Heuristic Inference of Topological Representation of Metric Relationships

Abstract

A system includes a windowing module that divides time series data for each metric into portions. Each portion corresponds to a respective window of time. A hash module calculates a hash value for each of the portions for each of the metrics. An identification module compares the hash values for each pair of metrics and, for a selected pair of metrics, counts how many windows of time in which the hash values of the selected pair of metrics are equal. A pair is identified as a candidate pair in response to the count exceeding a threshold. A metric graph module creates a first edge in a graph based on the candidate pair of metrics. Each of the metrics is a node in the graph and direct relationships between each pair of the metrics are edges in the graph. An anomaly combination module analyzes an anomaly condition based on the graph.

What is claimed is: 
     
         1 . A system comprising:
 a windowing circuit configured to divide, for each metric of a plurality of metrics, time series data for values of the metric into a plurality of time series portions, each corresponding to a respective window of time;   a hash circuit configured to calculate a hash value for each of the time series portions for each of the plurality of metrics;   a candidate identification circuit configured to (i) compare the hash values for each pair of metrics from the plurality of metrics, (ii) for a selected pair of metrics, count for how many windows of time the hash values of the selected pair of metrics are equal to each other, and (iii) identify the pair of metrics as a candidate pair in response to the count exceeding a threshold;   a metric relationship graph creation circuit configured to selectively create a first edge in a graph based on the candidate pair of metrics, wherein (i) each metric of the plurality of metrics is a node in the graph and (ii) direct relationships between each pair of the plurality of metrics are edges in the graph;   an anomaly combination circuit configured to detect an anomaly condition based on the graph; and   a conditioning circuit logically positioned prior to the windowing circuit and configured to:
 apply a low-pass filter to the time series data for the metrics, 
 wherein the low-pass-filtered time series data is divided into the plurality of time series portions by the windowing circuit.