A method of diagnosing faults in a utility supply network involves receiving performance data indicative of performance of the utility supply network, and receiving historical performance data indicative of a historical performance of the utility supply network and a fault associated with the historical performance data. A fault in the utility supply network is determined based on a comparison of the performance data with the historical performance data.

The present disclosure is directed to a method of detecting anomalous behaviors based on a temporal profile. The method can include collecting, by a control system comprising a processor and memory, a set of network data communicated by a plurality of network nodes over a network during a time duration. The method can include identifying, by the control system, one or more seasonalities from the set of network data. The method can include generating, by the control system, a temporal profile based on the one or more identified seasonalities. The method can include detecting, by the control system and based on the temporal profile, an anomalous behavior performed by one of the plurality of network nodes. The method can include identifying, by the control system and based on the temporal profile, a root cause for the anomalous behavior.

A method is provided for identifying operating conditions of a system. Input data relating to operation of the system is applied to a multi-class model for classification, where the multi-class model is configured for classifying the data into one of a plurality of predefined classes, and each class corresponds to a respective operating condition of the system. A confidence level of the classification by the multi-class model is determined. If the confidence level is below a threshold confidence level, the input data is applied to a plurality of binary models, where each binary model is configured for determining whether the data is or is not in a respective one of the predefined classes. If the plurality of binary models determine that the data is not in any of the respective predefined classes, the data can be taken into consideration when updating the multi-class model.

Embodiments of the present invention provide a system for processing real-time event logs related to monitored events on a network. The system is configured for identifying one or more entity resources associated with an entity, continuously monitoring the one or more entity resources, identifying one or more events associated with the one or more entity resources, pre-processing the one or more events, via an artificial intelligence engine, identifying at least one event of the one or more events is abnormal based on pre-processing the one or more events, filtering the at least one event that is abnormal, segmenting the at least one event from the one or more events, and in response to segmenting the at least one event, storing the at least one event in a first log that is different from a second log that stores the one or more events excluding the at least one event.

A method for discovering and diagnosing network anomalies. The method includes receiving key performance indicator (KPI) data and alarm data. The method includes extracting features based on samples obtained by discretizing the KPI data and the alarm data. The method includes generating a set of rules based on the features. The method includes identifying a sample as a normal sample or an anomaly sample. In response to identifying the sample as the anomaly sample, the method includes identifying a first rule that corresponds to the sample, wherein the first rule indicates symptoms and root causes of an anomaly included in the sample. The method further includes applying the root causes to derive a root cause explanation of the anomaly and performing a corrective action to resolve the anomaly based on the first rule.

A system, method, and computer-readable medium are disclosed for performing a data center monitoring and management operation. The data center monitoring and management operation includes: monitoring data center assets within a data center; identifying an issue within the data center, the issue being associated with an operational situation associated with a particular component of the data center; associating the issue with a particular point in time; and, informing a user about the issue, the informing including information regarding the particular point in time, the informing including a graphical depiction of the particular component of the data center and the issue within the data center.

The present disclosure is directed to a method of detecting anomalous behaviors based on a temporal profile. The method can include collecting, by a control system comprising a processor and memory, a set of network data communicated by a plurality of network nodes over a network during a time duration. The method can include identifying, by the control system, one or more seasonalities from the set of network data. The method can include generating, by the control system, a temporal profile based on the one or more identified seasonalities. The method can include detecting, by the control system and based on the temporal profile, an anomalous behavior performed by one of the plurality of network nodes. The method can include identifying, by the control system and based on the temporal profile, a root cause for the anomalous behavior.

In one embodiment, a network assurance service that monitors a network maps time series of values of key performance indicator (KPIs) measured from the network to lists of unique values from the time series. The service sets a target alarm rate for anomaly detection alarms raised by the network assurance service. The service uses an optimization function to identify a set of thresholds for the KPIs. The optimization function is based on: a comparison between the target alarm rate and a fraction of network issues flagged by the service as outliers, KPI thresholds selected based on the lists of unique values from the time series, and a number of thresholds that the KPIs must cross for the service to raise an alarm. The service raises an anomaly detection alarm for the monitored network based on the identified set of thresholds for the KPIs.

A deep reinforcement learning-based information processing method includes: determining whether a target edge computing server enters an alert state according to a quantity of service requests received by the target edge computing server within a preset time period; when the target edge computing server enters the alert state, obtaining preset system status information from a preset memory library; computing an optimal action value corresponding to the target edge computing server based on a preset deep reinforcement learning model according to the preset system status information and preset strategy information; and generating an action corresponding to the target edge computing server according to the optimal action value, and performing the action on the target edge computing server. A deep reinforcement learning-based information processing apparatus for an edge computing server includes a first determining module, an acquisition module, a first computing module, a first generation module.

A method for detecting anomalies in one or more network performance metrics stream for one or more monitored object comprising using a discrete window on the stream to extract a motif from said stream for a first of said network performance metric for a first of said monitored object. Maintaining an abnormal and a normal cluster center of historical time series for said first network performance metric for said first monitored object. Classifying said motif based on a distance between said new time series and said abnormal and said normal cluster center. Determining whether an anomaly for said motif occurred based on said distance and a predetermined decision boundary.