Enterprise black box system and method for data centers

1. A distributed black box system, comprising a plurality of data center enterprise black box (DEBB) systems, for providing comprehensive awareness, assuredness, and auditability of a plurality of activities with respect to a plurality of data centers to an enterprise by raising a plurality of alerts based on a plurality of model sequences, a plurality of model frequency measures, and a plurality of model occurrence factors,

wherein a plurality of application and data assets of said enterprise are hosted by said plurality of data centers in a distributed manner,

a DEBB system part of said distributed black box system is associated with a data center of said plurality of data centers, and

said DEBB system provides a black box functionality for said enterprise by providing a single point of entry and exit for requests directed to said data center and by coordinating with a plurality of peer DEBB systems, wherein each of said peer DEBB systems is a part of said plurality of DEBB systems,

said plurality of activities result in a plurality of transactions with respect to said plurality of data centers,

said plurality of transactions result in a plurality of errors related to said plurality of data centers, said plurality of transactions result in a plurality of exceptions related to said plurality of data centers,

said DEBB system including a non-transitory tangible computer readable medium storing computer readable program code for causing a computer to perform the steps of:

determining an external transaction, wherein said external transaction is a transaction initiated by said enterprise and is a part of said plurality of transactions;

determining an external transaction type of said external transaction;

determining a sequence of internal transactions related to said external transaction, wherein each internal transaction of said sequence of internal transactions is initiated by a data center of said plurality of data centers;

determining a sequence of internal transaction types, wherein each internal transaction type of said sequence of internal transaction types corresponds with an internal transaction of said sequence of internal transactions;

determining a plurality of external transactions, wherein each of said plurality of external transactions is of said external transaction type;

determining a plurality of sequences of internal transaction types, wherein each sequence of said plurality of sequences of internal transaction types is associated with an external transaction of said plurality of external transactions; and

correlating of said plurality of sequences of internal transaction types to compute a plurality of computed model sequences, wherein each of said plurality of computed model sequences is a part of said plurality of model sequences.

2. The system of claim 1 , wherein said computer readable program code further comprises code for causing the computer to perform the steps of:

determining an external transaction of said plurality of transactions, wherein said external transaction is a transaction initiated by said enterprise and is a part of said plurality of transactions;

determining an external transaction type of said external transaction;

determining a sequence of internal transactions related to said external transaction, wherein each internal transaction of said sequence of internal transactions is initiated by a data center of plurality of data centers and is a part of said plurality of transactions;

determining a sequence of internal transaction types, wherein each internal transaction type of said sequence of internal transaction types corresponds with an internal transaction of said sequence of internal transactions;

determining a plurality of internal transaction type model sequences based on said external transaction type and said plurality of model sequences;

correlating of said sequence of internal transaction types with each of said plurality of internal transaction type model sequences to determine an abnormality factor of said external transaction; and

raising of an abnormal transaction alert of said plurality of alerts based on said abnormality factor.

3. The system of claim 1 wherein said computer readable program code further comprises code for causing the computer to perform the steps of:

determining an internal transaction of said plurality of transactions, wherein said internal transaction is a transaction initiated by a data center of said plurality of data centers;

determining an internal transaction type of said internal transaction;

determining an external transaction of said plurality of transactions associated with said internal transaction;

determining an external transaction type of said external transaction;

determining an occurrence count associated with said internal transaction type and said external transaction, wherein said occurrence count is based on the number of times an internal transaction of said internal transaction type happens as part of said external transaction;

determining a model frequency measure and a model occurrence factor based on said internal transaction type, said external transaction type, said plurality of model frequency measures, and said plurality of model occurrence factors;

determining an abnormality factor based on said occurrence count, said model frequency measure, and said model occurrence factor;

raising of an abnormal transaction alert of said plurality of alerts based on said abnormality factor.

4. The system of claim 1 , wherein said computer readable program code further comprises code for causing the computer to perform the steps of:

determining a transaction of said plurality of transactions;

determining a transaction type of said transaction;

determining a sequence of abnormal transaction alerts associated with said transaction type, wherein an alert of said sequence of abnormal transaction alters is a part of said plurality of alerts;

predicting an alert score based on a time series analysis of said sequence of abnormal transaction alerts;

computing a transaction abnormality risk based on said alert score; and

raising of an abnormal transaction alert of said plurality of alerts based on said transaction abnormality risk.

5. The system of claim 1 , wherein said computer readable program code further comprises code for causing the computer to perform the steps of:

determining an error of said plurality of errors;

determining an error type of said error;

determining a sequence of abnormal error alerts associated with said error type wherein an alert of said sequence of abnormal error alters is a part of said plurality of alerts;

predicting an alert score based on a time series analysis of said sequence of abnormal error alerts;

computing an error abnormality risk based on said alert score; and

raising of an abnormal error alert of said plurality of alerts based on said error abnormality risk.

6. The system of claim 1 , wherein said computer readable program code further comprises code for causing the computer to perform the steps of:

determining an exception of said plurality of errors;

determining an exception type of said error;

determining a sequence of abnormal exception alerts associated with said exception type wherein an alert of said sequence of abnormal exception alters is a part of said plurality of alerts;

predicting an alert score based on a time series analysis of said sequence of abnormal exception alerts;

computing an exception abnormality risk based on said alert score; and

raising of an abnormal exception alert of said plurality of alerts based on said error abnormality risk.

7. The system of claim 1 , wherein said further computer readable program code further comprises code for causing the computer to perform the steps of:

determining an internal transaction, wherein said internal transaction is a transaction initiated by a data center of said plurality of data centers and is a part of said plurality of transactions;

determining an internal transaction type of said internal transaction;

determining an external transaction type;

determining a plurality of external transactions of said plurality of transactions related to said external transaction type;

identifying a plurality of associated external transactions, wherein each of said plurality of associated external transactions is a part of said plurality of external transactions and an internal transaction of said internal transaction type happens as part of each associated external transaction of said plurality of associated external transactions;

determining a sequence of numbers, wherein each number of said sequence of numbers corresponds with the count of number times an internal transaction of said internal transaction type happens as part of an associated external transaction of said plurality of associated external transactions;

determining a model frequency measure of said plurality of model frequency measures based on said sequence of numbers; and

determining a model occurrence factor of said plurality of model occurrence factors based on said plurality of associated external transactions and said plurality of external transactions.