公开(公告)号：US09245235B2

公开(公告)日：2016-01-26

申请号：US14050945

申请日：2013-10-10

Applicant: NEC Laboratories America, Inc.

Inventor： Haifeng Chen ,  Min Ding ,  Bin Liu ,  Abhishek Sharma ,  Kenji Yoshihira ,  Guofei Jiang

IPC: G06N5/04 ,  G06N99/00 ,  G06F17/18 ,  G06F11/30

CPC classification number: G06N99/005 ,  G06F11/3055 ,  G06F11/3072 ,  G06F17/18 ,  G06N5/048

Abstract: A system and method for analysis of complex systems which includes determining model parameters based on time series data, further including profiling a plurality of types of data properties to discover complex data properties and dependencies; classifying the data dependencies into predetermined categories for analysis; and generating a plurality of models based on the discovered properties and dependencies. The system and method may analyze, using a processor, the generated models based on a fitness score determined for each model to generate a status report for each model; integrate the status reports for each model to determine an anomaly score for the generated models; and generate an alarm when the anomaly score exceeds a predefined threshold.

Abstract translation: 一种用于分析复杂系统的系统和方法，包括基于时间序列数据确定模型参数，还包括分析多种类型的数据属性以发现复杂数据属性和依赖性; 将数据依赖关系分类为预定类别进行分析; 以及基于所发现的属性和依赖关系生成多个模型。 系统和方法可以基于为每个模型确定的适应度分数来使用处理器分析生成的模型，以生成每个模型的状态报告; 整合每个模型的状态报告，以确定生成的模型的异常得分; 并且当异常得分超过预定阈值时产生报警。

公开(公告)号：US08943367B2

公开(公告)日：2015-01-27

申请号：US13738004

申请日：2013-01-10

Applicant: NEC Laboratories America, Inc.

Inventor： Guofei Jiang ,  Min Ding ,  Yong Ge

IPC: G06F11/00 ,  G06F11/07 ,  G06F11/34 ,  G06F19/24

CPC classification number: G06F11/079 ,  G06F11/3457 ,  G06F19/24

Abstract: A method for metric ranking in invariant networks includes, given an invariant network and a set of broken invariants, two ranking processes are used to determine and rank the anomaly scores of each monitoring metrics in large-scale systems. Operators can follow the rank to investigate the root-cause in problem investigation. In a first ranking process, given a node/metric, the method determines multiple scores by integrating information from immediate neighbors to decide the anomaly score for metric ranking. In a second ranking process, given a node/metric, an iteration process is used to recursively integrate the information from immediate neighbors at each round to determine its anomaly score for metric ranking.

Abstract translation: 在不变网络中的度量排序的方法包括给定不变网络和一组破坏的不变量，使用两个排序过程来确定和排列大型系统中每个监测度量的异常分数。 运营商可以按照排名调查问题调查的根本原因。 在第一排序过程中，给定节点/度量，该方法通过集成来自直接邻居的信息来确定度量排名的异常得分来确定多个分数。 在第二个排序过程中，给定一个节点/度量，迭代过程被用来递归地整合来自每个轮次的直接邻居的信息，以确定其针对度量排名的异常得分。

公开(公告)号：US20140108324A1

公开(公告)日：2014-04-17

申请号：US14050808

申请日：2013-10-10

Applicant: NEC Laboratories America, Inc.

Inventor： Haifeng Chen ,  Min Ding ,  Bin Liu ,  Abhishek Sharma ,  Kenji Yoshihira ,  Guofei Jiang

IPC: G06N5/04

CPC classification number: G06N20/00 ,  G06F11/3055 ,  G06F11/3072 ,  G06F17/18 ,  G06N5/048

Abstract: Systems and method for modeling system dynamics, including extracting features representative of a temporal evolution of a dynamical system, further including deriving one or more vector trajectories by performing sliding window segmentation of one or more time series; applying a linear test to determine whether the one or more vector trajectories are linear or nonlinear; and performing linear or nonlinear subspace decomposition on the vector trajectory based on the linear test. The system and method may generate a system evolution model from the extracted features of the dynamical system and determine a fitness score of the system evolution model.

Abstract translation: 用于建模系统动力学的系统和方法，包括提取表示动力系统的时间演化的特征，还包括通过执行一个或多个时间序列的滑动窗口分割来导出一个或多个矢量轨迹; 应用线性测试来确定一个或多个矢量轨迹是线性还是非线性; 并基于线性测试对矢量轨迹进行线性或非线性子空间分解。 系统和方法可以从动力系统的提取特征生成系统演化模型，并确定系统演化模型的适应度。

公开(公告)号：US20140047279A1

公开(公告)日：2014-02-13

申请号：US13950523

申请日：2013-07-25

Applicant: NEC Laboratories America, Inc.

Inventor： Abishek Sharma ,  Heifeng Chen ,  Min Ding ,  Kenji Yoshihira ,  Guofei Jiang

IPC: G06F11/07

CPC classification number: G06F11/0751 ,  G06F11/0709 ,  G06F11/079 ,  H04L41/064 ,  H04L41/0677 ,  H04L43/0817

Abstract: A computer implemented method for temporal ranking in invariant networks includes considering an invariant network and a set of broken invariants in the invariant network, assuming, for each time point inside a window W, that each metric with broken invariants is affected by a fault at that time point, computing an expected pattern for each invariant of a metric with assumed fault, said pattern indicative of time points at which an invariant will be broken given that its associated metric was affected by a fault at time t, comparing the expected pattern with the pattern observed over the time window W; and determining a temporal score based on a match from the prior comparing

Abstract translation: 用于不变网络中的时间排序的计算机实现方法包括考虑不变网络中的不变网络和一组破坏的不变量，假设对于窗口W内的每个时间点，具有破坏不变量的每个度量受到该故障的影响 时间点，计算具有假定故障的度量的每个不变量的预期模式，所述模式指示在时间t处其相关联度量受到故障影响时不变量将被破坏的时间点，将预期模式与 在时间窗口W上观察到的图案; 以及基于来自所述先前比较的匹配来确定时间分数

公开(公告)号：US09026855B2

公开(公告)日：2015-05-05

申请号：US13950523

申请日：2013-07-25

Applicant: NEC Laboratories America, Inc.

Inventor： Abhishek Sharma ,  Haifeng Chen ,  Min Ding ,  Kenji Yoshihira ,  Guofei Jiang

IPC: G06F11/00 ,  G06F11/07 ,  H04L12/24 ,  H04L12/26

CPC classification number: G06F11/0751 ,  G06F11/0709 ,  G06F11/079 ,  H04L41/064 ,  H04L41/0677 ,  H04L43/0817

Abstract: A computer implemented method for temporal ranking in invariant networks includes considering an invariant network and a set of broken invariants in the invariant network, assuming, for each time point inside a window W, that each metric with broken invariants is affected by a fault at that time point, computing an expected pattern for each invariant of a metric with assumed fault, said pattern indicative of time points at which an invariant will be broken given that its associated metric was affected by a fault at time t, comparing the expected pattern with the pattern observed over the time window W; and determining a temporal score based on a match from the prior comparing.

Abstract translation: 用于不变网络中的时间排序的计算机实现方法包括考虑不变网络中的不变网络和一组破坏的不变量，假设对于窗口W内的每个时间点，具有破坏不变量的每个度量受到该故障的影响 时间点，计算具有假定故障的度量的每个不变量的预期模式，所述模式指示在时间t处其相关联度量受到故障影响时不变量将被破坏的时间点，将预期模式与 在时间窗口W上观察到的图案; 以及基于来自所述先前比较的匹配来确定时间分数。

公开(公告)号：US20140108314A1

公开(公告)日：2014-04-17

申请号：US14050945

申请日：2013-10-10

Applicant: NEC Laboratories America, Inc.

Inventor： Haifeng Chen ,  Min Ding ,  Bin Liu ,  Abhishek Sharma ,  Kenji Yoshihira ,  Guofei Jiang

IPC: G06N99/00

CPC classification number: G06N99/005 ,  G06F11/3055 ,  G06F11/3072 ,  G06F17/18 ,  G06N5/048

Abstract: A system and method for analysis of complex systems which includes determining model parameters based on time series data, further including profiling a plurality of types of data properties to discover complex data properties and dependencies; classifying the data dependencies into predetermined categories for analysis; and generating a plurality of models based on the discovered properties and dependencies. The system and method may analyze, using a processor, the generated models based on a fitness score determined for each model to generate a status report for each model; integrate the status reports for each model to determine an anomaly score for the generated models; and generate an alarm when the anomaly score exceeds a predefined threshold.

Abstract translation: 一种用于分析复杂系统的系统和方法，包括基于时间序列数据确定模型参数，还包括分析多种类型的数据属性以发现复杂数据属性和依赖性; 将数据依赖关系分类为预定类别进行分析; 以及基于所发现的属性和依赖关系生成多个模型。 系统和方法可以基于为每个模型确定的适应度分数来使用处理器分析生成的模型，以生成每个模型的状态报告; 整合每个模型的状态报告，以确定生成的模型的异常得分; 并且当异常得分超过预定阈值时产生报警。

公开(公告)号：US20130219223A1

公开(公告)日：2013-08-22

申请号：US13738004

申请日：2013-01-10

Applicant: NEC Laboratories America, Inc.

Inventor： Guofei Jiang ,  Min Ding ,  Yong Ge

IPC: G06F11/07

CPC classification number: G06F11/079 ,  G06F11/3457 ,  G06F19/24

Abstract: A method for metric ranking in invariant networks includes, given an invariant network and a set of broken invariants, two ranking processes are used to determine and rank the anomaly scores of each monitoring metrics in large-scale systems. Operators can follow the rank to investigate the root-cause in problem investigation. In a first ranking process, given a node/metric, the method determines multiple scores by integrating information from immediate neighbors to decide the anomaly score for metric ranking. In a second ranking process, given a node/metric, an iteration process is used to recursively integrate the information from immediate neighbors at each round to determine its anomaly score for metric ranking.

Abstract translation: 在不变网络中的度量排序的方法包括给定不变网络和一组破坏的不变量，使用两个排序过程来确定和排列大型系统中每个监测度量的异常分数。 运营商可以按照排名调查问题调查的根本原因。 在第一排序过程中，给定节点/度量，该方法通过集成来自直接邻居的信息来确定度量排名的异常得分来确定多个分数。 在第二个排序过程中，给定一个节点/度量，迭代过程被用来递归地整合来自每个轮次的直接邻居的信息，以确定其针对度量排名的异常得分。