WO2003007174A9 - Early warning in e-service management systems - Google Patents
Early warning in e-service management systemsInfo
- Publication number
- WO2003007174A9 WO2003007174A9 PCT/US2002/021023 US0221023W WO03007174A9 WO 2003007174 A9 WO2003007174 A9 WO 2003007174A9 US 0221023 W US0221023 W US 0221023W WO 03007174 A9 WO03007174 A9 WO 03007174A9
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- variable
- behavior
- threshold
- early warning
- model
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
Definitions
- aspects of the present invention relate to the field of e-commerce.
- Other aspects of the present invention relate to a method and system to intelligently manage an infrastructure that supports an e-service business.
- Web-enabled eBusiness processes effectively distill all computing resources down to a single customer-visible service (or eService). For example, a user interacts with a web site to make an online purchase. All of the back-end hardware and software components supporting this service are hidden, so the user's perception of the entire organization is based on this single point of interaction. How can organizations mitigate these risks and gain the benefits of well-managed eServices?
- eService customer-visible service
- ASPs Application Service Providers
- ISPs Internet Service Providers
- MSPs Managed Service Providers
- SLAs Service Level Agreements
- the Internet enables companies to outsource those areas in which the company does not specialize. This collaboration strategy creates a loss of control over infrastructure and business processes between companies comprising the complete value chain. Partners, including suppliers and service providers must work in concert to provide a high quality service. But how does a company control infrastructure which it doesn't own and processes that transcend its' organizational boundaries? Even infrastructure outsourcers don't have mature tools or the capability to manage across organizational boundaries.
- the underlying problem is not lack of resources, but the misguided attempt to apply yesterday's management technology to today's eService problem.
- Forrester Research "Most companies use 'systems' management tools to solve pressing operational problems. None of these tools can directly map a system or service failure to business impact.” To compensate, they rely on slow, manual deployment by expensive and hard-to-find technical personnel to diagnose the impact of infrastructure failures on service delivery (or, conversely, to explain service failures in terms of events in the underlying infrastructure). The result is very long time-to-value and an unresponsive support infrastructure. In an extremely competitive marketplace, the resulting service degradation and excessive costs can be fatal.
- Fig. 1 shows a high-level block diagram of an eService management system
- Fig. 2 shows expanded block diagrams of both local service management systems and the global eService management system and their interactions via a dispatcher;
- Fig. 3 shows the input and output relationship of a Behavior eXpert (BeX);
- Fig. 4 shows different functional modes of a BeX
- Fig. 5 illustrates an exemplary internal structure of a BeX in relation to other parts in a local service management system
- ! Fig. 6 shows a time series variable values with an underlying pattern
- Fig. 7 shows an exemplary variable behavior that can be described by two embedded patterns
- Fig. 8 depicts the internal structure of the statistical learning mechanism of a BeX
- Fig. 9 is an exemplary flowchart of a process, in which statistical models characterizing the normal and dynamic behavior of a variable are established and are applied in generating early warning of threshold violation in eService management;
- Fig. 10 is an exemplary flowchart for online normal behavior modeling
- Fig. 11 illustrates the actual behavior of a time series variable and its violation of a threshold
- Fig. 12 illustrates the predicted behavior of a time series variable
- Fig. 13 is an exemplary flowchart for an early warning mechanism.
- An embodiment of the present invention is illustrated that is related to Behavior eXperts (BeXs) employed in an eService management system.
- the present invention enables intelligent eService management by incorporating statistical behavior modeling and abnormal behavior forecasting (or early warning) capabilities in a BeX.
- a Behavior Expert (BeX) in an eService management system is a distributed, autonomous intelligent agent, designed to detect, analyze, predict, and control certain behavior of the components of a business infrastructure that supports the underlying eService.
- a BeX may be attached to a component (or an application) of an eBusiness infrastructure so that the operational status or the behavior of the component may be dynamically monitored and adaptively adjusted to optimize the eService quality.
- Fig. 1 is a high level diagram of an eService Management System 100.
- An eService 105 is a web-centric service, which allows electronic transactions over the Internet. Such a web-centric service may, for example, sell books, shoes, or flowers. It may also sell stocks or information.
- the eService 105 is supported by an eService infrastructure 115, which may comprise infrastructure components such as web servers, databases, billing systems, or other eServices.
- each component may play a distinct role.
- a database may be part of the infrastructure that supports shoes.com service and the database may store all the transaction information. The performance of each infrastructure component may affect the overall quality of service ofshoes.com eService.
- a cluster, 110 there is a cluster, 110, of local service management systems.
- Each of the local service management systems may be responsible for the management of a local system which is part of the eService infrastructure 115.
- local service management system 110b may be responsible for managing a database for an eService called shoes.com.
- a local system may comprise one or more infrastructure components.
- the performance information about infrastructure components or a local system of the eService infrastructure 115 may be sent, via a dispatcher 130, to a global data repository (not shown), located in a global eService management system 150.
- the information stored in the global data repository may be accessed and integrated by the global eService management system 150 to assess the overall performance of the eService infrastructure 115 and subsequently to estimate the overall service quality of the eService 105.
- the dispatcher 130 may represent a collective comprising one or more distributed dispatchers.
- the quality of an eService depends on various factors. Such factors are related to both the performance of individual infrastructure components and how the business process of the eService takes place within the supporting eService infrastructure. Different components in the eService infrastructure 115 may impact the quality of eService differently, depending on the role of each component with respect to the business process of the eService. Therefore, the strategy to manage the infrastructure that supports an eService may be directly related to or dictated by the business process model of the eService.
- business process model 120 is derived from the eService 105.
- the business process model 120 dictates both how the eService infrastructure 115 should be managed by local service management systems 110 and how the global eService management system 150 integrates the information from systems 110 to evaluate the overall performance of the eService infrastructure 115.
- the knowledge about the business process model 120 may be distributed in local service management systems 110a, 110b, ..., 110c.
- the global eService management system 150 may seem to be a centralized unit in Fig. 1, it may be distributed, similar to local service management systems.
- Fig. 2 presents the exemplary internal structures of both a local service management systems (110b) and the global eService management system 150 and how they interact with each other.
- local service management system 110b comprises a plurality of data providers 210, a service manager 220, one or more Behavior eXperts (BeXs) 215, a local ecology pattern detector 225, an adaptive feedback control mechanism 230, and a communication unit 240.
- BeXs Behavior eXperts
- Data providers 210 supply observation data (observations in terms of, for example, the operational status), acquired from various infrastructure components, to the service manager 220.
- the service manager 220 converts the observation data to Generic Data Objects so that different Behavior eXperts (BeXs) 215 may access the observation data in a uniform way.
- BeXs Behavior eXperts
- Each BeX in a local service management system may be designated to monitor an infrastructure component.
- a BeX at component level may access the observation data acquired (by the data providers) from the underlying infrastructure component and analyze the behavior of the infrastructure component based on the observation data.
- a BeX may post some detected abnormal behavior of individual components, in the form, for example, states or events, on a blackboard server (not shown in Fig. 2) located in the service manager 220. Such posted information may be shared among different BeXs and accessed by the local ecology pattern detector 225.
- the local ecology pattern detector 225 may retrieve information from the blackboard server so that abnormal behavior occurred in different infrastructure components may be reviewed as a whole in order to detect any alarming trend or ecological pattern of the underlying local system. Detected ecological patterns may be reported, in the form of, for example, events together with some of the abnormal events at component level that have high priorities, to the dispatcher 130, via the communication unit 240.
- Each local service management system (110a,..., 110b,...110c) may act asynchronously to monitor the performance of a local infrastructure.
- an adaptive feedback control mechanism 230 may be activated so that the behavior of a local service management system may be adaptively tuned towards some desired behavior.
- the local service management system 110b may trigger the adaptive feedback control mechanism 230 to tune the responsible BeX so that the BeX becomes less sensitive to these events and, consequently, to become more aware of the events that actually do not impact the eService.
- the performance information gathered from different local service management systems may be routed, through the dispatcher 130, to the global eService management system 150.
- the global eService management system 150 comprises a global ecology controller 255, an eService enterprise 250, a design studio 260, a eService manager 270, a notifier 280, and a port 290 for external APIs.
- Data routed from the dispatcher 130 may be stored in the global data repository 245 and accessed by the global ecology controller 255.
- the global ecology controller 255 may then integrate the information from local service management systems 110 to and evaluate the performance of the overall eService infrastructure.
- the global ecology controller 255 may also estimate the service quality of the eService 105 based on the assessment about the overall infrastructure performance. This may be done by measuring the impact of detected abnormal behavior in different parts of the infrastructure on the eService.
- the translation from local infrastructure performance data to overall eService quality may be performed based on the business process model of the underlying eService.
- the global ecology controller 255 may also activate an adaptive feedback control. It may send feedback adjustments to different local service management systems, from where the adjustments may be passed further down to various individual BeXs.
- the purpose of activating an adaptive feedback control may be to tune the behavior of an eService management system so that it converges to an optimal state to ensure the quality of an eService.
- both the local ecology pattern detectors 225 as well as the global ecology controller 255 may be realized using BeXs.
- a BeX is an intelligent reasoning mechanism that takes input data and generates inference output based on its expert knowledge.
- the distinction between a BeX at component level and a BeX for, for example, realizing a local ecology pattern detector, may be merely functional rather than structural and methodological.
- a BeX that is attached to an infrastructure component may perform an individual monitoring task.
- a BeX implemented at an ecological level may perform higher level integration task.
- Fig. 3 depicts the input and output relationship of a BeX.
- a BeX 215 may be associated with one or more infrastructure components 310.
- Data providers 210 acquire performance data from the associated infrastructure components 310 and supply observation data to the BeX 215.
- the BeX may base its analysis on the observation data supplied by the data providers 210.
- the BeX throws one or more events 320 to signal the abnormal behavior of the underlying components 310.
- Events thrown by other BeXs may also be made available by the data providers 210 as the observation data. In this way, different BeXs may interact with each other, sharing what is detected and making further inferences.
- Fig. 4 illustrates that a BeX may function in different modes: learning mode 410 and operational mode 420.
- the observation data is fed to a BeX and may be utilized during both the learning mode 410 and the operational model 420.
- the BeX learns the patterns of variables or ordinary behavior of the variables under normal operation environment of the system. Such learning may be achieved using different methods.
- a statistical learning mechanism 430 is used to accomplish the task.
- the learned behavior may be captured in a behavior model of the variable.
- Such a model may be an linear or non-linear model.
- a BeX monitors its associated component(s) and detects any abnormal behavior.
- Abnormal behavior may be defined a priori or it may be detected by comparing with learned normal behavior.
- Detection of abnormal behavior of an infrastructure component may be achieved by an operational mechanism 450 within a BeX.
- the operational mechanism 450 monitors the operational status of its associated component through the observation data and determines whether the operational status is acceptable according to some criteria. For example, a BeX that monitors a database may detect an abnormal behavior when the database is not responding to queries, given that the acceptable behavior of the database is that its responding time to a query should be less than 20 seconds. In this case, the BeX reports the abnormal behavior after detecting that the normal responding time has elapsed.
- variable behavior learned during the learning mode 410 may be applied during the operational mode to proactively predict any incoming abnormal behavior before it occurs.
- proactive prediction is achieved by an early warning mechanism 440.
- the early warning mechanism 440 estimates, with some certainty (may be expressed in the form of a probability), when, in the future, an abnormal behavior will occur.
- Such early warning may be sent to the operational mechanism 450 which will react accordingly to either report the estimated trend or incorporate the warning into its own inference.
- the learning mode 410 and the operational mode 420 may be running at different times or simultaneously. Particularly, during the learning mode 410, there may be different states of learning. For example, a BeX may learn some variable behavior offline from some historical data in a batch mode or the BeX may learn dynamic variable behavior online during its operation in an incremental fashion. The former may be applied before the BeX is first deployed and the latter may be applied after the BeX is up and running.
- a BeX 215 operates based on variables 510, rules 520, and events 320.
- Rules 520 govern the transitional relationship between the variables 510 and events 320.
- Events 320 may be generated based on updated states which may be set based on the values of the variable 510.
- Rules 520 may be classified into metric rules and behavior rules, where the metric rules govern the transition between variables and states and behavior rules govern the transition between states and events.
- Observation data acquired by the data providers 210 is sent to a general data server 220a where the observation data is converted into Generic Data Objects (GDO) 220b so that heterogeneous kinds of data may be packaged and accessed in a uniformed way.
- GDO Generic Data Objects
- a BeX (e.g., 215) may access the GDOs 220b to instantiate or to populate its internal variables 510.
- the updated variable values may trigger or fire rules 520. Fired rules may then generate certain events 320 (indicating abnormal behavior of the infrastructure components that are monitored by BeX 215), which are formatted in accordance with the UDM 530 before being posted on the blackboard server 540.
- a rule may define some violation of acceptable behavior and may take the form:
- IF premise describes a condition
- then-action describes the action to be taken when the condition satisfies
- else- action describes the action to be taken when the condition does not satisfy.
- the condition described in the "IF premise” may specify violation of acceptable behavior in terms of a variable value exceeds some expected value or threshold. For example, “IF Memory Capacity ⁇ 20%” describes that when the value of variable Memory Capacity is below a threshold of 20%” (a threshold that may define that the acceptable behavior of a memory is that it has more than 20% of its memory available), a violation of a threshold occurs.
- the rules may be designed to enforce some performance requirements, imposed on the running components of an eService infrastructure to support an underlying eService.
- Detecting abnormal behavior usually involve comparing variable values to some thresholds. Since the underlying infrastructure component that is monitored may operate continuously, the variable values may need to be sampled regularly according to some internal clock (which also regulates how often the BeX detects abnormal behavior in its operational mode). Such regular data sampling produces time series variables, each of which may present some particular pattern over time.
- the statistical learning mechanism 410 is designed to learn such patterns based on time series variable values.
- Fig. 6 illustrates an example in which the time series values of a variable X form an emerging pattern over time.
- the horizontal axis represents time
- vertical axis represents the magnitude of variable values
- the dots represent the discrete values of a variable X recorded over time
- the curve is a sine-wave like pattern representing the emerging patter of variable X in time.
- Data points recorded over time often include noise or outliers that are usually extraneous data points that do not fit into the principle pattern of the data.
- noise may have to be considered in the modeling process by either modeling the noise simultaneously or reducing the brittleness of the data prior to the modeling.
- the emerging patter or the actual trend line over the analysis time horizon may be more reliably discovered. This discovery may take the form of a non-linear model to capture the variable's behavior.
- Time series variables may have different underlying intrinsic patterns of varying amplitudes and wavelengths.
- a data stream containing only one or two patterns is called shallow data while data streams that have many patterns is called deep data.
- Fig. 7 illustrates a data stream that may be represented by two different underlying patterns embedded in the value of variable X.
- the first pattern, pattern 1 presents a high frequency
- the second patter, pattern 2 presents a lower frequency. They are modulated on top of each other and together they form the underlying pattern of the variable X over time.
- a statistical learning model may be designed to identify and to quantify any number of such intrinsic patterns, although long term patterns with low amplitudes may be much more difficult to detect since they are generally obscured by random noises. Data series containing multiple patterns also introduce a higher level of noise (seen as apparent randomness or excessive outliers) into the modeling process simply by virtue of the patterns themselves.
- the modeling technique used to learn the behavior of variables that are characterized by multiple patterns may have to be designed accordingly to deal explicitly with problems associated with multiple and embedded patterns.
- Fig. 8 depicts an exemplary construct of the statistical learning mechamsm 430, which comprises two parts: an offline normal behavior modeling mechanism 810 and an online behavior modeling mechanism 820.
- the offline normal behavior modeling mechanism 810 learns a variable's normal pattern in a batch mode based on offline observation data corresponding to pre-recorded data points. What it captures is the static or regular pattern of the underlying variable without considering the dynamic noise factor. For example, a sine wave is a regular pattern that can be characterized using a sine function.
- the online behavior modeling mechanism 820 learns the dynamics of a variable's behavior based on online observation data corresponding to the data points collected during a BeX's operations. What it captures is the dynamic or adaptive pattern of the underlying variable, which is modulated on top of the regular pattern, learned during the offline modeling. For example, if a variable has, under normal situations, a sine pattern, its values measured online usually will not exactly fit the sine wave. This may be due to noise. To model a variable's pattern, both its regular and its dynamic patterns need to be captured. The online behavior modeling mechanism 820 is designed to characterize the variable's dynamics in time.
- a compound statistical model for a variable may be built that is capable of characterizing the real time behavior of a variable.
- variable patterns that a BeX learns offline are the ordinary behaviors as seen under the (assumed) normal operation of the system. These behaviors may be encoded in a non-linear time series model. This model is deployed when the BeX is running in operational mode to regularly forecast near-term future values of the variable. This forecast constitutes the root mechanism in the early warning mechanism 440.
- a variable has a time- varying or non-stationary behavior.
- ⁇ is the mean of the variable obtained through Least Squares Regression (LSR), assuming uniform time interval, as:
- i is the index for the time-of-day
- / is the index for the /-th day in the data collected
- a denotes the z ' -th time-of-day deviation from the overall mean u .
- a residual is the part of the model attributed to random fluctuations or noise in the pattern associated with the same point.
- j is the index for the day-of-week
- / is the index for the /-th week in the data collected
- ⁇ denotes the 7-th day-of-week deviation from the overall mean
- Such modeling may be easily extended to larger time periods. For example, it may be extended to week-of-month effects.
- an additional parameter may be used to characterize the k-th week-of-month deviation, denoted by ' k . This may be necessary for some data that has a structured variation from the first week to the last week of the month, on top the time-of-day and day-of-week variation, assuming the month-to-month variation is random.
- indices , j, k, / that correspond to time. That implies that given any time reference point t, when a variable is measured, the time reference point t may need to be translated into the corresponding indices, i, j, k, I, depending on the specific model used.
- the random variables (representing residuals) y h yu, y- may be uniformly denoted by y..
- the offline normal behavior modeling mechanism 810 is used to learn the static and regular behavior of a variable.
- a noise factor may need to be identified and removed from the data points.
- an autocorrelation relationship may exist among adjacent data points. That is, y, may not be an independent and identical distributed (i.i.d) random variable. This property of y, may further complicate the model.
- the above equation captures the dependency between y t and the same residuals measured at p previous time reference points.
- the equation 10 characterizes the p-or ⁇ er autoregressive (AR) process.
- ⁇ > ⁇ > 2 » ' P be the (p+l)-dimensional AR parameter vector
- u > is an uncorrelated normal distributed random variable with zero mean and variance of 1 (white noise)
- ⁇ is the standard deviation.
- D is a ⁇ x ⁇ submatrix of obtained by deleting row and column zeros and d is the j-dimensional vector identical to the first column of ⁇ with the zeroth element deleted.
- the covariance matrix elements are defined as
- the offline normal behavior modeling mechanism 810 establishes an offline normal behavior model for a variable by estimating the model parameters , i> " j> Y i " ⁇ ⁇ >' ">a P )> ⁇ based on given measured data points.
- the learning process may be performed in a batch mode using the data points recorded prior to the learning.
- the learned model, represented by those model parameters, is deployed when the underlying BeX is put in its operational mode.
- the online behavior modeling mechamsm 820 may be used to characterize the dynamic behavior of a variable.
- An online statistical learning mechanism may learn through some window period sliding along the time and may characterize the dynamics using some statistics computed from such sliding windows. The statistics computed from such sliding windows is then compared with the reference window to detect any slow and sudden statistical change in the time series variable. For example, such statistics may include averages or standard deviations.
- an online statistical learning mechanism To characterize such dynamic behavior into patterns, it may also be necessary for an online statistical learning mechanism to detect different segments along time in which the statistical properties of the variable dynamics differ significantly.
- segmentation based on statistical properties. For example, Generalized Likelihood Ratio (GLR) segmentation does this.
- GLR Generalized Likelihood Ratio
- the online behavior modeling mechanism 820 adaptively, from segment to segment, characterizes the dynamic behavior of a time series variable.
- the online behavior modeling mechanism 820 utilizes an auto-regression (AR) model to analyze the behavior of ⁇ ' defined in equation 10.
- AR auto-regression
- the AR coefficients ⁇ ⁇ *' 2 ' ' p ' can be estimated online and dynamically updated over time. Different approaches exist to perform such online estimation and dynamic updating.
- the identified auto-correlation may be used to predict the future residual values, hence also the variable values. This will facilitate the early warning capability of a BeX in an e-service management system by forecasting that certain threshold violation events may happen, with a certain probability, in the specified time horizon.
- the online behavior modeling mechanism 820 may detect any changes in statistical properties. This is due to the fact that the underlying time series variable (representing the residuals) are often only piecewise stochastically stationary. Therefore, the following two tasks have to be performed during online statistical learning. First, the online behavior modeling mechanism 820 identifies a new segmentation boundary whenever there is a significant statistical property change. Secondly, when the new boundary is identified, the accumulated statistics prior to the new boundary need to be flushed out so that statistical properties for the new segment can be accumulated without the data from a segment that is not statistically coherent. Such segmentation may be implemented using the Generalized Likelihood Ratio method.
- Fig. 9 is an exemplary flowchart of a process, in which statistical models characterizing the normal and dynamic behavior of a variable are established and are applied in generating early warning of threshold violation in eService management.
- Offline observation data with respect to a variable is first collected at act 910.
- the observation data collected offline is assumed to represent the normal behavior of the variable and is used to establish, at act 920, a statistical model that characterizes the normal behavior of the variable.
- To model the dynamic behavior of the variable online observation data is collected at act 930 and is used to establish, at act 940, a statistical model that characterizes the dynamic behavior of the variable.
- the generated models are then used, at act 950, to generate early warning of threshold violation with respect to the variable. Both the established statistical models and the generated early warning are used to detect, at act 960, abnormal behavior of the variable.
- Fig. 10 is an exemplary flowchart for the online behavior modeling mechanism 820.
- a new observation is received first at act 1010.
- the received observation is used to update, at act 1020, a history buffer.
- the online behavior modeling mechanism 820 then examines, at act 1030, to see whether there are enough observations accumulated to perform learning. If not , the process returns back to act 1010 to collect new observations. If there are enough observations collected for learning, a segmentation is performed, at act 1040, that detects any significant statistical property change that may correspond to a different segment of data.
- the online behavior modeling mechanism 820 identifies, at act 1080, the boundary of the new segment and flushes out, at act 1090, the information that is stored in the history buffer before the detected new boundary. The process then returns to act 1010 to continue to collect new observations for the new segment. If no new segment is detected, determined at act 1050, the observation data collected so far is used to dynamically estimate (or update), at act 1060, the auto-regression parameters. Such estimated auto-regression parameters are then sent, at act 1070, to the early warning mechanism 440.
- the future behavior of the variable may be predicted or forecasted.
- the certainty with which the future can be predicted may depend on many factors, including the compactness of the underlying patterns (the amount of randomness in the behavior), the depth of the historical base (how much past data is available for pattern discovery), the validity of the modeling techniques adopted, the amount of error in the model (how well the model represents the actual patterns), and how far into the future to predict (the further in the future we predict, the less confidence we have in our prediction).
- the early warning mechanism 440 (Fig.
- the statistical model for the variable behavior may be used to predict when a critical threshold may be violated.
- the above rule indicates "if the value of X in the current time period exceeds the threshold A, then send a violation event".
- the goal of the early warning mechanism 440 is to predict when (at what of time ⁇ in the future) X t will exceed the threshold A. This is illustrated in Fig. 11 and Fig. 12.
- the horizontal axis represents the time and the vertical axis represents the magnitude of a variable value.
- the location of the threshold A (1105) is shown in Fig. 11 (a) and a curve 1110 represents the actual behavior of variable X as recorded up to the current time 1115 (the dividing point between history and future).
- Fig. 11 (b) With the time, the values of variable X are continuously measured and recorded. Such recorded values form a continuing curve 1120. From curve 1120, it can be seen that the values of variable X over time (the behavior of variable X) are steadily trending toward the threshold (note that "steadily trending" is not a requirement of the model, but is used here to simplify the discussion.). In Fig. 11 (b), the movement of X is recorded across the next three analysis intervals (these might correspond to the data sampling rates of the variable) and eventually at the third interval, the variable X exceeds the threshold A and an event may be thrown to indicate that an abnormal event has been detected.
- the goal of the early warning mechanism 440 is to predict the likelihood of a threshold violation at a specific time in the future and may assign that likelihood a degree of certainty.
- the statistical model of a variable learned during offline and online statistical learning may be used to facilitate the task. This is illustrated in Fig. 12.
- a statistical model can be derived that characterizes the behavior of variable X based on the data points on curve 1110.
- Such a statistical model allows the early warning mechanism 440 to look ahead a number of analysis periods and forecast the behavior of the variable X.
- the dotted curve 1250 represents the predicted behavior of variable X in the next three sampling points and a predicted point and time 1240 of threshold violation may also be estimated.
- the early warning mechanism 440 Given a time reference value t , the early warning mechanism 440 first identifies, at act 1310, the corresponding indices /, j, k (e.g., day, week, month), based on which the residual value at time * or ⁇ ' is derived, at act 1320, based on the statistical model of the variable. That is,
- the early warning mechanism 440 uses the current value of the residual ⁇ ' to generate, at act 1330, a forecast of the residual value at a number of future time reference points. For example, to predict the forecast mean of ⁇ ' at the future time reference points of + + 2,..,t + H 5 or f+j ⁇ h-l,2,..,H, where H is the maximum prediction horizon, the following computation may be carried out:
- A ⁇ ⁇ c 2 A l +A 2 - c l
- the threshold for the variable values can be translated into corresponding residual thresholds for the residual values of the variable
- the early warning mechanism 440 may also estimate the probability for the residuals to exceed the corresponding residual thresholds derived accordingly for the residuals.
- Some BeXs may also employ rules enforce that variable values to be within a specific range, defined by two thresholds - a low and a high threshold. In this case, the prediction of a threshold violation may be estimated with respect to both thresholds. Similarly, the prediction of a violation with respect to both low and high variable thresholds may be performed based on residual values using translated low and high thresholds for the residual values.
- the probability for a residual value to remain within the range of [th, th * ] (or X within [T, T"]) can be computed, at act
- the probability for the variable to exceed the threshold can be simply derived from 1 _ i V
- the thresholds (T, 7") and the maximum number of future time steps H may be determined by the designer or user of the BeX.
- the predictive detection system will generate a forecast of the variable values in each future time interval as well as the probability of violating the thresholds.
- An early warning message may be sent out if the model predicts a threshold violation with a sufficiently high probability (may also be established by the designer or a user).
- a general-purpose computer alone or in connection with a special purpose computer. Such processing may be performed by a single platform or by a distributed processing platform.
- processing and functionality can be implemented in the form of special purpose hardware or in the form of software being run by a general-purpose computer.
- Any data handled in such processing or created as a result of such processing can be stored in any memory as is conventional in the art.
- such data may be stored in a temporary memory, such as in the RAM of a given computer system or subsystem.
- such data may be stored in longer-term storage devices, for example, magnetic disks, rewritable optical disks, and so on.
- a computer-readable media may comprise any form of data storage mechanism, including such existing memory technologies as well as hardware or circuit representations of such structures and of such data.
Abstract
Description
Claims
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/902,094 US20020077792A1 (en) | 2000-10-27 | 2001-07-11 | Early warning in e-service management systems |
US09/902,094 | 2001-07-11 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2003007174A1 WO2003007174A1 (en) | 2003-01-23 |
WO2003007174A9 true WO2003007174A9 (en) | 2003-11-13 |
Family
ID=25415298
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2002/021023 WO2003007174A1 (en) | 2001-07-11 | 2002-07-03 | Early warning in e-service management systems |
Country Status (2)
Country | Link |
---|---|
US (1) | US20020077792A1 (en) |
WO (1) | WO2003007174A1 (en) |
Families Citing this family (29)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040015381A1 (en) * | 2002-01-09 | 2004-01-22 | Johnson Christopher D. | Digital cockpit |
US7096074B2 (en) * | 2002-05-30 | 2006-08-22 | Insyst Ltd. | Methods and apparatus for early fault detection and alert generation in a process |
US20040138934A1 (en) * | 2003-01-09 | 2004-07-15 | General Electric Company | Controlling a business using a business information and decisioning control system |
US20040138936A1 (en) * | 2003-01-09 | 2004-07-15 | Johnson Christopher D. | Performing what-if forecasts using a business information and decisioning control system |
US20040138935A1 (en) * | 2003-01-09 | 2004-07-15 | Johnson Christopher D. | Visualizing business analysis results |
US20060106637A1 (en) * | 2003-01-09 | 2006-05-18 | General Electric Company | Business system decisioning framework |
US20040138932A1 (en) * | 2003-01-09 | 2004-07-15 | Johnson Christopher D. | Generating business analysis results in advance of a request for the results |
US20060111931A1 (en) * | 2003-01-09 | 2006-05-25 | General Electric Company | Method for the use of and interaction with business system transfer functions |
US7676390B2 (en) | 2003-09-04 | 2010-03-09 | General Electric Company | Techniques for performing business analysis based on incomplete and/or stage-based data |
US7162312B2 (en) * | 2003-09-24 | 2007-01-09 | Siemens Aktiengesellschaft | Method, system and device for predictive error recognition in a plant |
US7424395B2 (en) * | 2004-09-10 | 2008-09-09 | Exxonmobil Research And Engineering Company | Application of abnormal event detection technology to olefins recovery trains |
US7349746B2 (en) * | 2004-09-10 | 2008-03-25 | Exxonmobil Research And Engineering Company | System and method for abnormal event detection in the operation of continuous industrial processes |
US20060074598A1 (en) * | 2004-09-10 | 2006-04-06 | Emigholz Kenneth F | Application of abnormal event detection technology to hydrocracking units |
US7567887B2 (en) | 2004-09-10 | 2009-07-28 | Exxonmobil Research And Engineering Company | Application of abnormal event detection technology to fluidized catalytic cracking unit |
US7761172B2 (en) * | 2006-03-21 | 2010-07-20 | Exxonmobil Research And Engineering Company | Application of abnormal event detection (AED) technology to polymers |
US7720641B2 (en) * | 2006-04-21 | 2010-05-18 | Exxonmobil Research And Engineering Company | Application of abnormal event detection technology to delayed coking unit |
DE102006050938A1 (en) | 2006-10-28 | 2008-04-30 | Abb Technology Ag | Foresight determination method for process variable, involves assigning discrete measured value to each weighted measured value, and measuring future temporal process of process variable by linear regression of discrete measured value |
US20080103847A1 (en) * | 2006-10-31 | 2008-05-01 | Mehmet Sayal | Data Prediction for business process metrics |
WO2011008855A2 (en) * | 2009-07-14 | 2011-01-20 | Pinchuk Steven G | Method of predicting a plurality of behavioral events and method of displaying information |
US8037365B2 (en) * | 2009-11-03 | 2011-10-11 | International Busniss Machines coporation | System and method for automated and adaptive threshold setting to separately control false positive and false negative performance prediction errors |
US8862250B2 (en) | 2010-05-07 | 2014-10-14 | Exxonmobil Research And Engineering Company | Integrated expert system for identifying abnormal events in an industrial plant |
US11257101B2 (en) * | 2012-08-15 | 2022-02-22 | Alg, Inc. | System, method and computer program for improved forecasting residual values of a durable good over time |
US10430814B2 (en) * | 2012-08-15 | 2019-10-01 | Alg, Inc. | System, method and computer program for improved forecasting residual values of a durable good over time |
WO2014028645A2 (en) * | 2012-08-15 | 2014-02-20 | Alg, Inc. | System, method and computer program for forecasting residual values of a durable good over time |
CN106815255A (en) * | 2015-11-27 | 2017-06-09 | 阿里巴巴集团控股有限公司 | The method and device of detection data access exception |
US11188917B2 (en) * | 2018-03-29 | 2021-11-30 | Paypal, Inc. | Systems and methods for compressing behavior data using semi-parametric or non-parametric models |
WO2020254203A1 (en) * | 2019-06-19 | 2020-12-24 | Koninklijke Philips N.V. | Role-specific process compliance alert system |
US20210182875A1 (en) * | 2019-12-11 | 2021-06-17 | Dell Products L.P. | Globalization, Localization, and Internationalization Learning and Regulation Model |
TWI738277B (en) | 2020-03-31 | 2021-09-01 | 中國信託商業銀行股份有限公司 | Monitoring alarm method and its server end |
Family Cites Families (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5210704A (en) * | 1990-10-02 | 1993-05-11 | Technology International Incorporated | System for prognosis and diagnostics of failure and wearout monitoring and for prediction of life expectancy of helicopter gearboxes and other rotating equipment |
US5223207A (en) * | 1992-01-29 | 1993-06-29 | The United States Of America As Represented By The United States Department Of Energy | Expert system for online surveillance of nuclear reactor coolant pumps |
US5819028A (en) * | 1992-06-10 | 1998-10-06 | Bay Networks, Inc. | Method and apparatus for determining the health of a network |
DE4243882C1 (en) * | 1992-12-23 | 1994-01-05 | Baleanu Michael Alin | Method and device for monitoring a technical process |
US5465321A (en) * | 1993-04-07 | 1995-11-07 | The United States Of America As Represented By The Administrator Of The National Aeronautics And Space Administration | Hidden markov models for fault detection in dynamic systems |
US5974457A (en) * | 1993-12-23 | 1999-10-26 | International Business Machines Corporation | Intelligent realtime monitoring of data traffic |
US5615323A (en) * | 1994-11-04 | 1997-03-25 | Concord Communications, Inc. | Displaying resource performance and utilization information |
US5659593A (en) * | 1994-11-30 | 1997-08-19 | Lucent Technologies Inc. | Detection of deviations in monitored patterns |
US5877954A (en) * | 1996-05-03 | 1999-03-02 | Aspen Technology, Inc. | Hybrid linear-neural network process control |
WO1997043666A1 (en) * | 1996-05-14 | 1997-11-20 | Alliedsignal Inc. | Radar based terrain and obstacle alerting function |
US5764509A (en) * | 1996-06-19 | 1998-06-09 | The University Of Chicago | Industrial process surveillance system |
US5799154A (en) * | 1996-06-27 | 1998-08-25 | Mci Communications Corporation | System and method for the remote monitoring of wireless packet data networks |
US6125105A (en) * | 1997-06-05 | 2000-09-26 | Nortel Networks Corporation | Method and apparatus for forecasting future values of a time series |
US6199018B1 (en) * | 1998-03-04 | 2001-03-06 | Emerson Electric Co. | Distributed diagnostic system |
US20010052087A1 (en) * | 1998-04-27 | 2001-12-13 | Atul R. Garg | Method and apparatus for monitoring a network environment |
US6119111A (en) * | 1998-06-09 | 2000-09-12 | Arch Development Corporation | Neuro-parity pattern recognition system and method |
US6611867B1 (en) * | 1999-08-31 | 2003-08-26 | Accenture Llp | System, method and article of manufacture for implementing a hybrid network |
US6427132B1 (en) * | 1999-08-31 | 2002-07-30 | Accenture Llp | System, method and article of manufacture for demonstrating E-commerce capabilities via a simulation on a network |
US6611735B1 (en) * | 1999-11-17 | 2003-08-26 | Ethyl Corporation | Method of predicting and optimizing production |
US6868525B1 (en) * | 2000-02-01 | 2005-03-15 | Alberti Anemometer Llc | Computer graphic display visualization system and method |
US6850988B1 (en) * | 2000-09-15 | 2005-02-01 | Oracle International Corporation | System and method for dynamically evaluating an electronic commerce business model through click stream analysis |
-
2001
- 2001-07-11 US US09/902,094 patent/US20020077792A1/en not_active Abandoned
-
2002
- 2002-07-03 WO PCT/US2002/021023 patent/WO2003007174A1/en not_active Application Discontinuation
Also Published As
Publication number | Publication date |
---|---|
US20020077792A1 (en) | 2002-06-20 |
WO2003007174A1 (en) | 2003-01-23 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20020077792A1 (en) | Early warning in e-service management systems | |
Vilalta et al. | Predictive algorithms in the management of computer systems | |
US20020174222A1 (en) | Behavior experts in e-service management | |
US9633198B2 (en) | Detecting anomalous process behavior | |
US20190268214A1 (en) | Predicting issues before occurrence, detection, or reporting of the issues | |
US20190228296A1 (en) | Significant events identifier for outlier root cause investigation | |
US6311175B1 (en) | System and method for generating performance models of complex information technology systems | |
US8122123B2 (en) | System and method for monitoring business performance using monitoring artifacts | |
US7467145B1 (en) | System and method for analyzing processes | |
US20070192065A1 (en) | Embedded performance forecasting of network devices | |
US7725575B2 (en) | Unexpected demand detection system and unexpected demand detection program | |
US20120290543A1 (en) | Accounting for process data quality in process analysis | |
US20150039555A1 (en) | Heuristically modifying dbms environments using performance analytics | |
US20170039530A1 (en) | System and method for smart alerts | |
US20030149570A1 (en) | Early warning in e-service management systems | |
US8688501B2 (en) | Method and system enabling dynamic composition of heterogenous risk models | |
Vanier et al. | 88 BELCAM PROJECT: SERVICE LIFE, DURABILITY AND ASSET MANAGEMENT RESEARCH | |
US6856983B2 (en) | Adaptive feedback control in e-service management | |
Bey-Temsamani et al. | A practical approach to combine data mining and prognostics for improved predictive maintenance | |
Dehlavi | A machine learning model for predicting the procurement lifetime of electronic units in sustainment-dominated systems | |
Zhang et al. | Risk-based dynamic pricing via failure prediction | |
US20030208575A1 (en) | Framework for e-service management | |
Yuan et al. | A Bayesian framework for supply chain risk management using business process standards | |
Wang et al. | Discovering multiple time lags of temporal dependencies from fluctuating events | |
Ishida | An application of qualitative reasoning to process diagnosis: automatic rule generation by qualitative simulation |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ OM PH PL PT RO RU SD SE SG SI SK SL TJ TM TN TR TT TZ UA UG UZ VN YU ZA ZM ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR IE IT LU MC NL PT SE SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
COP | Corrected version of pamphlet |
Free format text: PUBLISHED INTERNATIONAL SEARCH REPORT (1 PAGE) REPLACED BY CORRECT INTERNATIONAL SEARCH REPORT (2 PAGES) |
|
REG | Reference to national code |
Ref country code: DE Ref legal event code: 8642 |
|
122 | Ep: pct application non-entry in european phase | ||
NENP | Non-entry into the national phase |
Ref country code: JP |
|
WWW | Wipo information: withdrawn in national office |
Country of ref document: JP |