METHODOLOGY FOR INTELLIGENT PATTERN DETECTION AND ANOMALY DETECTION IN MACHINE TO MACHINE COMMUNICATION NETWORK
The present invention relates generally to network communications, and more particularly to machine-to-machine (M 2 M) data communications. The present invention provides for a method, apparatus and computer program product for detecting anomalous performance event across a machine-to-machine (M 2 M) network and thereafter alerting users of performance issues in real-time or near real-time.
1 . A method for detecting an abnormal performance event across a machine-to-machine (M2M) network, comprising:
determining by identification one or more performance events to monitor;
acquiring data of one or more monitored performance events;
comparing the acquired data with one or more predetermined event characteristic limits over a predetermined period in real-time or near real-time; and
issuing an alert in response to compared acquired data exceeding the one or more predetermined event characteristic limits.
2 . The method of claim 1 , wherein the acquiring data further includes identifying one or more event data streams to monitor and identifying data within the one or more event data streams.
3 . The method of claim 2 , wherein the identifying data within the one or more event streams further includes sourcing information from one or more log files of a server.
4 . The method of claim 3 , wherein the server is an authentication, authorization and accounting server.
5 . The method of claim 2 , wherein the identifying data within the one or more event streams further includes capturing identified data for the comparing.
6 . The method of claim 3 , wherein the comparing further includes comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.
7 . The method of claim 6 , wherein the comparing further includes comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period and with one or more historical files.
8 . The method of claim 1 , wherein the issuing an alert further includes directing an asynchronous alert command to a command interface message queue associated with a predetermined output routing for receipt by one or more receiving devices associated with the predetermined output routing.
9 . The method of claim 8 , wherein the predetermined output is the alert is sent to a device having an application programming interface of an interested party.
10 . The method of claim 9 , wherein the alert includes one or more of: a voice call, an email and a text message.
11 . The method of claim 9 , wherein the application programming interface of an interested party comprises at least one or more of an Alerts section displaying near real time alerts from multiple sources and a Device Details section displaying details of events in relation to a device.
12 . An apparatus for communicating and issuing alerts in response to event data exceeding one or more event thresholds in a machine-to-machine (M2M) network, comprising:
a device protocol capable of communications with a server across a M2M network,
a device capable of communicating with a server system across the network using a communication adapter; the server system having an application module for acquiring event data of one or more events, comparing acquired event data with one or more predetermined event characteristic limits over a predetermined period in real-time or near real-time; and issuing a command in response to compared acquired data exceeding the one or more predetermined event characteristic limits; and
a notification means for issuing an alert to one or more recipients in response to the issued command, wherein the alert includes information in relation the event.
13 . The apparatus of claim 12 , wherein the server is in communication with one or more receiving devices.
14 . The apparatus of claim 13 , wherein the application module further includes logic to identify one or more event data streams to monitor and identify data within the one or more event data streams.
15 . The apparatus of claim 13 , wherein the application module further includes logic to capture identified data for the comparing.
16 . The apparatus of claim 13 , wherein the application module further includes logic to compare the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.
17 . The apparatus of claim 16 , wherein the application module further includes logic to issue an alert to the one or more receiving devices.
18 . The apparatus of claim 17 , wherein the alert is sent to a device having an application programming interface of an interested party.
19 . The apparatus of claim 17 , wherein the alert includes one or more of: a voice call, an email and a text message.
20 . A computer program product stored on a computer usable medium, comprising: computer readable program means for causing a computer to control an execution of an application to perform a method for detecting anomalous performance event data across a machine-to-machine (M2M) network, comprising:
determining by identification one or more performance events to monitor;
acquiring data of one or more monitored performance events;
comparing the acquired data with one or more predetermined event characteristic limits over a predetermined period in real-time or near real-time; and issuing an alert in response to compared acquired data exceeding the one or more predetermined event characteristic limits.