公开(公告)号：US10884891B2

公开(公告)日：2021-01-05

申请号：US15325847

申请日：2014-12-11

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Morad Awad ,  Gil Elgrably ,  Mani Fischer ,  Renato Keshet ,  Mike Krohn ,  Alina Maor ,  Ron Maurer ,  Igor Nor ,  Olga Shain ,  Doron Shaked

IPC: G06F17/00 ,  G06F11/34 ,  G06F17/18 ,  G06F17/40 ,  G06K9/00 ,  G06K9/62 ,  G06F11/30 ,  G06F16/2455 ,  G06F3/0484

Abstract: Interactive detection of system anomalies is disclosed. One example is a system including a data processor, an anomaly processor, and an interaction processor. Input data related to a series of events and telemetry measurements is received by the data processor. The anomaly processor detects presence of a system anomaly in the input data, the system anomaly indicative of a rare situation that is distant from a norm of a distribution based on the series of events and telemetry measurements. The interaction processor is communicatively linked to the anomaly processor and to an interactive graphical user interface. The interaction processor displays, via the interactive graphical user interface, an output data stream based on the presence of the system anomaly, receives, from the interactive graphical user interface, feedback data associated with the output data stream, and provides the feedback data to the anomaly processor for operations analytics based on the feedback data.

公开(公告)号：US10803074B2

公开(公告)日：2020-10-13

申请号：US15750587

申请日：2015-08-10

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Alina Maor ,  Renato Keshet ,  Ron Maurer ,  Yaniv Sabo

IPC: G06F16/00 ,  G06F16/2458 ,  G06F16/28 ,  G06F21/00 ,  G06F21/55 ,  G06N7/00 ,  G06N20/00 ,  G06F16/2457 ,  G06F17/18

Abstract: The present disclosure provides a method, system and non-transient computer readable medium for evaluating system behaviour by deriving a statistical distance between each entity in a multi-entity system, and summing the statistical distance to each other entity to create a ranked abnormality score for each entity in the system.

公开(公告)号：US11061395B2

公开(公告)日：2021-07-13

申请号：US16071959

申请日：2016-02-04

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Ron Maurer ,  Sagi Schein ,  Renato Keshet

IPC: G05B23/02 ,  G06N3/04 ,  H04L29/06

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

公开(公告)号：US20180091359A1

公开(公告)日：2018-03-29

申请号：US15280940

申请日：2016-09-29

Applicant: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP

Inventor： Gal Alon ,  Doron Shaked ,  Igor Giller ,  Marina Lyan ,  Ron Maurer ,  Noam Fraenkel ,  Igor Nor ,  Yair Horovitz

IPC: H04L12/24

CPC classification number: H04L41/069 ,  G06F3/04182 ,  H04L41/12

Abstract: In some examples, a first pair of parameters in respective first and second log message streams associated with respective first and second source components and a second pair of parameters in the respective first and second log message streams may be identified. The first pair may be identical and the second pair may be identical. It may be determined that first pair of parameters was simultaneously generated and that the second pair of parameters was simultaneously generated in the first and in the second log message streams. A linkage score may be determined between the first and the second source components. The linkage score may be based on the determination that each of the respective first and the second pairs of parameters was simultaneously generated. It may be determined that that the first and second source components are topologically linked based on the linkage score.

公开(公告)号：US11899444B2

公开(公告)日：2024-02-13

申请号：US17348380

申请日：2021-06-15

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Ron Maurer ,  Sagi Schein ,  Renato Keshet

IPC: G05B23/02 ,  G06N3/044 ,  H04L9/40

CPC classification number: G05B23/0297 ,  G06N3/044 ,  H04L63/1425

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

公开(公告)号：US10419269B2

公开(公告)日：2019-09-17

申请号：US15438477

申请日：2017-02-21

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Pavel Danichev ,  Ron Maurer ,  Nurit Peres ,  Fernando Vizer

IPC: G06F15/173 ,  H04L12/24 ,  H04L12/26 ,  H04L29/06

Abstract: Event-time pairs are received for a current time slot. Each event-time pair denotes the occurrence of an event at a system by an event type as well as an occurrence time. For each different event type, a property value for the time slot is computed for each different property of a number of different properties, from the event-time pairs having the different event type. For each different property, a time-decaying histogram of identified property values of the different property is updated using the property value computed for the different property for the current time slot. An anomaly score for each identified property value within the time-decaying histogram of each different property is computed to detect occurrence of an anomaly within the system.

公开(公告)号：US20190033851A1

公开(公告)日：2019-01-31

申请号：US16071959

申请日：2016-02-04

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Ron Maurer ,  Sagi Schein ,  Renato Keshet

IPC: G05B23/02 ,  G06N3/04 ,  H04L29/06

Abstract: Real-time alerts and transmission of selected signal samples is disclosed. One example is a system including a base facility linked to a production station with an alerting system to perform anomaly analysis utilizing an anomaly model. A receiver at the base facility receives, from the production station, a selection of signal samples based on the anomaly analysis, where the received selection is optimized at the production station to be substantially relevant to an update of a statistical model while adhering to a dynamic capacity limitation of the production station. The statistical model is maintained at the base facility and incorporates features related to the production station. A management system at the base facility updates the statistical model based on the received selection, optionally derives an updated anomaly model based on the statistical model, and optionally transmits the updated anomaly model to the production station.

公开(公告)号：US20180241654A1

公开(公告)日：2018-08-23

申请号：US15438477

申请日：2017-02-21

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Pavel Danichev ,  Ron Maurer ,  Nurit Peres ,  Fernando Vizer

IPC: H04L12/26 ,  H04L29/08

CPC classification number: H04L41/064 ,  H04L29/06891 ,  H04L41/069 ,  H04L43/024 ,  H04L43/04 ,  H04L43/067 ,  H04L63/145

Abstract: Event-time pairs are received for a current time slot. Each event-time pair denotes the occurrence of an event at a system by an event type as well as an occurrence time. For each different event type, a property value for the time slot is computed for each different property of a number of different properties, from the event-time pairs having the different event type. For each different property, a time-decaying histogram of identified property values of the different property is updated using the property value computed for the different property for the current time slot. An anomaly score for each identified property value within the time-decaying histogram of each different property is computed to detect occurrence of an anomaly within the system.

公开(公告)号：US20190012351A1

公开(公告)日：2019-01-10

申请号：US15750587

申请日：2015-08-10

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Alina Maor ,  Renato Keshet ,  Ron Maurer ,  Yaniv Sabo

IPC: G06F17/30 ,  G06F17/18

CPC classification number: G06F16/2462 ,  G06F16/24578 ,  G06F16/285 ,  G06F16/288 ,  G06F17/18 ,  G06F21/00 ,  G06F21/552 ,  G06N7/005 ,  G06N20/00

Abstract: The present disclosure provides a method, system and non-transient computer readable medium for evaluating system behaviour by deriving a statistical distance between each entity in a multi-entity system, and summing the statistical distance to each other entity to create a ranked abnormality score for each entity in the system.

公开(公告)号：US20180238939A1

公开(公告)日：2018-08-23

申请号：US15438259

申请日：2017-02-21

Applicant: Hewlett Packard Enterprise Development LP

Inventor： Ron Maurer ,  Shahar Tal

IPC: G01R19/25 ,  G01R35/00 ,  G04F10/00

CPC classification number: G04F10/00 ,  G16H40/67

Abstract: A current measurement receipt interval is computed as a difference between a current receipt time of a current measurement from a sensor and a previous receipt time of a previous measurement from the sensor. An expected measurement receipt interval is estimated, based on a lowest mode of measurement receipt intervals including the computed current measurement receipt interval.