Abstract:
The disclosed embodiments relate to a system that reduces bandwidth requirements for transmitting telemetry data from sensors in a computer system. During operation, the system obtains a cross-imputability value for each sensor in a set of sensors that are monitoring the computer system, wherein a cross-imputability value for a sensor indicates how well a sensor value obtained from the sensor can be predicted based on sensor values obtained from other sensors in the set. Next, the system clusters sensors in the set of sensors into two or more groups based on the determined cross-imputability values. Then, while transmitting sensor values from the set of sensors, for a group of sensors having cross-imputability values exceeding a threshold, the system selectively transmits sensor values from some but not all of the sensors in the group to reduce a number of sensor values transmitted.
Abstract:
The disclosed embodiments provide a system that analyzes telemetry data from a computer system. During operation, the system obtains the telemetry data, which includes first information containing telemetric signals gathered using sensors in the computer system and second information that indicates one or more transaction latencies of software running on the computer system. Upon detecting an upward trend in the one or more transaction latencies, the system analyzes the telemetry data for a correlation between the one or more transaction latencies and one or more environmental factors represented by a subset of the telemetric signals. Upon identifying the correlation between the one or more transaction latencies and an environmental factor, the system stores an indication that the environmental factor may be contributing to the upward trend in the one or more transaction latencies.
Abstract:
The disclosed embodiments relate to a system for validating a prognostic-surveillance mechanism, which detects anomalies that arise during operation of a computer system. During operation, the system obtains telemetry data comprising a set of raw signals gathered from sensors in the computer system during operation of the computer system, wherein the telemetry signals are gathered over a monitored time period. Next, for each raw signal in the set of raw signals, the system decomposes the raw signal into deterministic and stochastic components. The system then generates a corresponding set of synthesized signals based on the deterministic and stochastic components of the raw signals, wherein the synthesized signals are generated for a simulated time period, which is longer than the monitored time period. Finally, the system uses the set of synthesized signals to validate one or more performance metrics of the prognostic-surveillance mechanism.
Abstract:
The disclosed embodiments relate to a system that performs an intrusion-detection technique to differentiate between packets received from malicious remote users and legitimate local users in a networked computer system. During operation, the system determines arrival times for incoming packets at a node in the networked computer system. Next, the system determines inter-arrival times between the incoming packets from the arrival times. The system then determines a mean cumulative function (MCF) for the inter-arrival times by computing a cumulative sum of the inter-arrival times. Finally, upon detecting a change in a slope of the MCF, the system generates an alarm to indicate that a malicious remote user may be generating some of the incoming packets.
Abstract:
The disclosed embodiments provide a system that analyzes telemetry data from a computer system. During operation, the system obtains the telemetry data, which includes first information containing telemetric signals gathered using sensors in the computer system and second information that indicates one or more transaction latencies of software running on the computer system. Upon detecting an upward trend in the one or more transaction latencies, the system analyzes the telemetry data for a correlation between the one or more transaction latencies and one or more environmental factors represented by a subset of the telemetric signals. Upon identifying the correlation between the one or more transaction latencies and an environmental factor, the system stores an indication that the environmental factor may be contributing to the upward trend in the one or more transaction latencies.