Methods and systems that estimate a degree of abnormality of a complex system
Methods and systems that estimate a degree of abnormality of a complex system based on historical time-series data representative of the complex system's past behavior and using the historical degree of abnormality to determine whether or not a degree of abnormality determined from current time-series data representative of the same complex system's current behavior is worthy of attention. The time-series data may be metric data that represents behavior of a complex system as a result of successive measurements of the complex system made over time or in a time interval. A degree of abnormality represents the amount by which the time-series data violates a threshold. The larger the degree of abnormality of the current time-series data is from the historical degree of abnormality, the larger the violation of the thresholds and the greater the probability the violation in the current time-series data is worthy of attention.
1. A method stored in one or more data-storage devices and executed using one or more processors of a computer system to identify abnormal behavior of a virtual machine, the method comprising:
retrieving historical time-series data that represents one of past behavior, performance, and usage of the virtual machine from a data-storage device;
retrieving current time-series data that represents one of current behavior, performance, and usage of the virtual machine from a data-storage device;
computing estimated upper-threshold and lower-threshold historical degrees of abnormality based on the historical time-series data;
computing estimated current degree of abnormality based on the current time-series;
comparing the estimated current degree of abnormality with one of the estimated upper-threshold and lower-threshold historical degrees of abnormality to determine whether one of the current behavior, performance, and usage of the virtual machine is abnormal; and
displaying an alert on a visual display screen in response to the virtual machine experiencing the abnormal behavior, performance, or usage, the alert indicating an out-of-control process of the virtual machine.
2. The method of claim 1 , wherein computing the estimated historical degree of abnormality further comprises
computing upper and lower combined sets of abnormalities based on the historical time-series data;
for each set of abnormalities,
forming a histogram of the set of abnormalities;
computing an empirical probability density function based on the histogram;
computing a cumulative distribution based on the empirical probability;
computing an inverse empirical cumulative distribution based on the empirical cumulative distribution, the inverse empirical cumulative distribution is one of an upper-threshold abnormality degree component of the upper-threshold historical degree of abnormality and a lower-threshold abnormality degree component of the lower-threshold historical degree of abnormality;
forming the upper-threshold estimated historical degree of abnormality based the upper-threshold abnormality degree components; and
forming the lower-threshold estimated historical degree of abnormality based the lower-threshold abnormality degree components.
3. The method of claim 2 , wherein computing the upper and lower combined sets of abnormalities further comprises:
forming upper-threshold combined set of abnormalities, the upper-threshold combined set of abnormalities having one of a set of historical upper-threshold event distances and a set of historical upper-threshold distance metrics and one of a set of historical upper-threshold event durations and a set of historical upper-threshold event counts; and
forming lower-threshold combined set of abnormalities, the upper-threshold combined set of abnormalities having one of a set of historical lower-threshold event distances and a set of historical lower-threshold distance metrics and one of a set of historical lower-threshold event durations and a set of historical lower-threshold event counts.
4. The method of claim 2 , wherein the cumulative distribution further comprises one of an empirical cumulative distribution and a parametric cumulative distribution.
5. The method of claim 1 , wherein computing the estimated current degree of abnormality further comprises:
computing a current distance metric for data values of the current time-series that violates one of an upper threshold and a lower threshold;
computing one of a current count and a current duration of the data values of the current time-series that violates one of an upper threshold and a lower threshold; and
forming the estimated current degree of abnormality based on the current distance metric and one of the current count and the current duration.
6. The method of claim 1 , wherein comparing the estimated current degree of abnormality with one of the estimated upper-threshold and lower-threshold historical degrees of abnormality further comprises:
when the estimated current degree of abnormality corresponds to an upper-threshold event, comparing the estimated current degree of abnormality with the estimated upper-threshold historical degree of abnormality;
when the estimated current degree of abnormality corresponds to a lower-threshold event, comparing the estimated current degree of abnormality with the estimated lower-threshold historical degree of abnormality; and
generating an alert when a current distance metric and one of a current count and a current duration of the estimated current degree of abnormality are greater than the abnormality degree components one of the upper-threshold historical degree of abnormality and lower-threshold degree of historical degree of abnormality.
7. A system to identify abnormal behavior of a virtual machine, the system comprising:
one or more processors;
one or more data-storage devices;
a visual display screen; and
machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors controls the system to perform operations comprising:
retrieving historical time-series data that represents one of past behavior, performance, and usage of the virtual machine from the one or more data-storage device;
retrieving current time-series data that represents one of current behavior, performance, and usage of the virtual machine from the one or more data-storage device;
computing estimated upper-threshold and lower-threshold historical degrees of abnormality based on historical time-series data;
computing estimated current degree of abnormality based on current time-series data;
comparing the estimated current degree of abnormality with one of the estimated upper-threshold and lower-threshold historical degrees of abnormality to determine whether one of the current behavior, performance, and usage of the virtual machine is abnormal; and
displaying an alert on the visual display screen in response to the virtual machine experiencing the abnormal behavior, performance, or usage, the alert indicating an out-of-control process of the virtual machine.
8. The system of claim 7 , wherein computing the estimated historical degree of abnormality further comprises
computing upper and lower combined sets of abnormalities based on the historical time-series data;
for each set of abnormalities,
forming a histogram of the set of abnormalities;
computing an empirical probability density function based on the histogram;
computing a cumulative distribution based on the empirical probability;
computing an inverse empirical cumulative distribution based on the empirical cumulative distribution, the inverse empirical cumulative distribution is one of an upper-threshold abnormality degree component of the upper-threshold historical degree of abnormality and a lower-threshold abnormality degree component of the lower-threshold historical degree of abnormality;
forming the upper-threshold estimated historical degree of abnormality based the upper-threshold abnormality degree components; and
forming the lower-threshold estimated historical degree of abnormality based the lower-threshold abnormality degree components.
9. The method of claim 8 , wherein computing the upper and lower combined sets of abnormalities further comprises:
forming upper-threshold combined set of abnormalities, the upper-threshold combined set of abnormalities having one of a set of historical upper-threshold event distances and a set of historical upper-threshold distance metrics and one of a set of historical upper-threshold event durations and a set of historical upper-threshold event counts; and
forming lower-threshold combined set of abnormalities, the upper-threshold combined set of abnormalities having one of a set of historical lower-threshold event distances and a set of historical lower-threshold distance metrics and one of a set of historical lower-threshold event durations and a set of historical lower-threshold event counts.
10. The method of claim 8 , wherein the cumulative distribution further comprises one of an empirical cumulative distribution and a parametric cumulative distribution.
11. The method of claim 7 , wherein computing the estimated current degree of abnormality further comprises:
computing a current distance metric for data values of the current time-series that violates one of an upper threshold and a lower threshold;
computing one of a current count and a current duration of the data values of the current time-series that violates one of an upper threshold and a lower threshold; and
forming the estimated current degree of abnormality based on the current distance metric and one of the current count and the current duration.
12. The method of claim 7 , wherein comparing the estimated current degree of abnormality with one of the estimated upper-threshold and lower-threshold historical degrees of abnormality further comprises:
when the estimated current degree of abnormality corresponds to an upper-threshold event, comparing the estimated current degree of abnormality with the estimated upper-threshold historical degree of abnormality;
when the estimated current degree of abnormality corresponds to a lower-threshold event, comparing the estimated current degree of abnormality with the estimated lower-threshold historical degree of abnormality; and
generating an alert when a current distance metric and one of a current count and a current duration of the estimated current degree of abnormality are greater than the abnormality degree components one of the upper-threshold historical degree of abnormality and lower-threshold degree of historical degree of abnormality.
13. A method stored in one or more data-storage devises and executed using one or more processors of a computer system to identify abnormal behavior of a virtual machine, the method comprising:
retrieving historical time-series data that represents one of past behavior, performance, and usage of the virtual machine from the one or more data-storage device;
retrieving current time-series data that represents one of current behavior, performance, and usage of the virtual machine from the one or more data-storage device;
determining upper-threshold events and lower-threshold event in the historical time-series data;
for each upper and lower threshold event,
computing a normalized total relative distance,
computing a median of the normalized total relative distances, and
computing a mean of the normalized total relative distances;
computing one of an upper-threshold cumulative distribution and lower-threshold cumulative distribution for the current time-series data based on the median and mean of the normalized total relative distance, the cumulative distribution is the estimate of the degree of abnormality; and
displaying an alert on a visual display screen in response to the cumulative distribution of the current upper-threshold event or the current lower-threshold event being greater than a threshold, the alert indicating an out-of-control process of the virtual machine.
14. The method of claim 13 , wherein determining the upper-threshold events in the historical time-series data further comprises:
for each data value of the historical time-series greater than the upper threshold, computing a relative distance; and
forming an upper-threshold event, each upper-threshold event corresponds to set of consecutive relative distances.
15. The method of claim 13 , wherein determining the lower-threshold events in the historical time-series data further comprises:
for each data value of the historical time-series greater than the lower threshold, computing a relative distance; and
forming a lower-threshold event, each lower-threshold event corresponds to set of consecutive relative distances.
16. The method of claim 13 , wherein computing a normalized total relative distance further comprises integrating over the relative distances comprising one of an upper-threshold event and a lower-threshold event.
17. The method of claim 13 , wherein computing the cumulative distribution for the current data further comprises:
determining one of an upper-threshold event and a lower-threshold event in the current time-series data;
computing a total relative distance of one of the upper-threshold event and the lower-threshold event;
normalizing the total relative distance based on the event counts of the event; and
computing a value for the cumulative distribution based on the normalized total relative distance of the event, the value is the degree of abnormality of the current time-series data.
18. A non-transitory computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system to perform operations comprising:
retrieving historical time-series data that represents one of past behavior, performance, and usage of the virtual machine from a data-storage device;
retrieving current time-series data that represents one of current behavior, performance, and usage of the virtual machine from a data-storage device;
determining upper-threshold events and lower-threshold event in the historical time-series data;
for each upper and lower threshold event,
computing a normalized total relative distance,
computing a median of the normalized total relative distances, and
computing a mean of the normalized total relative distances;
computing one of an upper-threshold cumulative distribution and lower-threshold cumulative distribution for the current time-series data based on the median and mean of the normalized total relative distance, the cumulative distribution is the estimate of the degree of abnormality; and
displaying an alert on a visual display screen in response to the cumulative distribution of the current upper-threshold event or the current lower-threshold event being greater than a threshold, the alert indicating an out-of-control process of the virtual machine.
19. The computer-readable medium of claim 18 , wherein determining the upper-threshold events in the historical time-series data further comprises:
for each data value of the historical time-series greater than the upper threshold, computing a relative distance; and
forming an upper-threshold event, each upper-threshold event corresponds to set of consecutive relative distances.
20. The computer-readable medium of claim 18 , wherein determining the lower-threshold events in the historical time-series data further comprises:
for each data value of the historical time-series greater than the lower threshold, computing a relative distance; and
forming a lower-threshold event, each lower-threshold event corresponds to set of consecutive relative distances.
21. The computer-readable medium of claim 18 , wherein computing a normalized total relative distance further comprises integrating over the relative distances comprising one of an upper-threshold event and a lower-threshold event.
22. The computer-readable medium of claim 18 , wherein computing the cumulative distribution for the current data further comprises:
determining one of an upper-threshold event and a lower-threshold event in the current time-series data;
computing a total relative distance of one of the upper-threshold event and the lower-threshold event;
normalizing the total relative distance based on the event counts of the event; and
computing a value for the cumulative distribution based on the normalized total relative distance of the event, the value is the degree of abnormality of the current time-series data.