A system and method for performing automated learning of an Internet-of-Things (IoT) application are disclosed. The automated learning is based on generation of application-agnostic events, allowing the automated learning to be performed without prior knowledge of the IoT application.

Various methods, apparatuses/systems, and media for automatic generation and management of cloud service provider events are provided. A service provider computing device defines a maturity level of an event; publishes an event schema associated with the maturity level of the event; and transmits the event to an event platform that is configured to provide infrastructure for event production and consumption. The event platform validates the event based on the event schema; calculates a validation score for the event upon validation of the event; and publishes the validation score on a website. A consumer computing device consumes the published event from the event platform.

A method (100, 200, 300) for managing network event data are disclosed. The method for managing network event data comprises receiving incoming network event data, the network event data comprising notifications of network events occurring within a network (102). The method further comprises, for individual notified network events within the received network event data, identifying a category of the notified network event (104) and filtering the received network event data on the basis of co-occurrence in the network of network events in individual network categories with network events in other network categories (106). Also disclosed are a Manager (600), a System (700) and a computer program.

Apparatuses and methods for identifying network anomalies. A method includes determining a cumulative anomaly score over a predefined time range based on a subset of historical PM samples and determining an anomaly ratio of a first time window and a second time window, based on the cumulative anomaly score. The method also includes determining one or more anomaly events coinciding with CM parameter changes based on the anomaly ratio; collating the PM, alarm, and CM data into a combined data set based on matching fields and timestamps; generating a set of rules linking one or more CM parameter changes and the collated data to anomaly events; and generating root cause explanations for CM parameter changes that are linked to anomaly events.

A data security system interfaces with a plurality of heterogeneous online collaboration platforms, each having its own platform specific set of collaboration settings to control access to collaborative data. The data security system maps a set of common collaboration settings to the platform specific set of collaboration settings of each heterogeneous online collaboration platform and monitors a state of the platform specific set of collaboration settings of each heterogeneous online collaboration platform. If the data security system determines that the state of a platform specific collaboration setting does not comply with a specified common collaboration setting state, the data security system automatically changes the state of the platform specific collaboration setting to comply with the common collaboration setting state.

Systems and methods for dynamically routing notifications based on device statuses are disclosed herein. For instance, a notification may be generated for a user account corresponding to an application that is installed on a plurality of devices. A system identifies a status of each of the plurality of devices and uses the status of each of the plurality of devices to select a particular device to receive the notification. The system then transmits the notification to the selected particular device.

Systems, methods, and computer-readable for determining performance metrics of a network include obtaining, from a network assurance system, one or more network performance metrics, the network performance metrics corresponding to execution of one or more applications in a network domain. An Application Performance Management (APM) system provides one or more applications performance metrics, the applications performance metrics corresponding to execution of the one or more applications in an applications domain. The one or more network performance metrics are integrated with the one or more applications performance metrics to determine integrated performance metrics for the one or more applications across the network domain and the applications domain.

A performance monitoring system includes a metric collector configured to receive, via metric exporters, telemetry data comprising metrics related to a network of computing devices. A metric time series database stores related metrics. An alert rule evaluator service is configured to evaluate rules using stored metrics. The performance monitoring system may include a machine learning module and is configured to determine optimized metric collection sampling intervals and rule evaluation intervals, and to automatically determine recommended alert rules.

A method for handling large-scale host failures on a cloud platform includes: configuring a corresponding failed host queue for each host group; setting initial priority values and evacuation count thresholds for cloud hosts; arranging failed hosts in failed host queues according to priorities of the failed hosts, and arranging the cloud hosts in the failed hosts according to priority values of the cloud hosts; handling, by the host group, the failed hosts the cloud hosts and in the corresponding failed host queue according to an arrangement order; when evacuation of a cloud host fails, re-determining a priority value of the cloud host; detecting evacuation capability of the host group corresponding to each failed host queue, and disabling a failed host queue having poor evacuation capability; arranging failed hosts in the disabled failed host queue into remaining failed host queues; and enabling a failed host queue meeting a condition.

An anomaly detection apparatus (10) includes a storage unit (14) that stores dictionary information (14b) in which a partial character string of a message representing a type of a message included in a text log output from a system and an ID set for the type of the message are associated with each other. The anomaly detection apparatus (10), when the message included in the text log output from the system is acquired, refers to the dictionary information (14b) stored in the storage unit (14), classifies the message included in the text log by the type, and assigns the ID to the message that has been classified; and detects an anomaly based on the ID assigned to the message.