Anomaly analysis for software distribution

摘要

A population of devices provides telemetry data and receives software changes or updates. Event buckets for respective events are found. Event buckets have counts of event instances, where each event instance is an occurrence of a corresponding event reported as telemetry by a device. Records of the software changes are provided, each change record representing a software change on a corresponding device. The event buckets are analyzed to identify which indicate an anomaly. Based on the change records and the identified event buckets, correlations between the software changes and the identified event buckets are found.

主权项

1. A method of correlating software updates and indications of anomalies occurring on devices at least some of which have the software updates, the method comprising:
accessing update installation information indicating which of the software updates were applied to which of the device and update times thereof; accessing a telemetry data source, the telemetry data source comprising indications of occurrences of same events on the devices, the indications of occurrences having been received from the devices via a data network, each indication of an occurrence indicating which event occurred and on which corresponding device and a time of occurrence thereof; identifying anomalies in the telemetry data source by computing counts of the events therein based on the times of occurrence of the events; identifying a set of updates by determining which of the anomalies are correlated with which of the updates according to the times of occurrence and according to the update times; accessing source code change data that indicates which source code changes are associated with which of the updates; finding correlations between the source code changes and the anomalies by, based on the identified set of updates and the source code change data, identifying source code changes associated with the identified set of updates, wherein the finding the correlations between the source code changes and the anomalies comprises applying a heuristic that computes correlation scores or probabilities for pairings of updates and anomalies; and for each anomaly, storing indications of any source code changes determined to be correlated with the anomaly.