ANOMALY DETECTION USING A DATA STREAM PROCESSING LANGUAGE FOR ANALYZING INSTRUMENTED SOFTWARE

摘要

An instrumentation analysis system processes data streams by executing instructions specified using a data stream language program. The data stream language allows users to specify a search condition using a find block for identifying the set of data streams processed by the data stream language program. The set of identified data streams may change dynamically. The data stream language allows users to group data streams into sets of data streams based on distinct values of one or more metadata attributes associated with the input data streams. The data stream language allows users to specify a threshold block for determining whether data values of input data streams are outside boundaries specified using low/high thresholds. The elements of the set of data streams input to the threshold block can dynamically change. The low/high threshold values can be specified as data streams and can dynamically change.

主权项

1. A method for detecting anomalies in data streams, the method comprising:
receiving instructions of a data stream language program, comprising:
a threshold block configured to receive a first input comprising a plurality of data streams comprising data values and a second input comprising a plurality of data streams comprising threshold values;a first set of instructions for generating the first input of the threshold block; anda second set of instructions for generating the second input of the threshold block; receiving an input set of data streams; and executing the first set of instructions to aggregate data of the input set of data streams to generate a first plurality of data streams comprising data values provided as the first input of the threshold block; executing the second set of instructions to aggregate data of the input set of data streams to generate a second plurality of data streams comprising threshold values provided as the second input of the threshold block; matching data streams from the first plurality with data streams from the second plurality to identify corresponding data streams; and for each data stream of the first plurality:
comparing a data value of the data stream against a threshold value from a corresponding data stream from the second plurality; anddetermining whether to generate an event based on the result of comparison of the data value and the threshold value.