Patent Grant
11914462
In the last few years, computing environments have grown at astronomical rates, making it more and more difficult to detect and diagnose issues. To address this difficulty, complex monitoring and alerting systems have been built and are available to enterprises. Generally, those systems monitor the computing environment and send alerts to engineers and administrators when things break. However, even with those systems it may be difficult to identify and diagnose issues, for example, because it may be difficult to determine what an alert means, what the underlying issue is, and/or how to fix the issue. In addition, a computing environment may generate many (e.g., hundreds, thousands, etc.) alerts daily. Some alerts may be minor warnings and may not be as important as other alerts that indicate more critical errors/problems. Thus, it may also be difficult to determine which alerts or issues should be addressed right away.
Methods and systems are described herein for detecting incidents (e.g., errors, events, etc.) in computing systems.
To address these and other issues, computing systems may use social media messages, for example, received from third party computer systems to identify issues and events in a computing environment. Users may post messages to one or more social media accounts associated with an enterprise (e.g., a Twitter® account and/or a Facebook® account) that describe an issue (e.g., complain about an issue) they are experiencing with an organization's computing system. For example, a user may complain on social media that they are unable to login to a website or access certain data on a mobile application. The social media messages may be received by a computing system associated with the enterprise and may be aggregated based on a timestamp associated with each message. For example, each message that was published within a time window (e.g., 5 minutes, 10 minutes, 3 hours, 1 day, or any other time window) may form a group. Each group may be combined into an entry such that a timeseries dataset is generated based on many groups. The timeseries dataset may be used to determine whether a system issue or another event occurred in the enterprise by performing anomaly detection on the dataset. For example, an anomaly may indicate that there is an unusually large number of people having issues with a computing system, software application, website, or other service. The text from one or more social media messages associated with a detected anomaly may indicate what service, component, device, etc. is having a problem. An anomaly detection system may be able to use this data to generate an alert to send to the appropriate monitoring system (e.g., so that it can properly notify a user to fix the issue). An anomaly detection system may also be able to use the data to determine an appropriate priority level for an alert associated with the issue. For example, if the issue is affecting certain target users or a large number of users of the system, it may be helpful to raise the priority of an alert associated with the issue so that it is addressed more quickly. The anomaly detection system may be implemented as one or more services. For example, the anomaly detection system may include an anomaly detection service and/or a sentiment analysis service for analyzing the social media messages. Each service may be accessible via an application programming interface (API) by other computing systems.
Additionally or alternatively, an anomaly detection system may be able to notify a computing system when something is working well. For example, if there is an update to a user interface, users may post messages to their social media accounts saying how much they enjoy the new user interface. Users may otherwise use social media to state their opinion about various products offered by the organization. For example, a user may publish a message indicating that the user likes a new logo. A system may use social media messages, sentiment analysis, and/or anomaly detection to determine a positive anomaly in social media. The text of the social media messages corresponding to the positive anomaly may indicate what contributed to the positive anomaly. For example, one or more messages may indicate that the user interface for a new website is very easy to use and/or runs faster than before. As an additional example, an anomaly detection system may be able to determine the effect a change in a computing system is having on users. For example, the anomaly detection system may use social media to determine that a user interface change makes it easier for users to perform tasks using the organization's software. Methods and systems described herein may enable a computing system to work more efficiently because when problems arise the computing system may be able to determine what the problem is and/or how to fix it more quickly. The computing system may also be able to better prioritize what should be fixed (e.g., a problem that affects many users should be fixed before a problem that does not affect as many users, or a problem that is so frustrating that users post to social media may be an indication that an alert associated with the problem should have its priority raised, etc.).
An anomaly detection system may receive social media messages that include a timestamp indicating when each message was published. The system may generate, using a sentiment detection model, sentiment identifiers for the social media messages. For example, the sentiment identifiers may include a negative sentiment identifier, a positive sentiment identifier, and/or a neutral sentiment identifier. The system may use the sentiment identifiers, timestamps, and/or social media messages to generate a timeseries dataset for each type of sentiment identifier (e.g., a timeseries dataset for the positive sentiment identifier, a timeseries dataset for the negative sentiment identifier, etc.). The timeseries dataset may be input into an anomaly detection model to determine whether an anomaly has occurred in the social media messages (e.g., the anomaly may indicate that there is an issue with a computing system). The system may retrieve textual data from the social media messages associated with the detected anomaly. For example, if many users begin publishing messages on social media stating that a feature of a website is not working, the anomaly detection system may be able to use the text to determine a computing system to which an alert should be sent, so that the issue may be resolved.
Various other aspects, features, and advantages of the disclosure will be apparent through the detailed description of the disclosure and the drawings attached hereto. It is also to be understood that both the foregoing general description and the following detailed description are examples and not restrictive of the scope of the disclosure. As used in the specification and in the claims, the singular forms of “a,” “an,” and “the” include plural referents unless the context clearly dictates otherwise. In addition, as used in the specification and the claims, the term “or” means “and/or” unless the context clearly dictates otherwise. Additionally, as used in the specification “a portion,” refers to a part of, or the entirety of (i.e., the entire portion), a given item (e.g., data) unless the context clearly dictates otherwise.
In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the disclosure. It will be appreciated, however, by those having skill in the art, that the disclosure may be practiced without these specific details or with an equivalent arrangement. In other cases, well-known structures and devices are shown in block diagram form to avoid unnecessarily obscuring the disclosure.
The client device 104 may be any computing device, including, but not limited to, a laptop computer, a tablet computer, a hand-held computer, smartphone, other computer equipment (e.g., a server or virtual server), including “smart,” wireless, wearable, and/or mobile devices. The client device may be used to send a message or post to the social media computing platform 108. Although only one client device 104 is shown, the system 100 may include any number of client devices, which may be configured to communicate with the social media computing platform 108 via the network 150 (e.g., to send social media messages, or other communications). The social media computing platform 108 may receive social media messages from the client device 104 and may publish them (e.g., on a website or other application accessible via the Internet). Additionally or alternatively, the social media computing platform 108 may send social media posts to the anomaly detection system 102 (e.g., in response to a query received from the anomaly detection system 102). The social media computing platform and/or the monitoring platform may include one or more servers or other computing devices. A social media message may include any portion of text that is shared with people via the Internet or other computer network. For example, a social media message may include a blog post, a comment (e.g., on a website, social media post, or other application, etc.), a discussion board or discussion forum accessible via the Internet, a message on a shopping network, a message on an anonymous social network, etc. A social media message may include a message or post that is shared, posted, or otherwise published, for example, on Facebook®, Twitter®, LinkedIn®, Instagram®, Snapchat®, YouTube®, Reddit®, Quora®, Digg®, Pinterest®, Flipboard®, Yelp®, Tumblr®, Etsy®, etc.
A social media message may include internal communication channels used by businesses or enterprises (e.g., Hangouts®, Slack®, Microsoft Teams®, etc.). For example, employees of a company may communicate about positive or negative issues regarding one or more computing systems. A social media message may include call audio recordings from a call center (e.g., an audio recording of a user that has called a customer service line of a company). The audio recordings may be converted to text for use by the computing system 100.
The monitoring platform 106 may include one or more computing devices configured to monitor other computing systems or computing devices. The monitoring platform may determine a priority level (e.g., low, medium, high) to assign to an alert, and may send the alert to an appropriate computing system associated with the alert. The alert may indicate that a computing system is experiencing an error. For example, the alert may indicate that a particular application is not working as expected, a computing system has not generated a log file as expected, a computing system is unable to be detected, or any other issue. The monitoring platform 106 may receive alerts from any application, system, component, etc. that is used in an organization (e.g., enterprise company, business, government, etc.). The alerts may be overwhelming to an operations management team and it may be difficult for the team to understand the importance or impact of a condition underlying an alert. Using messages to determine the priority level of an alert may allow the monitoring system and/or team to address more important issues in a more efficient manner.
The anomaly detection system 102 may be configured to use anomaly detection in social media messages or other communication channels both internal or external to detect issues or malfunctions in one or more computing systems (e.g., computing systems that are monitored by the monitoring platform 106). The anomaly detection system 102 may include one or more computing devices described above and/or may include any type of mobile terminal, fixed terminal, or other device. For example, the anomaly detection system 102 may be implemented as a cloud computing system and may feature one or more component devices. A person skilled in the art would understand that system 100 is not limited to the devices shown. Users may, for example, utilize one or more other devices to interact with devices, one or more servers, or other components of system 100. A person skilled in the art would also understand that, while one or more operations are described herein as being performed by particular components of the system 100, those operations may, in some embodiments, be performed by other components of the system 100. As an example, while one or more operations are described herein as being performed by components of the anomaly detection system 102, those operations may be performed by components of the client device 104, monitoring platform 106, and/or social media computing platform 108. In some embodiments, the various computers and systems described herein may include one or more computing devices that are programmed to perform the described functions. Additionally or alternatively, multiple users may interact with system 100 and/or one or more components of system 100. For example, a first user and a second user may interact with the anomaly detection system 102 using two different client devices.
One or more components of the anomaly detection system 102, client device 104, the monitoring platform 106, and/or the social media computing platform 108, may receive content and/or data via input/output (hereinafter “I/O”) paths. The one or more components of the anomaly detection system 102, the client device 104, the monitoring platform 106, and/or the social media computing platform 108 may include processors and/or control circuitry to send and receive commands, requests, and other suitable data using the I/O paths. The control circuitry may include any suitable processing, storage, and/or input/output circuitry. Each of these devices may include a user input interface and/or user output interface (e.g., a display) for use in receiving and displaying data. It should be noted that in some embodiments, the anomaly detection system 102, the client device 104, the monitoring platform 106, and/or the social media computing platform 108 may have neither user input interface nor displays and may instead receive and display content using another device (e.g., a dedicated display device such as a computer screen and/or a dedicated input device such as a remote control, mouse, voice input, etc.). Additionally, the devices in system 100 may run an application (or another suitable program). The application may cause the processors and/or control circuitry to perform operations related to using machine learning and social media data to detect anomalies associated with one or more computing systems.
One or more components and/or devices in the system 100 may include electronic storages. The electronic storages may include non-transitory storage media that electronically stores information. The electronic storage media of the electronic storages may include one or both of (a) system storage that is provided integrally (e.g., substantially non-removable) with servers or client devices or (ii) removable storage that is removably connectable to the servers or client devices via, for example, a port (e.g., a USB port, a firewire port, etc.) or a drive (e.g., a disk drive, etc.). The electronic storages may include one or more of optically readable storage media (e.g., optical disks, etc.), magnetically readable storage media (e.g., magnetic tape, magnetic hard drive, floppy drive, etc.), electrical charge-based storage media (e.g., EEPROM, RAM, etc.), solid-state storage media (e.g., flash drive, etc.), and/or other electronically readable storage media. The electronic storages may include one or more virtual storage resources (e.g., cloud storage, a virtual private network, and/or other virtual storage resources). The electronic storages may store software algorithms, information determined by the processors, information obtained from servers, information obtained from client devices, or other information that enables the functionality as described herein.
The anomaly detection system 102 may include a communication subsystem 112. The communication subsystem 112 may allow the anomaly detection system 102 to communicate with the monitoring platform 106, the social media computing platform 108, and/or the client device 104 via the network 150. The communication subsystem 112 may be configured to send requests for social media data to the social media computing platform 108 and receive data in response to the requests. The data may include one or more social media messages. The social media messages may have been published within a particular time period or time window (e.g., within the last 10 minutes, within the last 5 minutes, 1 month ago, or any other time period). Each social media message may include a timestamp indicating a date and/or time when the message was published. The data may include one or more messages internal to an organization (e.g., one or more messages that is published within a company, one or more direct messages that are sent between two users, etc.) Each of the one or more messages internal to an organization may include a timestamp indicating when the message was sent and/or received.
Referring to
The communication subsystem 112 may request particular types of social media messages from the social media platform. For example, the communication subsystem 112 may request social media messages that mention or otherwise indicate a particular entity (e.g., the organization, user, company, group, etc. that is associated with the anomaly detection system 102). Social media messages that mention or otherwise indicate the entity associated with the anomaly detection system 102 may be useful in determining whether an anomaly has occurred (e.g., whether an application of the entity is not working correctly, something the entity did recently was helpful for one or more users, etc.). For example, as shown in the textual data 206 of
As explained in more detail below, the anomaly detection system 102 may be able to send an alert to a monitoring system (e.g., the monitoring platform 106), associated with the application, indicating that a problem has occurred with the application. This may enable the problem to be resolved more quickly and/or efficiently.
The anomaly detection system 102 may include a natural language processing subsystem 114. The natural language processing subsystem 114 may be configured to generate, via a sentiment detection model, a sentiment identifier for each social media message. The sentiment identifiers may include a negative sentiment identifier, a positive sentiment identifier, and/or a neutral sentiment identifier. The negative identifier may indicate that there is an error with a computing system (e.g., the computing system associated with the social media message to which the negative identifier corresponds). The positive identifier may indicate that an entity associated with the message has done something that a user approves of. For example, a positive identifier may indicate that a user interface is easy to use, a new functionality on a website is helpful to the user, a new product is helpful to the user, and/or any other positive event. The sentiment identifiers may include an indication of emotion. For example, the sentiment identifiers may include happy, sad, angry, frustrated, nervous, or any other emotional identifier. A message may be assigned more than one identifier. For example, a message may be assigned the angry identifier, the frustrated identifier, and the negative identifier.
The social media data may include a message identifier (ID) 303, text 306 (e.g., the textual data 206 of
The anomaly detection system 102 may include an anomaly detection subsystem 116. The anomaly detection subsystem 116 may be configured to determine, using the social media data (e.g., the textual data, the timestamp, and/or other social media data) and the sentiment identifiers, whether there is an anomaly in the social media data. For example, the anomaly detection subsystem 116 may use an anomaly detection model to determine that an unusually large (e.g., larger than a threshold) number of social media messages have been created within a time period.
The anomaly detection subsystem 116 may use social media data and sentiment identifiers (e.g., generated by the natural language processing subsystem 114) to generate data for input into the anomaly detection model. The anomaly detection subsystem 116 may receive a set of social media messages that were published within a particular time window (e.g., 10 minutes, 3 minutes, etc.) as discussed above in connection with the communication subsystem 112. In some embodiments, the social media data may be aggregated with internal communications (e.g., chat messages, direct messages, other messages that may be internal to an organization) and corresponding sentiment identifiers, and may be input into the anomaly detection model. The anomaly detection subsystem 116 may aggregate or group the received social media messages according to the sentiment identifier generated for each message. For example, there may be a group of social media messages with the negative sentiment identifier, a group of social media messages with the positive sentiment identifier, and/or a group of social media messages with the neutral identifier. Referring to
The anomaly detection subsystem 116 may input the timeseries dataset (e.g., the dataset 400) into an anomaly detection model to determine whether one or more anomalies occurred during the time window corresponding to the social media messages (e.g., the time window in which the social media messages were received). The anomaly detection model may be a machine learning model that is generated, trained, and/or used by the anomaly detection subsystem 116.
One or more machine learning models (e.g., the anomaly detection model used by the anomaly detection subsystem 116 and/or the sentiment detection model used by the natural language processing subsystem 114) may take as input a dataset (e.g., one or more social media messages as described in connection with
In some embodiments, the machine learning model may include an artificial neural network. In such embodiments, machine learning model may include an input layer and one or more hidden layers. Each neural unit of the machine learning model may be connected with one or more other neural units of the machine learning model. Such connections can be enforcing or inhibitory in their effect on the activation state of connected neural units. Each individual neural unit may have a summation function which combines the values of all of its inputs together. Each connection (or the neural unit itself) may have a threshold function that a signal must surpass before it propagates to other neural units. The machine learning model may be self-learning and/or trained, rather than explicitly programmed, and may perform significantly better in certain areas of problem solving, as compared to computer programs that do not use machine learning. During training, an output layer of the machine learning model may correspond to a classification of machine learning model and an input known to correspond to that classification may be input into an input layer of machine learning model during training. During testing, an input without a known classification may be input into the input layer, and a determined classification may be output. For example, a social media message may be input and a sentiment identifier may be output. As an additional example, a time series dataset may be entered and one or more indications of whether an anomaly exists in the dataset may be output.
A machine learning model trained by the natural language processing subsystem 114 and/or the anomaly detection subsystem 116 may include embedding layers at which each feature of a vector (e.g., a vector representing a social media message, a vector representing a timeseries data entry, etc.) may be converted into a dense vector representation. These dense vector representations for each feature may be pooled at one or more subsequent layers to convert the set of embedding vectors into a single vector.
The machine learning model may be structured as a factorization machine model. The machine learning model may be a non-linear model and/or supervised learning model that can perform classification and/or regression. For example, the machine learning model may be a general-purpose supervised learning algorithm that the system uses for both classification and regression tasks. The machine learning model may include a Bayesian model configured to perform variational inference on one or more datasets (e.g., a dataset including social media messages, a dataset including timeseries data, etc.). The machine learning model may include a bidirectional encoder representations from transformers (BERT) model. The BERT model may be trained (e.g., via supervised learning) on social media message data to determine sentiment identifiers for subsequent social media messages that are input into the BERT model. As an example, the machine learning model may output a value indicating a sentiment identifier. A first sentiment identifier may be determined, for example, if the value is above a first threshold. A second sentiment identifier may be determined, for example, if the value is below a second threshold. A third sentiment identifier may be determined, for example, if the value is below the first threshold and above the second threshold (e.g., the value is between the two threshold values).
The anomaly detection model and the sentiment detection model may be the same machine learning model or separate machine learning models. For example, each model may be trained separately to perform their respective tasks (e.g., sentiment detection and anomaly detection).
The anomaly detection subsystem 116 may use the parameters output by the anomaly detection model to determine whether an anomaly has occurred for each type of sentiment identifier. For example, if a time series dataset includes a data entry corresponding to the positive sentiment identifier and a data entry corresponding to the negative identifier, the anomaly detection subsystem 116 may determine whether there is an anomaly in social media messages associated with the positive sentiment identifier and whether there is an anomaly in social media messages associated with the negative sentiment identifier. Anomaly detection as well as other techniques are described in U.S. patent application Ser. No. 17/239,261, filed on Apr. 23, 2021, and entitled “Automatic Model Selection for a Time Series,” which is hereby incorporated herein by reference in its entirety. Other anomaly detection and processing techniques are described in U.S. patent application Ser. No. 17/238,536, filed on Apr. 23, 2021, and entitled “Anomaly Detection Data Workflow for Time Series Data,” U.S. patent application Ser. No. 17/238,486, filed on Apr. 23, 2021, and entitled “Anomaly Detection in a Split Timeseries Dataset,” and U.S. patent application Ser. No. 17/239,143, filed on Apr. 23, 2021, and entitled “Anomaly detection in Computing System Events,” which are hereby incorporated herein by reference in their entireties.
The anomaly detection subsystem 116 may use the detected anomalies to determine whether information (e.g., alerts, notifications, etc.) should be sent to the monitoring platform 106. The anomaly detection subsystem 116 may send an alert to the monitoring platform 106, for example, if there is an anomaly detected in time series data associated with the negative sentiment identifier. The anomaly detection subsystem 116 may determine an event associated with the anomaly and determine a computing system that should be notified. To determine the event, the anomaly detection subsystem 116 may retrieve the social media messages associated with an anomaly. The anomaly detection subsystem 116 may determine, based on the textual data, whether an anomaly is associated with one or more computing systems or software applications. For example, the anomaly detection subsystem 116 may use keywords that are associated with a computing system to determine whether the anomaly is associated with the computing system. The anomaly detection subsystem 116 may compare the keywords with words in the social media messages to determine whether the anomaly is associated with the computing system (or application). For example, if one or more social media messages indicate that there is a problem with logging in to a mobile device application, and the keywords contain one or more matching words (e.g., “login”, “mobile device”, and/or “application,”) the anomaly detection subsystem 116 may determine that the anomaly is associated with a computing system responsible for login and/or a computing system associated with mobile device applications. By identifying the computing system and/or software application associated with the anomaly, the anomaly detection system 102 may be able help software/system issues be resolved more quickly and thus increase the efficiency of one or more computing systems.
Additionally or alternatively, the keywords may correspond to one or more events or actions, or system events. An event may be associated with a positive sentiment identifier. For example, an event may include an update to an application (e.g., a website, mobile application, or other software). An event may include the release of a new logo, an action by a company, press release, or any other type of event. The anomaly detection subsystem 116 may compare keywords associated with an event with words in the social media messages and may determine a computing system (e.g., a communication system) associated with the event. The communication subsystem 112 may send a notification to the determined computing system indicating the anomaly and/or the social media messages.
Additionally or alternatively, the anomaly detection subsystem 116 may train a machine learning model (e.g., a machine learning model as discussed above, a system detection model, etc.) to identify one or more computing systems based on the social media messages associated with an anomaly. For example, the machine learning model may be a supervised model that uses a dataset to train to identify computing systems. Referring to
The communication subsystem 112 may generate a message (e.g., an alert, a notification, etc.) and send the message to the computing system determined by the anomaly detection subsystem 116. The message may include a command and/or data (e.g., textual data) from one or more social media messages associated with the anomaly detected by the anomaly detection subsystem 116. The communication subsystem 112 may send the message to the computing system indicated by the output of the anomaly detection subsystem 116. Additionally or alternatively, the communication subsystem 112 may send the message to a central systems monitoring team that may prioritize the alert, identify the cause of the alert, and/or notify a team associated with the alert (e.g., a team associated with a component that is not working as intended).
The computing system may be a monitoring system (e.g., the monitoring platform 106). The command may cause the monitoring system to correlate the textual data with an alert generated by the monitoring system and modify the alert to raise a priority level of the alert. For example, the monitoring system may perform keyword matching between the text of the social media messages and one or more alerts generated by the monitoring system. Additionally or alternatively, the monitoring system may correlate one or more timestamps and/or metadata associated with the textual data with a timestamp of an alert. For example, if a keyword is “mobile app”, the monitoring system may correlate textual data that includes “mobile app” with system events (e.g., alerts) that may be relevant to mobile applications. The message may help the computing system to determine which alerts should have highest priority. For example, if users are complaining about an issue on social media, it may be helpful to raise the priority of the associated alert over other alerts because it may enable the issue to be resolved more quickly. Modifying the priority level of an alert via a message may be used to train a machine learning model (e.g., via reinforcement learning, or supervised learning) to learn to raise priority levels for similar alerts/events.
In some embodiments, the communication subsystem 112 may only send alerts to computing systems and/or services that have subscribed to receive them. The communication subsystem 112 may receive a first alert subscription request from a first software service. The first alert subscription request may indicate a first monitoring system for sending alerts. The anomaly detection system 102 may store the first alert subscription request and a first set of keywords corresponding to the first software service. The communication subsystem 112 may use the keywords to determine (by comparing textual data of the social media messages with the first set of keywords), an anomaly corresponds to the software service. The communication subsystem 112 may generate an alert and send it to the first monitoring system, for example if a match is found between the first set of keywords and the textual data.
Computing system 600 may include one or more processors (e.g., processors 610a-610n) coupled to system memory 620, an input/output I/O device interface 630, and a network interface 640 via an input/output (I/O) interface 650. A processor may include a single processor or a plurality of processors (e.g., distributed processors). A processor may be any suitable processor capable of executing or otherwise performing instructions. A processor may include a central processing unit (CPU) that carries out program instructions to perform the arithmetical, logical, and input/output operations of computing system 600. A processor may execute code (e.g., processor firmware, a protocol stack, a database management system, an operating system, or a combination thereof) that creates an execution environment for program instructions. A processor may include a programmable processor. A processor may include general or special purpose microprocessors. A processor may receive instructions and data from a memory (e.g., system memory 620). Computing system 600 may be a units-processor system including one processor (e.g., processor 610a), or a multi-processor system including any number of suitable processors (e.g., 610a-610n). Multiple processors may be employed to provide for parallel or sequential execution of one or more portions of the techniques described herein. Processes, such as logic flows, described herein may be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating corresponding output. Processes described herein may be performed by, and apparatus can also be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit). Computing system 600 may include a plurality of computing devices (e.g., distributed computer systems) to implement various processing functions.
I/O device interface 630 may provide an interface for connection of one or more I/O devices 660 to computer system 600. I/O devices may include devices that receive input (e.g., from a user) or output information (e.g., to a user). I/O devices 660 may include, for example, graphical user interface presented on displays (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD) monitor), pointing devices (e.g., a computer mouse or trackball), keyboards, keypads, touchpads, scanning devices, voice recognition devices, gesture recognition devices, printers, audio speakers, microphones, cameras, or the like. I/O devices 660 may be connected to computer system 600 through a wired or wireless connection. I/O devices 660 may be connected to computer system 600 from a remote location. I/O devices 660 located on remote computer system, for example, may be connected to computer system 600 via a network and network interface 640.
Network interface 640 may include a network adapter that provides for connection of computer system 600 to a network. Network interface 640 may facilitate data exchange between computer system 600 and other devices connected to the network. Network interface 640 may support wired or wireless communication. The network may include an electronic communication network, such as the Internet, a local area network (LAN), a wide area network (WAN), a cellular communications network, or the like.
System memory 620 may be configured to store program instructions 670 or data 680. Program instructions 670 may be executable by a processor (e.g., one or more of processors 610a-610n) to implement one or more embodiments of the present techniques. Instructions 670 may include modules of computer program instructions for implementing one or more techniques described herein with regard to various processing modules. Program instructions may include a computer program (which in certain forms is known as a program, software, software application, script, or code). A computer program may be written in a programming language, including compiled or interpreted languages, or declarative or procedural languages. A computer program may include a unit suitable for use in a computing environment, including as a stand-alone program, a module, a component, or a subroutine. A computer program may or may not correspond to a file in a file system. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, sub programs, or portions of code). A computer program may be deployed to be executed on one or more computer processors located locally at one site or distributed across multiple remote sites and interconnected by a communication network.
System memory 620 may include a tangible program carrier having program instructions stored thereon. A tangible program carrier may include a non-transitory computer readable storage medium. A non-transitory computer readable storage medium may include a machine readable storage device, a machine readable storage substrate, a memory device, or any combination thereof. Non-transitory computer readable storage medium may include non-volatile memory (e.g., flash memory, ROM, PROM, EPROM, EEPROM memory), volatile memory (e.g., random access memory (RAM), static random access memory (SRAM), synchronous dynamic RAM (SDRAM)), bulk storage memory (e.g., CD-ROM and/or DVD-ROM, hard-drives), or the like. System memory 620 may include a non-transitory computer readable storage medium that may have program instructions stored thereon that are executable by a computer processor (e.g., one or more of processors 610a-610n) to cause the subject matter and the functional operations described herein. A memory (e.g., system memory 620) may include a single memory device and/or a plurality of memory devices (e.g., distributed memory devices).
I/O interface 650 may be configured to coordinate I/O traffic between processors 610a-610n, system memory 620, network interface 640, I/O devices 660, and/or other peripheral devices. I/O interface 650 may perform protocol, timing, or other data transformations to convert data signals from one component (e.g., system memory 620) into a format suitable for use by another component (e.g., processors 610a-610n). I/O interface 650 may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard.
Embodiments of the techniques described herein may be implemented using a single instance of computer system 600 or multiple computer systems 600 configured to host different portions or instances of embodiments. Multiple computer systems 600 may provide for parallel or sequential processing/execution of one or more portions of the techniques described herein.
Those skilled in the art will appreciate that computer system 600 is merely illustrative and is not intended to limit the scope of the techniques described herein. Computer system 600 may include any combination of devices or software that may perform or otherwise provide for the performance of the techniques described herein. For example, computer system 600 may include or be a combination of a cloud-computing system, a data center, a server rack, a server, a virtual server, a desktop computer, a laptop computer, a tablet computer, a server device, a client device, a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a vehicle-mounted computer, or a Global Positioning System (GPS), or the like. Computer system 600 may also be connected to other devices that are not illustrated, or may operate as a stand-alone system. In addition, the functionality provided by the illustrated components may in some embodiments be combined in fewer components or distributed in additional components. Similarly, in some embodiments, the functionality of some of the illustrated components may not be provided or other additional functionality may be available.
Those skilled in the art will also appreciate that while various items are illustrated as being stored in memory or on storage while being used, these items or portions of them may be transferred between memory and other storage devices for purposes of memory management and data integrity. Alternatively, in other embodiments some or all of the software components may execute in memory on another device and communicate with the illustrated computer system via inter-computer communication. Some or all of the system components or data structures may also be stored (e.g., as instructions or structured data) on a computer-accessible medium or a portable article to be read by an appropriate drive, various examples of which are described above. In some embodiments, instructions stored on a computer-accessible medium separate from computer system 600 may be transmitted to computer system 600 via transmission media or signals such as electrical, electromagnetic, or digital signals, conveyed via a communication medium such as a network or a wireless link. Various embodiments may further include receiving, sending, or storing instructions or data implemented in accordance with the foregoing description upon a computer-accessible medium. Accordingly, the present disclosure may be practiced with other computer system configurations.
At 710, anomaly detection system 102 (e.g., using one or more components in system 100 (
At 715, anomaly detection system 102 (e.g., using one or more components in system 100 (
At 720, anomaly detection system 102 (e.g., using one or more components in system 100 (
At 725, anomaly detection system 102 (e.g., using one or more components in system 100 (
At 735, anomaly detection system 102 (e.g., using one or more components in system 100 (
It is contemplated that the actions or descriptions of
At 810, anomaly detection system 102 (e.g., using one or more components in system 100 (
At 815, anomaly detection system 102 (e.g., using one or more components in system 100 (
At 820, anomaly detection system 102 (e.g., using one or more components in system 100 (
At 825, anomaly detection system 102 (e.g., using one or more components in system 100 (
At 830, anomaly detection system 102 (e.g., using one or more components in system 100 (
It is contemplated that the actions or descriptions of
In block diagrams, illustrated components are depicted as discrete functional blocks, but embodiments are not limited to systems in which the functionality described herein is organized as illustrated. The functionality provided by each of the components may be provided by software or hardware modules that are differently organized than is presently depicted, for example such software or hardware may be intermingled, conjoined, replicated, broken up, distributed (e.g., within a data center or geographically), or otherwise differently organized. The functionality described herein may be provided by one or more processors of one or more computers executing code stored on a tangible, non-transitory, machine readable medium. In some cases, third party content delivery networks may host some or all of the information conveyed over networks, in which case, to the extent information (e.g., content) is said to be supplied or otherwise provided, the information may be provided by sending instructions to retrieve that information from a content delivery network.
The reader should appreciate that the present application describes several disclosures. Rather than separating those disclosures into multiple isolated patent applications, applicants have grouped these disclosures into a single document because their related subject matter lends itself to economies in the application process. But the distinct advantages and aspects of such disclosures should not be conflated. In some cases, embodiments address all of the deficiencies noted herein, but it should be understood that the disclosures are independently useful, and some embodiments address only a subset of such problems or offer other, unmentioned benefits that will be apparent to those of skill in the art reviewing the present disclosure. Due to costs constraints, some features disclosed herein may not be presently claimed and may be claimed in later filings, such as continuation applications or by amending the present claims. Similarly, due to space constraints, neither the Abstract nor the Summary sections of the present document should be taken as containing a comprehensive listing of all such disclosures or all aspects of such disclosures.
It should be understood that the description and the drawings are not intended to limit the disclosure to the particular form disclosed, but to the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present disclosure as defined by the appended claims. Further modifications and alternative embodiments of various aspects of the disclosure will be apparent to those skilled in the art in view of this description. Accordingly, this description and the drawings are to be construed as illustrative only and are for the purpose of teaching those skilled in the art the general manner of carrying out the disclosure. It is to be understood that the forms of the disclosure shown and described herein are to be taken as examples of embodiments. Elements and materials may be substituted for those illustrated and described herein, parts and processes may be reversed or omitted, and certain features of the disclosure may be utilized independently, all as would be apparent to one skilled in the art after having the benefit of this description of the disclosure. Changes may be made in the elements described herein without departing from the spirit and scope of the disclosure as described in the following claims. Headings used herein are for organizational purposes only and are not meant to be used to limit the scope of the description.
As used throughout this application, the word “may” is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must). The words “include”, “including”, and “includes” and the like mean including, but not limited to. As used throughout this application, the singular forms “a,” “an,” and “the” include plural referents unless the content explicitly indicates otherwise. Thus, for example, reference to “an element” or “a element” includes a combination of two or more elements, notwithstanding use of other terms and phrases for one or more elements, such as “one or more.” The term “or” is, unless indicated otherwise, non-exclusive, i.e., encompassing both “and” and “or.” Terms describing conditional relationships, e.g., “in response to X, Y,” “upon X, Y,”, “if X, Y,” “when X, Y,” and the like, encompass causal relationships in which the antecedent is a necessary causal condition, the antecedent is a sufficient causal condition, or the antecedent is a contributory causal condition of the consequent, e.g., “state X occurs upon condition Y obtaining” is generic to “X occurs solely upon Y” and “X occurs upon Y and Z.” Such conditional relationships are not limited to consequences that instantly follow the antecedent obtaining, as some consequences may be delayed, and in conditional statements, antecedents are connected to their consequents, e.g., the antecedent is relevant to the likelihood of the consequent occurring. Statements in which a plurality of attributes or functions are mapped to a plurality of objects (e.g., one or more processors performing actions A, B, C, and D) encompasses both all such attributes or functions being mapped to all such objects and subsets of the attributes or functions being mapped to subsets of the attributes or functions (e.g., both all processors each performing actions A-D, and a case in which processor 1 performs action A, processor 2 performs action B and part of action C, and processor 3 performs part of action C and action D), unless otherwise indicated. Further, unless otherwise indicated, statements that one value or action is “based on” another condition or value encompass both instances in which the condition or value is the sole factor and instances in which the condition or value is one factor among a plurality of factors. The term “each” is not limited to “each and every” unless indicated otherwise. Unless specifically stated otherwise, as apparent from the discussion, it is appreciated that throughout this specification discussions utilizing terms such as “processing,” “computing,” “calculating,” “determining” or the like refer to actions or processes of a specific apparatus, such as a special purpose computer or a similar special purpose electronic processing/computing device.
The above-described embodiments of the present disclosure are presented for purposes of illustration and not of limitation, and the present disclosure is limited only by the claims which follow. Furthermore, it should be noted that the features and limitations described in any one embodiment may be applied to any other embodiment herein, and flowcharts or examples relating to one embodiment may be combined with any other embodiment in a suitable manner, done in different orders, or done in parallel. In addition, the systems and methods described herein may be performed in real time. It should also be noted that the systems and/or methods described above may be applied to, or used in accordance with, other systems and/or methods.
The present techniques will be better understood with reference to the following enumerated embodiments:
1. A method, the method comprising: receiving a plurality of social media messages; generating a plurality of sentiment identifiers corresponding to the plurality of social media messages; generating a timeseries dataset; inputting the timeseries dataset into an anomaly detection model to determine one or more anomalies associated with the timeseries dataset; retrieving textual data; determining, based on the textual data, whether each anomaly of the one or more anomalies is associated with one or more computing systems; and sending one or more alerts to one or more monitoring systems associated with the one or more computing systems.
2. A method, the method comprising: receiving a plurality of social media messages, wherein each message of the plurality of social media messages comprises a timestamp indicating when each message was published; generating, via a sentiment detection model, a plurality of sentiment identifiers corresponding to the plurality of social media messages; generating, for each sentiment identifier of the plurality of sentiment identifiers, a corresponding timeseries dataset, each timeseries dataset comprising a plurality of entries each comprising a corresponding timestamp and a corresponding degree of sentiment; inputting each timeseries dataset into an anomaly detection model to determine one or more anomalies associated with each timeseries dataset; determining, based on the one or more anomalies, whether each anomaly of the one or more anomalies is associated with an event; and sending a notification indicating the one or more anomalies and a corresponding event.
3. The method of any of the preceding embodiments, further comprising: inputting, into a system detection model, message data extracted from a first message of the plurality of social media messages, wherein the first message is associated with a first timestamp of a first anomaly of the one or more anomalies; and determining, based on output of the system detection model, a corresponding computing system associated with the first anomaly.
4. The method of any of the preceding embodiments, further comprising: generating a list of keywords from a first set of messages of the plurality of social media messages, wherein the first set of messages corresponds to a first anomaly of the one or more anomalies; identifying, based on a comparison of the list of keywords with a list of application names, a first monitoring system of the plurality of monitoring systems; and based on the identifying, sending a first alert of the one or more alerts to the first monitoring system.
5. The method of any of the preceding embodiments, further comprising: sending, based on a first anomaly of the one or more anomalies, a command and the textual data to a first monitoring system, wherein the command causes the first monitoring system to perform operations comprising: correlating the textual data with an alert generated by the monitoring system; and in response to the correlating, modifying the alert to raise a priority level of the alert.
6. The method of any of the preceding embodiments, further comprising: receiving a first alert subscription request from a first software service, wherein the first alert subscription request indicates a first monitoring system for sending alerts; receiving a second alert subscription request from a second software service, wherein the second alert subscription request indicates a second monitoring for sending alerts; storing the first alert subscription request and a first set of keywords corresponding to the first software service; and storing the second alert subscription request and a second set of keywords corresponding to the second software service.
7. The method of any of the preceding embodiments, further comprising: determining, based on a comparison of the textual data and the first set of keywords, that a first anomaly of the one or more anomalies corresponds to the first software service; determining, based on a comparison of the textual data and the second set of keywords, that a second anomaly of the one or more anomalies corresponds to the second software service; in response to the determining that the first anomaly corresponds to the first software service, generating a first alert for the first monitoring system; in response to the determining that the second anomaly corresponds to the second software service, generating a second alert for the second monitoring system; and adding the first alert and the second alert to the one or more alerts.
8. A tangible, non-transitory, machine-readable medium storing instructions that, when executed by a data processing apparatus, cause the data processing apparatus to perform operations comprising those of any of embodiments 1-7.
9. A system comprising: one or more processors; and memory storing instructions that, when executed by the processors, cause the processors to effectuate operations comprising those of any of embodiments 1-7.
10. A system comprising means for performing any of embodiments 1-7.
This application is a continuation of U.S. patent application Ser. No. 17/239,342, filed Apr. 23, 2021. The content of the foregoing application is incorporated herein in its entirety by reference.
| Number | Name | Date | Kind |
|---|---|---|---|
| 11166075 | Decrop | Nov 2021 | B1 |
| 11354684 | Ravichandran | Jun 2022 | B2 |
| 11625602 | Sarferaz | Apr 2023 | B2 |
| 11727286 | Hazard | Aug 2023 | B2 |
| 11748416 | Hicklin | Sep 2023 | B2 |
| 11838309 | Martin | Dec 2023 | B1 |
| 20130262320 | Makanawala | Oct 2013 | A1 |
| 20210117868 | Sriharsha | Apr 2021 | A1 |
| 20210241289 | Roy | Aug 2021 | A1 |
| 20210286705 | Carter | Sep 2021 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20230161660 A1 | May 2023 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17239342 | Apr 2021 | US |
| Child | 18152590 | US |
