Correlation score based commonness indication associated with a point anomaly pertinent to data pattern changes in a cloud-based application acceleration as a service environment
A method implemented through a data processing device of a computing network including includes detecting a point anomaly in real-time data associated with each network entity based on determining whether the real-time data falls outside a threshold expected value thereof, and representing the detected point anomaly in a full mesh Q node graph, with Q being a number of features applicable for the each network entity. The method also includes capturing a transition in the point anomaly associated with a newly detected anomaly or non-anomaly in the real-time data associated with one or more of the Q number of features via the representation of the full mesh Q node graph, and deriving a current data correlation score for the point anomaly across the captured transition via the representation of the full mesh Q node graph.
1. A method of a computing network implemented in a data processing device comprising a processor communicatively coupled to a memory, comprising:
detecting real-time data associated with each network entity of a plurality of network entities of the computing network for each feature thereof sequentially in time;
detecting a point anomaly in the real-time data associated with the each network entity based on determining whether the real-time data falls outside a threshold expected value thereof;
representing the detected point anomaly in a full mesh Q node graph, wherein Q is a number of features applicable for the each network entity;
capturing a transition in the point anomaly associated with a newly detected one of: anomaly and non-anomaly in the real-time data associated with at least one feature of the Q number of features via the representation of the full mesh Q node graph; and
deriving a current data correlation score for the point anomaly across the captured transition as:
CS
=
∑
i
=
1
APC
(
1
-
EWP
i
TSAC
)
APC
,
wherein CS is the current data correlation score for the point anomaly across the captured transition, APC is a count of a total number of pairs of Y current anomalous features in the Q number of features and is given by Y C 2 + Y C 1 , EWP i is a weight of an edge of the i th pair of the Y current anomalous features in the representation of the full mesh Q node graph, and TSAC is a total number of time samples of the point anomaly comprising the captured transition, and
wherein the current data correlation score is indicative of a commonness of a combination of the Y current anomalous features contributing to the point anomaly with respect to an equivalent Y anomalous features contributing to another previously detected point anomaly associated with the each network entity.
2. The method of claim 1 , comprising the threshold expected value being one of: a maximum expected value and a minimum expected value.
3. The method of claim 1 , further comprising detecting at least one anomaly in the real-time data associated with the each network entity for the each feature thereof including the point anomaly in accordance with computing a score for the at least one anomaly indicative of anomalousness thereof, the computation of the score involving both relative scoring and absolute deviation scoring, and the absolute deviation scoring being based on previous data deviations from reference data bands.
4. The method of claim 3 , further comprising determining an event associated with a pattern of change of the real-time data associated with the each network entity based on executing an optimization algorithm to determine, among all features of the each network entity, a series of anomalies comprising the detected at least one anomaly that constitutes a sequence of patterned anomalies in accordance with scanning detected anomalies associated with the real-time data associated with the each network entity including the detected at least one anomaly.
5. The method of claim 4 , wherein determining the event based on executing the optimization algorithm further comprises finding, based on at least one dynamic programming technique, a longest occurring sequence of anomalies as the series of anomalies among all the features of the each network entity that is capable of being interleaved for a specific duration.
6. The method of claim 4 , further comprising enabling predictive classification of a future event associated with the each network entity into a category of determined problems based on the determined event associated with the pattern of change of the real-time data associated with the each network entity.
7. The method of claim 4 , further comprising at least one of:
collecting feedback from another data processing device of the computing network communicatively coupled to the data processing device via the computing network;
determining a severity indicator for the determined event based on the feedback from the another data processing device;
generating, utilizing the determined severity indicator, an event score for the determined event into which the current data correlation score is factored; and
ranking the determined event with respect to a plurality of events based on the generated event score.
8. A data processing device comprising:
a memory; and
a processor communicatively coupled to the memory, the processor executing instructions to:
detect real-time data associated with each network entity of a plurality of network entities of a computing network for each feature thereof sequentially in time,
detect a point anomaly in the real-time data associated with the each network entity based on determining whether the real-time data falls outside a threshold expected value thereof,
represent the detected point anomaly in a full mesh Q node graph, wherein Q is a number of features applicable for the each network entity,
capture a transition in the point anomaly associated with a newly detected one of: anomaly and non-anomaly in the real-time data associated with at least one feature of the Q number of features via the representation of the full mesh Q node graph, and
derive a current data correlation score for the point anomaly across the captured transition as:
CS
=
∑
i
=
1
APC
(
1
-
EWP
i
TSAC
)
APC
,
wherein CS is the current data correlation score for the point anomaly across the captured transition, APC is a count of a total number of pairs of Y current anomalous features in the Q number of features and is given by Y C 2 + Y C 1 , EWP i is a weight of an edge of the i th pair of the Y current anomalous features in the representation of the full mesh Q node graph, and TSAC is a total number of time samples of the point anomaly comprising the captured transition, and
wherein the current data correlation score is indicative of a commonness of a combination of the Y current anomalous features contributing to the point anomaly with respect to an equivalent Y anomalous features contributing to another previously detected point anomaly associated with the each network entity.
9. The data processing device of claim 8 , wherein the threshold expected value is one of: a maximum expected value and a minimum expected value.
10. The data processing device of claim 8 , wherein the processor further executes instructions to detect at least one anomaly in the real-time data associated with the each network entity for the each feature thereof including the point anomaly in accordance with computing a score for the at least one anomaly indicative of anomalousness thereof, the computation of the score involving both relative scoring and absolute deviation scoring, and the absolute deviation scoring being based on previous data deviations from reference data bands.
11. The data processing device of claim 10 , wherein the processor further executes instructions to determine an event associated with a pattern of change of the real-time data associated with the each network entity based on executing an optimization algorithm to determine, among all features of the each network entity, a series of anomalies comprising the detected at least one anomaly that constitutes a sequence of patterned anomalies in accordance with scanning detected anomalies associated with the real-time data associated with the each network entity including the detected at least one anomaly.
12. The data processing device of claim 11 , wherein the processor executes instructions to determine the event based on executing the optimization algorithm in accordance with finding, based on at least one dynamic programming technique, a longest occurring sequence of anomalies as the series of anomalies among all the features of the each network entity that is capable of being interleaved for a specific duration.
13. The data processing device of claim 11 , wherein the processor further executes instructions to enable predictive classification of a future event associated with the each network entity into a category of determined problems based on the determined event associated with the pattern of change of the real-time data associated with the each network entity.
14. The data processing device of claim 11 , wherein the processor further executes instructions to at least one of:
collect feedback from another data processing device of the computing network communicatively coupled to the data processing device via the computing network,
determine a severity indicator for the determined event based on the feedback from the another data processing device,
generate, utilizing the determined severity indicator, an event score for the determined event into which the current data correlation score is factored, and
rank the determined event with respect to a plurality of events based on the generated event score.
15. A computing system comprising:
a plurality of network entities of a computer network; and
a data processing device executing instructions to:
detect real-time data associated with each network entity of the plurality of network entities for each feature thereof sequentially in time,
detect a point anomaly in the real-time data associated with the each network entity based on determining whether the real-time data falls outside a threshold expected value thereof,
represent the detected point anomaly in a full mesh Q node graph, wherein Q is a number of features applicable for the each network entity,
capture a transition in the point anomaly associated with a newly detected one of: anomaly and non-anomaly in the real-time data associated with at least one feature of the Q number of features via the representation of the full mesh Q node graph, and
derive a current data correlation score for the point anomaly across the captured transition as:
CS
=
∑
i
=
1
APC
(
1
-
EWP
i
TSAC
)
APC
,
wherein CS is the current data correlation score for the point anomaly across the captured transition, APC is a count of a total number of pairs of Y current anomalous features in the Q number of features and is given by Y C 2 + Y C 1 , EWP i is a weight of an edge of the i th pair of the Y current anomalous features in the representation of the full mesh Q node graph, and TSAC is a total number of time samples of the point anomaly comprising the captured transition, and
wherein the current data correlation score is indicative of a commonness of a combination of the Y current anomalous features contributing to the point anomaly with respect to an equivalent Y anomalous features contributing to another previously detected point anomaly associated with the each network entity.
16. The computing system of claim 15 , wherein the threshold expected value is one of: a maximum expected value and a minimum expected value.
17. The computing system of claim 15 , wherein the data processing device further executes instructions to detect at least one anomaly in the real-time data associated with the each network entity for the each feature thereof including the point anomaly in accordance with computing a score for the at least one anomaly indicative of anomalousness thereof, the computation of the score involving both relative scoring and absolute deviation scoring, and the absolute deviation scoring being based on previous data deviations from reference data bands.
18. The computing system of claim 17 , wherein the data processing device further executes instructions to determine an event associated with a pattern of change of the real-time data associated with the each network entity based on executing an optimization algorithm to determine, among all features of the each network entity, a series of anomalies comprising the detected at least one anomaly that constitutes a sequence of patterned anomalies in accordance with scanning detected anomalies associated with the real-time data associated with the each network entity including the detected at least one anomaly.
19. The computing system of claim 18 , wherein the data processing device executes instructions to determine the event based on executing the optimization algorithm in accordance with finding, based on at least one dynamic programming technique, a longest occurring sequence of anomalies as the series of anomalies among all the features of the each network entity that is capable of being interleaved for a specific duration.
20. The computing system of claim 18 , wherein the data processing device further executes instructions to at least one of:
collect feedback from another data processing device of the computer network communicatively coupled to the data processing device via the computer network,
determine a severity indicator for the determined event based on the feedback from the another data processing device,
generate, utilizing the determined severity indicator, an event score for the determined event into which the current data correlation score is factored, and
rank the determined event with respect to a plurality of events based on the generated event score.