Segment-based technique and system for detecting performance anomalies and changes for a computer-based service
View Patent ↗A technique includes sampling at least one performance metric of a computer-based service to form time samples of the metric(s) and detecting an occurrence of an anomaly or a performance mode change in the service. The detection includes arranging the time samples in segments based on a statistical analysis of the time samples.
1. A method comprising:
sampling at least one performance metric of a computer-based service to form time samples of said at least one performance metric;
arranging the time samples in segments based on a statistical analysis of the time samples;
comparing at least some of the segments; and
identifying, based on the comparison of the segments, a particular one of the compared segments as being associated with characteristics of the at least one performance metric that are different than characteristics of the at least one performance metric that are associated with the other compared segments.
2. The method of claim 1 , wherein comparing the segments comprises:
clustering the segments to form clusters such that the segments of each cluster are statistically closer to each other than the segments not in the cluster.
3. The method of claim 2 , wherein the act of clustering comprises determining statistical distances among the segments.
4. The method of claim 1 , wherein the comparing of the segments occurs as the sampling is being performed.
5. The method of claim 1 , wherein the act of performing the statistical analysis comprises:
minimizing a statistical distance between a mixture distribution of the metric formed by the samples and a parametric statistical mixture distribution.
6. The method of claim 1 , wherein at least one of the segments includes a set of contiguous time samples with a similar performance metric.
7. The method of claim 1 , further comprising: providing information technology services, wherein the sampling and detecting are part of the information technology services.
8. The method of claim 1 , further comprising determining that the particular segment associated with the characteristics of the at least one performance metric that are different than characteristics of the at least one performance metric that are associated with the other compared segments is a segment related to a performance mode change in service relative to other segments.
9. The method of claim 1 , wherein determining that the particular segment associated with the characteristics of the at least one performance metric that are different than characteristics of the at least one performance metric that are associated with the other compared segments indicates a problem with the computer-based service.
10. The method of claim 1 , further comprising triggering an alert based on the identified segment.
11. A controller comprising:
at least one central processing unit (CPU) to provide a computer-based service; and
a performance evaluator executable on said at least one CPU to:
sample at least one performance metric of the computer-based service to form time samples of said at least one performance metric;
arrange the time samples in segments based on a statistical analysis of the samples; and
evaluate the segments to identify a segment that exhibits different characteristics of the at least one performance metric relative to other segments.
12. The controller of claim 11 , wherein the performance evaluator forms clusters of the segments such that the segments of each cluster are statistically closer to each other than the segments not in the cluster.
13. The controller of claim 12 , wherein the performance evaluator minimizes a statistical distance between a mixture distribution of the performance metric formed by the time samples and a predetermined statistical mixture distribution.
14. The controller of claim 13 , wherein the parametric statistical mixture distribution comprises a Gaussian mixture distribution.
15. The method of claim 11 , further comprising determining that the segment exhibiting different characteristics of the at least one performance metric relative to other segments is a segment related to a performance mode change in service relative to the other segments.
16. An article comprising a computer accessible storage medium containing instructions that when executed by a processor-based system cause the processor-based system to:
sample at least one performance metric of the computer-based service to form time samples of said at least one performance metric;
arrange the time samples into segments based on a statistical analysis of the samples; and
evaluate the segments to identify one segment that exhibits anomalous characteristics of the at least one performance metric relative to other segments.
17. The article of claim 16 , the storage medium containing instructions that when executed by the processor-based system cause the processor-based system to form clusters of the segments such that the segments of each cluster are statistically closer to each other than the segments not in the cluster.
18. The article of claim 17 , wherein the segment exhibiting the anomalous characteristics of the at least one performance metric is not located in any of the clusters.
19. The article of claim 16 , the storage medium containing instructions that when executed by the processor-based system cause the processor-based system to determine statistical distances among the segments to cluster the segments.
20. The controller of claim 16 , further comprising determining that the segment exhibiting anomalous characteristics of the at least one performance metric relative to other segments is a segment related to a performance mode change in service relative to the other segments.
21. A method comprising:
sampling, by a processor, at least one performance metric of a computer-based service to form time samples of the performance metric;
arranging, by a processor, the time samples into segments of contiguous time samples based on a statistical analysis of characteristics of the at least one performance metric associated with the time samples;
forming, by a processor, clusters of the segments; and
detecting, by a processor, an occurrence of an anomalous segment relative to the clusters.
22. The method of claim 21 wherein detecting an occurrence of an anomalous segment relative to the clusters includes detecting that a segment is not within any of the clusters.
23. The method of claim 21 , wherein clustering the segments comprises clustering the segments such that the segments of each cluster are statistically more similar to each other than the segments not in the cluster.