US 11,755,955 B2
Anomaly detection and tuning recommendation system
Klaus-Dieter Lange, Houston, TX (US); Mukund Kumar, Karnataka (IN); Prateek Bhatnagar, Karnataka (IN); Nalamati Sai Rajesh, Karnataka (IN); Nishant Rawtani, Karnataka (IN); and Craig Allan Estepp, Houston, TX (US)
Assigned to Hewlett Packard Enterprise Development LP, Spring, TX (US)
Filed by Hewlett Packard Enterprise Development LP, Houston, TX (US)
Filed on Apr. 8, 2021, as Appl. No. 17/225,897.
Claims priority of application No. 202041026767 (IN), filed on Jun. 24, 2020.
Prior Publication US 2021/0406146 A1, Dec. 30, 2021
Int. Cl. G06N 20/00 (2019.01); G06F 11/30 (2006.01); G06F 11/32 (2006.01); G06F 11/34 (2006.01); G06F 18/214 (2023.01)
CPC G06N 20/00 (2019.01) [G06F 11/3006 (2013.01); G06F 11/3075 (2013.01); G06F 11/327 (2013.01); G06F 11/3428 (2013.01); G06F 18/214 (2023.01)] 15 Claims
OG exemplary drawing
 
1. A method to detect anomalies on multiple levels of a computer system, comprising:
automatically obtaining train data from the computer system, wherein the train data comprises features associated with the multiple levels of the computer system that affect performance metrics defined by a selected benchmark;
automatically applying the train data to train a plurality of machine learning (ML) models;
creating a train snapshot corresponding to the selected benchmark based on a selected ML model from the plurality of ML models, wherein the train snapshot is associated with a previous state of the computer system;
creating a test snapshot corresponding to the selected benchmark or workload, wherein the test snapshot is associated with a transition state of the computer system;
detecting whether a change in the features associated with the multiple levels of the computer system occurred between the previous state of the computer system and the transition state of the computer system, wherein the change in the features comprises an addition of a new feature, a removal of a feature, or a modification of a feature that is identified based on the train snapshot associated with a previous state of the computer system and test snapshot associated with a transition state of the computer system; and
detecting whether an anomaly is associated with each of the multiple levels of the computer system based on the train snapshot and the test snapshot.