Granted Patent B2

US 12,423,419 · App. 18/157,271 · Granted Sep 23, 2025

Inventor: Ofir Ezrielev (Be'er Sheva, IL)

Assignee: Dell Products L.P.

G06F21/552G06N5/045G06F2221/034

Abstract

Claims (98)

1. A method of processing data, the method comprising:

obtaining an inference using an inference model and data obtained from a data collector, the inference being intended to match a set of fixed output values when the data is non-anomalous, and the inference comprising at least one dimension;

making a first determination, based on the inference, an anomaly level threshold, and a difference between a set of components of the inference and the set of fixed output values, regarding whether the data comprises anomalous data;

in a first instance of the first determination in which the data comprises anomalous data:

classifying the inference using a first schema to identify a type of anomaly presented by the data; and

performing an action set based on the type of anomaly to manage a potential impact of an occurrence of the type of anomaly.

2. The method of claim 1 , wherein making the first determination comprises:

obtaining a set of components of the inference, the set of components being based on the at least one dimension;

obtaining an anomaly level of the data using the set of components and the set of fixed output values;

making a second determination regarding whether the anomaly level exceeds the anomaly level threshold; and

in a first instance of the second determination in which the anomaly level exceeds the anomaly level threshold:

identifying the data as anomalous data.

3. The method of claim 2 , wherein obtaining the anomaly level comprises:

obtaining a difference, the difference being based on the set of components and the set of fixed output values; and

assigning the anomaly level of the data based on a magnitude of the difference and a second schema for identifying a degree of anomalousness of the data.

4. The method of claim 3 , wherein obtaining the difference comprises:

obtaining a first magnitude of a first component of the set of components;

obtaining a set of magnitudes, the set of magnitudes comprising the first magnitude;

obtaining a first fixed output value of the set of fixed output values, the first fixed output value corresponding to the first component;

obtaining a first difference using the first fixed output value and the first component;

obtaining a set of differences, the set of differences comprising the first difference; and

treating the set of differences as the difference.

5. The method of claim 4 , wherein classifying the inference comprises:

obtaining an identifier using the set of components; and

identifying, using the first schema and the identifier, the type of anomaly.

6. The method of claim 5 , wherein obtaining the identifier comprises:

obtaining a first direction of deviation based on the first fixed output value and the first component;

obtaining a set of directions of deviation using, at least in part, the first direction of deviation; and

obtaining the identifier using the set of directions of deviation and the difference.

7. The method of claim 5 , wherein identifying the type of anomaly comprises:

obtaining an anomaly lookup table, the anomaly lookup table comprising a listing of identifiers, and each identifier of the listing of identifiers being associated with a corresponding type of anomaly; and

performing a lookup process using the anomaly lookup table and the identifier as a key for the anomaly lookup table to obtain the type of anomaly.

8. The method of claim 5 , wherein identifying the type of anomaly comprises:

obtaining a set of clusters, each cluster in the set of clusters being associated with:

a historical inference, the historical inference being obtained prior to obtaining the inference; and

a type of anomaly;

making a third determination regarding whether the inference falls within a cluster of the set of clusters; and

in a first instance of the third determination in which the inference falls within a cluster of the set of clusters:

identifying the type of anomaly based on the cluster.

9. The method of claim 1 , wherein performing the action set comprises one selected from a group of actions consisting of:

notifying a downstream consumer of the type of anomaly;

initiating a process keyed to the type of anomaly; and

logging the type of anomaly in storage.

10. The method of claim 1 , wherein making the first determination is also based on an anomaly level for the data, the anomaly level being based on:

a difference between a set of components of the inference and the set of fixed output values.

11. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for processing data, the operations comprising:

obtaining an inference using an inference model and data obtained from a data collector, the inference being intended to match a set of fixed output values when the data is non-anomalous, and the inference comprising at least one dimension;

making a first determination, based on the inference, an anomaly level threshold, and a difference between a set of components of the inference and the set of fixed output values, regarding whether the data comprises anomalous data;

in a first instance of the first determination in which the data comprises anomalous data:

classifying the inference using a first schema to identify a type of anomaly presented by the data; and

performing an action set based on the type of anomaly to manage a potential impact of an occurrence of the type of anomaly.

12. The non-transitory machine-readable medium of claim 11 , wherein making the first determination comprises:

obtaining a set of components of the inference, the set of components being based on the at least one dimension;

obtaining an anomaly level of the data using the set of components and the set of fixed output values;

making a second determination regarding whether the anomaly level exceeds the anomaly level threshold; and

in a first instance of the second determination in which the anomaly level exceeds the anomaly level threshold:

identifying the data as anomalous data.

13. The non-transitory machine-readable medium of claim 12 , wherein obtaining the anomaly level comprises:

obtaining a difference, the difference being based on the set of components and the set of fixed output values; and

assigning the anomaly level of the data based on a magnitude of the difference and a second schema for identifying a degree of anomalousness of the data.

14. The non-transitory machine-readable medium of claim 13 , wherein obtaining the difference comprises:

obtaining a first magnitude of a first component of the set of components;

obtaining a set of magnitudes, the set of magnitudes comprising the first magnitude;

obtaining a first fixed output value of the set of fixed output values, the first fixed output value corresponding to the first component;

obtaining a first difference using the first fixed output value and the first component;

obtaining a set of differences, the set of differences comprising the first difference; and

treating the set of differences as the difference.

15. The non-transitory machine-readable medium of claim 14 , wherein classifying the inference comprises:

obtaining an identifier using the set of components; and

identifying, using the first schema and the identifier, the type of anomaly.

16. The non-transitory machine-readable medium of claim 15 , wherein obtaining the identifier comprises:

obtaining a first direction of deviation based on the first fixed output value and the first component;

obtaining a set of directions of deviation using, at least in part, the first direction of deviation; and

obtaining the identifier using the set of directions of deviation and the difference.

17. A data processing system, comprising:

a processor; and

a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for processing data, the operations comprising:

obtaining an inference using an inference model and data obtained from a data collector, the inference being intended to match a set of fixed output values when the data is non-anomalous, and the inference comprising at least one dimension;

making a first determination, based on the inference, an anomaly level threshold, and a difference between a set of components of the inference and the set of fixed output values, regarding whether the data comprises anomalous data;

in a first instance of the first determination in which the data comprises anomalous data:

classifying the inference using a first schema to identify a type of anomaly presented by the data; and

performing an action set based on the type of anomaly to manage a potential impact of an occurrence of the type of anomaly.

18. The data processing system of claim 17 , wherein making the first determination comprises:

obtaining a set of components of the inference, the set of components being based on the at least one dimension;

obtaining an anomaly level of the data using the set of components and the set of fixed output values;

making a second determination regarding whether the anomaly level exceeds the anomaly level threshold; and

in a first instance of the second determination in which the anomaly level exceeds the anomaly level threshold:

identifying the data as anomalous data.

19. The data processing system of claim 18 , wherein obtaining the anomaly level comprises:

obtaining a difference, the difference being based on the set of components and the set of fixed output values; and

assigning the anomaly level of the data based on a magnitude of the difference and a second schema for identifying a degree of anomalousness of the data.

20. The data processing system of claim 19 , wherein obtaining the difference comprises:

obtaining a first magnitude of a first component of the set of components;

obtaining a set of magnitudes, the set of magnitudes comprising the first magnitude;

obtaining a first fixed output value of the set of fixed output values, the first fixed output value corresponding to the first component;

obtaining a first difference using the first fixed output value and the first component;

obtaining a set of differences, the set of differences comprising the first difference; and

treating the set of differences as the difference.

Assignments (1)

Continuity (1)

References Cited (45)