. 5is a flowchart that illustrates a process for filtering a data set with a model. The process begins at505by extracting a subset of data from a data set. At510, the process determines whether the subset of data has string descriptors (e.g., string descriptors240if the data type is string data). If the subset of data does not have string descriptors, the process, at515, allocates the string descriptors. If the subset of data has string descriptors, the process, at520, extracts the string descriptors. At525, the process creates a model based on the attributes of the string descriptors (e.g., good model315based on attributes of string descriptors240extracted from sample340(1) as shown inFIG. 3).

At530, the process evaluates the model based on an outlier detection algorithm (e.g., an outlier detection process based on the RANSAC algorithm). At535, the process determines whether the model's similarity score meets (or exceeds) a similarity threshold. For example, if the evaluation of the model using a first iteration of the RANSAC algorithm results in no outliers or very few outliers, a similarity threshold may not be met, and the process extracts another subset of data to create another model. In one example, the similarity threshold may be set by a database administrator based on an expected number of outliers given the size of the database or the number of users actively using the database. In an alternate example, a clustering algorithm can be used to identify filtering thresholds of the subset of data based on the evaluation of the model associated with that subset of data.

Therefore, if the similarity score of the first model (e.g., good model315) does not meet a similarity threshold (e.g., after the first model is used to evaluate the subset of data and the data set (using the subset of data)), the process repeats the process ofFIG. 5starting at505by extracting another subset of data (e.g., sample340(2)) to create another model (e.g., better model320) for evaluation by the outlier detection algorithm. In one embodiment, the second model is evaluated using a second iteration of the RANSAC algorithm. However, if even the second model is unsatisfactory (e.g., goes not meet the similarity threshold), the process can extract a third subset of data (e.g., sample340(3)) to create a third model (e.g., best model325) for evaluation by a third iteration of the RANSAC algorithm, and so on. The process ends at540by filtering the master data set (e.g., data set80) using the model which identifies meets and/or exceeds the filtering threshold to detect outliers in the data set.

FIG. 6is a flowchart that illustrates a process for evaluating a model created by extracting a sample from a column in a database based on an iteration of an outlier detection algorithm. The process begins at605by starting an iteration of an outlier detection algorithm (e.g., the RANSAC algorithm). At610, the process accesses a column of data in a database (e.g., column335in database330as shown inFIG. 3). At615, the process extracts a sample of data from the column (e.g., sample340from column335as shown inFIG. 3). At620, the process applies data descriptors to the sample (e.g., string descriptors240).

At625, the process fits a model (e.g., a pre-existing model) with the data descriptors (or creates a new model based on the data descriptors). At630, the process determines a value distribution of the sample based on the data descriptors, and at635, creates a fingerprint of the sample using a clustering algorithm. At640, the process evaluates the model based on a similarity threshold (e.g., by using the running iteration of the RANSAC algorithm). The process ends at645by waiting for the iteration of the outlier detection algorithm to end.

FIG. 7is a flowchart that illustrates a process for identifying outliers in a data set based on multiple models and multiple iterations of an outlier detection algorithm. The process begins at710by determining if a previous iteration of an outlier detection algorithm has ended. At715, if the iteration has ended, the process receives the results of the model evaluated by the outlier detection algorithm. At720, the process determines if the model is satisfactory. For example, and as noted above, if the evaluation of the model using a first iteration of the RANSAC algorithm results in a low similarity score, the process extracts another subset of data to create another model. The determination of whether the model is satisfactory can also be made by a database administrator based on an expected (or anticipated) number of outliers given the size of the database or the number of users actively using the database. For example, if the database is a large database with multiple users modifying data stored in the database, very few or no outliers may indicate that the model is unsatisfactory.

If the model is unsatisfactory, the process, at725, runs another iteration of the outlier detection algorithm on another sample of data (e.g., sample340(2) or another subset of data). If the model is deemed satisfactory (e.g., if the results show a high similarity score), the process, at730, filters the entire column of data with the model created from the current sample of data. The process ends at735by identifying outliers in the column and marking the data as “dirty.”

Example Computing Environment

FIG. 8is a block diagram of a computing system800capable of implementing computing device10or client210as described above. Computing system800broadly represents any single or multi-processor computing device or system capable of executing computer-readable instructions. Examples of computing system800include, without limitation, any one or more of a variety of devices including workstations, personal computers, laptops, client-side terminals, servers, distributed computing systems, handheld devices (e.g., personal digital assistants and mobile phones), network appliances, storage controllers (e.g., array controllers, tape drive controller, or hard drive controller), and the like. In its most basic configuration, computing system800may include at least one processor20and a memory30. By executing the software that implements computing device10, computing system800becomes a special purpose computing device that is configured to perform outlier detection in a database.

Processor20generally represents any type or form of processing unit capable of processing data or interpreting and executing instructions. In certain embodiments, processor20may receive instructions from a software application or module. These instructions may cause processor20to perform the functions of one or more of the embodiments described and/or illustrated herein. For example, processor20may perform and/or be a means for performing all or some of the operations described herein. Processor20may also perform and/or be a means for performing any other operations, methods, or processes described and/or illustrated herein.

Memory30generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and/or other computer-readable instructions. Examples include, without limitation, random access memory (RAM), read only memory (ROM), flash memory, or any other suitable memory device. Although not required, in certain embodiments computing system800may include both a volatile memory unit and a non-volatile storage device. In one example, program instructions implementing a modifiable volume snapshot operation may be loaded into memory30.

In certain embodiments, computing system800may also include one or more components or elements in addition to processor20and memory30. For example, as illustrated inFIG. 8, computing system800may include a memory controller820, an Input/Output (I/O) controller835, and a communication interface845, each of which may be interconnected via a communication infrastructure805. Communication infrastructure805generally represents any type or form of infrastructure capable of facilitating communication between one or more components of a computing device. Examples of communication infrastructure805include, without limitation, a communication bus (such as an Industry Standard Architecture (ISA), Peripheral Component Interconnect (PCI), PCI express (PCIe), or similar bus) and a network.

Memory controller820generally represents any type or form of device capable of handling memory or data or controlling communication between one or more components of computing system800. For example, in certain embodiments memory controller820may control communication between processor20, memory30, and I/O controller835via communication infrastructure805. In certain embodiments, memory controller820may perform and/or be a means for performing, either alone or in combination with other elements, one or more of the operations or features described and/or illustrated herein.

I/O controller835generally represents any type or form of module capable of coordinating and/or controlling the input and output functions of a computing device. For example, in certain embodiments I/O controller835may control or facilitate transfer of data between one or more elements of computing system800, such as processor20, memory30, communication interface845, display adapter815, input interface825, and storage interface840.

Communication interface845broadly represents any type or form of communication device or adapter capable of facilitating communication between computing system800and one or more additional devices. For example, in certain embodiments communication interface845may facilitate communication between computing system800and a private or public network including additional computing systems. Examples of communication interface845include, without limitation, a wired network interface (such as a network interface card), a wireless network interface (such as a wireless network interface card), a modem, and any other suitable interface. In at least one embodiment, communication interface845may provide a direct connection to a remote server via a direct link to a network, such as the Internet. Communication interface845may also indirectly provide such a connection through, for example, a local area network (such as an Ethernet network), a personal area network, a telephone or cable network, a cellular telephone connection, a satellite data connection, or any other suitable connection.

In certain embodiments, communication interface845may also represent a host adapter configured to facilitate communication between computing system800and one or more additional network or storage devices via an external bus or communications channel. Examples of host adapters include, without limitation, Small Computer System Interface (SCSI) host adapters, Universal Serial Bus (USB) host adapters, Institute of Electrical and Electronics Engineers (IEEE) 1394 host adapters, Serial Advanced Technology Attachment (SATA), Serial Attached SCSI (SAS), and external SATA (eSATA) host adapters, Advanced Technology Attachment (ATA) and Parallel ATA (PATA) host adapters, Fibre Channel interface adapters, Ethernet adapters, or the like. Communication interface845may also allow computing system800to engage in distributed or remote computing. For example, communication interface845may receive instructions from a remote device or send instructions to a remote device for execution.

As illustrated inFIG. 8, computing system800may also include at least one display device810coupled to communication infrastructure805via a display adapter815. Display device810generally represents any type or form of device capable of visually displaying information forwarded by display adapter815. Similarly, display adapter815generally represents any type or form of device configured to forward graphics, text, and other data from communication infrastructure805(or from a frame buffer, as known in the art) for display on display device810.

As illustrated inFIG. 8, computing system800may also include at least one input device830coupled to communication infrastructure805via an input interface825. Input device830generally represents any type or form of input device capable of providing input, either computer or human generated, to computing system800. Examples of input device830include, without limitation, a keyboard, a pointing device, a speech recognition device, or any other input device.

As illustrated inFIG. 8, computing system800may also include storage device70to communication infrastructure805via a storage interface840. Storage device70generally represents any type or form of storage devices or mediums capable of storing data and/or other computer-readable instructions. For example, storage device70may include a magnetic disk drive (e.g., a so-called hard drive), a floppy disk drive, a magnetic tape drive, an optical disk drive, a flash drive, or the like. Storage interface840generally represents any type or form of interface or device for transferring and/or transmitting data between storage device70, and other components of computing system800.

In certain embodiments, storage device70may be configured to read from and/or write to a removable storage unit configured to store computer software, data, or other computer-readable information. Examples of suitable removable storage units include, without limitation, a floppy disk, a magnetic tape, an optical disk, a flash memory device, or the like. Storage device70may also include other similar structures or devices for allowing computer software, data, or other computer-readable instructions to be loaded into computing system800. For example, storage device70may be configured to read and write software, data, or other computer-readable information. Storage device70may also be a part of computing system800or may be separate devices accessed through other interface systems.

Many other devices or subsystems may be connected to computing system800. Conversely, all of the components and devices illustrated inFIG. 8need not be present to practice the embodiments described and/or illustrated herein. The devices and subsystems referenced above may also be interconnected in different ways from that shown inFIG. 8.

Computing system800may also employ any number of software, firmware, and/or hardware configurations. For example, one or more of the embodiments disclosed herein may be encoded as a computer program (also referred to as computer software, software applications, computer-readable instructions, or computer control logic) on a computer-readable storage medium. Examples of computer-readable storage media include magnetic-storage media (e.g., hard disk drives and floppy disks), optical-storage media (e.g., CD- or DVD-ROMs), electronic-storage media (e.g., solid-state drives and flash media), and the like. Such computer programs can also be transferred to computing system800for storage in memory via a network such as the Internet or upon a carrier medium.

The computer-readable medium containing the computer program may be loaded into computing system800. All or a portion of the computer program stored on the computer-readable medium may then be stored in memory30and/or various portions of storage device70. When executed by processor20, a computer program loaded into computing system800may cause processor20to perform and/or be a means for performing the functions of one or more of the embodiments described and/or illustrated herein. Additionally or alternatively, one or more of the embodiments described and/or illustrated herein may be implemented in firmware and/or hardware. For example, computing system800may be configured as an application specific integrated circuit (ASIC) adapted to implement one or more of the embodiments disclosed herein.

Example Networking Environment

FIG. 9is a block diagram of a network architecture900in which computing device10may be coupled to network250. In certain embodiments, network-attached storage (NAS) devices may be configured to communicate with computing device10using various protocols, such as Network File System (NFS), Server Message Block (SMB), or Common Internet File System (CIFS).

Network250generally represents any type or form of computer network or architecture capable of facilitating communication between multiple computing devices. Network250may facilitate communication between computing device10, client210, and/or server310. In certain embodiments, and with reference to computing system800ofFIG. 8, a communication interface, such as communication interface845inFIG. 8, may be used to provide connectivity between computing device10and network250. It should be noted that the embodiments described and/or illustrated herein are not limited to the Internet or any particular network-based environment. For example, network250can be a Storage Area Network (SAN).

In at least one embodiment, all or a portion of one or more of the embodiments disclosed herein may be encoded as a computer program and loaded onto and executed by computing device10, client210, server310, or any combination thereof. All or a portion of one or more of the embodiments disclosed herein may also be encoded as a computer program, stored in computing device10, client210, or server310, and distributed over network250.

In addition, one or more of the components described herein may transform data, physical devices, and/or representations of physical devices from one form to another. For example, a data analysis module50may transform behavior of a computing device in order to cause the computing device to perform outlier detection in a database.