Systems and methods for creation and use of an adaptive reference model
Systems and methods for creation and use of an adaptive reference model are described. One described method comprises receiving a plurality of snapshots from a plurality of computers, each of the plurality of snapshots comprising a plurality of pairs of asset names and asset values, and automatically creating an adaptive reference model based at least in part on the plurality of snapshots.
1 . A method comprising:
receiving a plurality of snapshots from a plurality of computers, each of the plurality of snapshots comprising a plurality of pairs of asset names and asset values; and
automatically creating an adaptive reference model based at least in part on the plurality of snapshots.
2 . The method of claim 1 , wherein automatically creating an adaptive reference model comprises determining a number of times a unique asset name occurs within the plurality of pairs of asset names and asset values.
3 . The method of claim 2 , further comprising:
determining a number of different asset values associated with the unique asset name; and
halting the determination for the unique asset name if the number of different asset values for the unique asset name exceeds a threshold.
4 . The method of claim 1 , wherein automatically creating an adaptive reference model comprises determining a number of times a unique string asset value occurs within the plurality of pairs of asset names and asset values.
5 . The method of claim 1 , wherein automatically creating an adaptive reference model comprises determining a mean and a standard deviation for a unique numerical asset value that occurs within the plurality of pairs of asset names and asset values.
6 . The method of claim 1 , wherein automatically creating an adaptive reference model comprises determining a plurality of relationships among the plurality of pairs of asset names.
7 . The method of claim 6 , further comprising using the plurality of relationships to determine the probability of the existence or absence of a first asset name on one of the plurality of computers based on the existence or absence of a second asset name on the one of the plurality of computers.
8 . The method of claim 6 , further comprises identifying a cluster of asset names, the cluster comprising non-overlapping groups of asset names that appear together.
9 . The method of claim 8 , further comprising identifying a relationship among a plurality of clusters.
10 . The method of claim 9 , wherein identifying a cluster relationship among the plurality of clusters comprises computing a matrix of probabilities that predict given the existence of a particular cluster in a snapshot, the likelihood of existence of another cluster in the snapshot.
11 . The method of claim 10 , further comprising discarding a cluster relationship from the adaptive reference model if the cluster relationship violates a stronger relationship.
12 . The method of claim 1 , wherein the adaptive reference model comprises a confidence criterion for determining when a relationship can be used to test a snapshot, the confidence criterion comprising at least one of:
a minimum threshold for a number of snapshots contained in the adaptive reference model;
a minimum threshold for a number of snapshots contained in the adaptive reference model that include the relationship;
a maximum threshold for a ratio of the number of different asset values to the number of snapshots containing the asset values.
13 . The method of claim 12 , wherein the adaptive reference model further comprises a plurality of minimum and maximum thresholds associated with a plurality of numeric asset values.
14 . The method of claim 13 , further comprising determining the plurality of minimum and maximum thresholds by calculating a mean and a standard deviation from the mean for each of the plurality of asset values.
15 . The method of claim 1 , further comprising removing from the adaptive reference model at least one pair of asset name and asset value that matches a recognition filter corresponding to a known trouble condition.
16 . The method of claim 1 , further comprising modifying the adaptive reference model by applying a policy template.
17 . The method of claim 16 , wherein the policy template comprises a plurality of pairs of asset names and asset values that is expected to be present in a normal computer.
18 . The method of claim 17 , wherein:
the plurality of pairs of asset names and asset values comprises a first plurality of asset names and asset pairs;
the policy template comprises a second plurality of asset names and asset values; and
applying the policy template comprises modifying the adaptive reference model so that the second plurality of pairs of asset names and asset values appear to have been present in each of the plurality of snapshots.
19 . A computer-readable medium on which is encoded program code, the program code comprising:
program code for receiving a plurality of snapshots from a plurality of computers, each of the plurality of snapshots comprising a plurality of pairs of asset names and asset values; and
program code for automatically creating an adaptive reference model based at least in part on the plurality of snapshots.
20 . The computer-readable medium of claim 19 , wherein program code for automatically creating an adaptive reference model comprises program code for determining a number of times a unique asset name occurs within the plurality of pairs of asset names and asset values.
21 . The computer-readable medium of claim 20 , further comprising:
program code for determining a number of different asset values associated with the unique asset name; and
program code for halting the determination for the unique asset name if the number of different asset values for the unique asset name exceeds a threshold.
22 . The computer-readable medium of claim 19 , wherein program code for automatically creating an adaptive reference model comprises program code for determining a number of times a unique string asset value occurs within the plurality of pairs of asset names and asset values.
23 . The computer-readable medium of claim 19 , wherein program code for automatically creating an adaptive reference model comprises program code for determining a mean and a standard deviation for a unique numerical asset value that occurs within the plurality of pairs of asset names and asset values.
24 . The computer-readable medium of claim 19 , wherein program code for automatically creating an adaptive reference model comprises determining a plurality of relationships among the plurality of pairs of asset names.
25 . The computer-readable medium of claim 24 , further comprising program code for using the plurality of relationships to determine the probability of the existence or absence of a first asset name on one of the plurality of computers based on the existence or absence of a second asset name on the one of the plurality of computers.
26 . The computer-readable medium of claim 25 , further comprises program code for identifying a cluster of asset names, the cluster comprising non-overlapping groups of asset names that appear together.
27 . The computer-readable medium of claim 26 , further comprising program code for identifying a relationship among a plurality of clusters.
28 . The computer-readable medium of claim 27 , wherein identifying a cluster relationship among the plurality of clusters comprises program code for computing a matrix of probabilities that predict given the existence of a particular cluster in a snapshot, the likelihood of existence of another cluster in the snapshot.
29 . The computer-readable medium of claim 28 , further comprising program code for discarding a cluster relationship from the adaptive reference model if the cluster relationship violates a stronger relationship.
30 . The computer-readable medium of claim 29 , wherein the adaptive reference model further comprises a plurality of minimum and maximum thresholds associated with a plurality of numeric asset values.
31 . The computer-readable medium of claim 30 , further comprising program code for determining the plurality of minimum and maximum thresholds by calculating a mean and a standard deviation from the mean for each of the plurality of asset values.
32 . The computer-readable medium of claim 19 , further comprising program code for removing from the adaptive reference model at least one pair of asset name and asset value that matches a recognition filter corresponding to a known trouble condition.
33 . The computer-readable medium of claim 19 , further comprising program code for modifying the adaptive reference model by applying a policy template.
34 . The computer-readable medium of claim 33 , wherein the policy template comprises a plurality of pairs of asset names and asset values that is expected to be present in a normal computer.
35 . The computer-readable medium of claim 34 , wherein:
the plurality of pairs of asset names and asset values comprises a first plurality of asset names and asset pairs;
the policy template comprises a second plurality of asset names and asset values; and
program code for applying the policy template comprises modifying the adaptive reference model so that the second plurality of pairs of asset names and asset values appear to have been present in each of the plurality of snapshots.