Predictive Anomaly Detection of Service Level Agreement in Multi-Subscriber IT Infrastructure

摘要

A predictive service level agreement (SLA) anomaly detection mechanism is provided for multi-subscriber IT infrastructure. Also, a method of filtering and prioritizing SLA anomaly alerts is provided. Furthermore, a method of constructing a skeleton network given historical and real-time monitoring data and a method of constructing a shadow baseline for each metric in a skeleton network are provided.

主权项

1. A predictive SLA anomaly detection mechanism for multi-subscriber IT infrastructure; the predictive SLA anomaly detection mechanism comprising:
a Data Fusion module that performs sanitization, extraction and transformation of raw monitoring data such that the resulting data are easier for further analysis, the Data Fusion module having an output; an SLA-aware Skeleton Modeling module having an input that receives the output of the Data Fusion module, wherein the SLA-aware Skeleton Modeling module constructs a set of time-invariant mathematical constraints of a given system while embedding the service level agreement information in the mathematical model, the SLA-aware Skeleton Modeling module having an output; a Shadow Baselining module having an input that receives the output of the SLA-aware Skeleton Modeling module, wherein the Shadow Baselining Module constructs a set of expected baseline functions for each metric according to the mathematical relationships between any pair of metrics modeled by the skeleton modeling, the Shadow Baselining module having an output; a System Analysis and Alerts Generation module having an input that receives the output of the Data Fusion module, SLA-aware Skeleton Modeling module, and the Shadow Baselining module, wherein the System Analysis and Alerts Generation module analyzes the system situation and accordingly generates alerts following predefined fault criteria, the System Analysis and Alerts Generation module having an output; and an SLA-aware Alerts Prioritization module having an input that receives the output of the System Analysis and Alerts Generation module, wherein the SLA-aware Alerts Prioritization module filters and prioritizes SLA alerts based on the significance of the alerts.