Confidence intervals for anomalies in computer log data

Abstract

Anomaly scores for respective message types in computer log data and confidence intervals for respective anomaly scores are calculated based on a number of appearances of respective message types in a plurality of models generated from a historical set of computer log data. Respective models of the plurality of models can have at least a portion of the historical set of computer log data excluded from the respective models. Respective anomaly scores and respective confidence intervals can be applied to a new set of log data to identify and troubleshoot unusual log data events.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 receiving a plurality of periods of log data comprising various message types, wherein respective periods of log data comprise a plurality of subsets, wherein respective subsets comprise log data from a respective time interval of a respective period;   generating a plurality of models using the plurality of periods of log data, wherein respective models comprise the plurality of periods of log data having at least one respective period of log data excluded, wherein generating the plurality of models further comprises:
 generating the plurality of models by excluding two or more respective periods of log data in each respective model such that each respective model comprises a number of periods of log data equal to the plurality of periods of log data minus the two or more excluded periods of log data, and further such that the plurality of models is greater than the plurality of periods of log data; 
   for respective models, calculating respective anomaly scores for at least a first message type indicating a rarity of the first message type in the respective models;   determining a first average anomaly score for the first message type by dividing a sum of the respective anomaly scores by the number of models;   calculating a confidence interval for the first average anomaly score of the first message type based on the first average anomaly score, a statistic based on respective anomaly scores of the first message type, the plurality of models, and a first confidence parameter;   storing, for respective various message types, respective average anomaly scores and respective confidence intervals for respective average anomaly scores in a non-transitory computer readable storage medium;   combining, for respective models of the plurality of models, respective anomaly scores of respective messages in a first subset associated with a first time interval to generate a plurality of respective first subset scores;   calculating an average first subset reference score by dividing a sum of respective first subset scores by the number of first subset scores;   calculating a first reference confidence interval for the average first subset reference score based on the average first subset reference score, a statistic based on respective first subset scores, the number of first subset scores, and a second confidence parameter, wherein the second confidence parameter is based on a selected confidence level and a number of degrees of freedom;   storing the average first subset reference score and the first reference confidence interval for the average first subset reference score in the non-transitory computer readable storage medium;   receiving a new subset of log data comprising a plurality of new messages from the first time interval;   matching respective message types of the plurality of new messages to respective message types stored in the non-transitory computer readable storage medium;   applying, for respective matched message types in the plurality of new messages, respective average anomaly scores and respective confidence intervals for the respective average anomaly scores to respective new messages of the new subset of log data;   summing respective average anomaly scores for the respective matched message types of the plurality of new messages to generate a new subset score for the new subset of log data;   presenting, for respective new messages in the new subset of log data, respective average anomaly scores and respective confidence intervals for respective average anomaly scores to a user interface; and   presenting the new subset score, the average first subset reference score for the first time interval, and the first reference confidence interval associated with the average first subset reference score for the first time interval to the user interface.