A monitoring system using agents to dynamically collect state information at controllable intensity levels from components of systems. The system receives state information collected by an agent at a particular intensity level, and processes the state information to determine an updated intensity level for collecting state information by the agent, or by some other agent. The state information may include data indicating the performance of one or more components, such as process response times or other metrics. The intensity level for collecting further state information can be increased when, among other things, previously collected state information indicates more detailed monitoring for the component is appropriate. The intensity level for collecting further state information can be decreased when, among other things, previously collected state information indicates continued expected behavior.

An aircraft sensor system includes a first sensor configured to detect a parameter of an aircraft system and a first micro electro-mechanical-system (MEMS) disposed local to a first component within the aircraft system. The first MEMS is communicatively connected to a controller, and is configured to trigger in response to a corresponding parameter exceeding a threshold. The controller is connected to an output of the first sensor and includes a non-transitory memory storing instructions configured to cause the controller to increase a sampling rate of the first sensor to a sampling rate corresponding to the first component for at least a predetermined length of time in response to the first MEMS being triggered.

A method and system for accelerating monitoring of network traffic. The method may include receiving, at a network chip of a network device, a network traffic data unit; selecting, by the network chip, the network traffic data unit based on a traffic sampling rate; processing, by the network chip, the network traffic data unit to obtain sample information; truncating the network traffic data unit to obtain a network traffic data unit portion; generating a flow sample header comprising the sample information; storing, in storage of the network chip, a flow sample comprising the flow sample header and the network traffic data unit portion; constructing a flow datagram comprising the flow sample and a plurality of other flow samples; sending the flow datagram to a collector; and clearing the flow sample and the plurality of other flow samples from the storage of the network chip.

Data reduction techniques are provided for a multi-sensor IoT environment. An exemplary method comprises: dynamically determining, by a device within a distributed network comprised of a plurality of sensors, an amount of sensor data to be collected by and/or transmitted by a sensor within the distributed network based on at least one predefined spatial-based rule and/or at least one predefined temporal-based rule; and processing the sensor data based on the dynamically determined amount of sensor data. A percentage of the plurality of sensors within the distributed network that collect and/or transmit the sensor data can optionally be specified. One or more sensors optionally collect the sensor data at a default resolution and a predefined spatial-based rule and/or a predefined temporal-based rule specifies a predefined trigger for at least one sensor to collect and/or transmit the sensor data at a higher resolution.

A disclosed method may include (1) sampling, by way of at least one CPU on a network device, packets traversing a network in connection with at least one communication session that involves computing devices, (2) calculating a total number of packets sampled by way of the CPU over a certain period of time, (3) identifying a sampling threshold that represents a target number of packets to be sampled by way of the CPU over the certain period of time, (4) determining that the total number of packets sampled over the certain period of time exceeds the sampling threshold, and in response to determining that the total number of packets sampled exceeds the sampling threshold, (5) decreasing a sampling rate at which the CPU is to sample subsequent packets traversing the network in connection with the communication session. Various other systems and methods are also disclosed.

Systems and methods of determining a network performance property in at least one computer network, including: sampling traffic in active communication with the at least one computer network, analyzing the sampled traffic to group communication packets to flows, and predicting at least one network property of the at least one network based on the grouped communication packets and based on at least one traffic parameter in the at least one network, where the at least one traffic parameter is selected from the group consisting of: union of packet streams, intersection of packet streams, and differences of packet streams, and where the predicted at least one network property is selected from the group consisting of: total number of flows, number of flows with a predefined characteristic, number of packets, and volume of packets.

Methods, systems, and computer-readable media for traffic distribution mapping in a service-oriented system are disclosed. A plurality of call paths are determined representing service interactions among a plurality of services. The call paths include a particular service and are determined using trace data generated by the services. Total call volumes are determined at individual ones of the services. Based at least in part on the call paths and the total call volumes, one or more estimated call ratios are determined between the particular service and one or more APIs of one or more additional services. Based at least in part on the call ratio(s) and the total call volumes, one or more call volumes are determined between the particular service and the one or more APIs of the one or more additional services.

In a system for efficiently detecting large/elephant flows in a network, the rate at which the received packets are sampled is adjusted according to a top flow detection likelihood computed for a cache of flows identified in the arriving network traffic. After observing packets sampled from the network, Dirichlet-Categorical inference is employed to calculate a posterior distribution that captures uncertainty about the sizes of each flow, yielding a top flow detection likelihood. The posterior distribution is used to find the most likely subset of elephant flows. The technique rapidly converges to the optimal sampling rate at a speed O(1/n), where n is the number of packet samples received, and the only hyperparameter required is the targeted detection likelihood.

Monitoring an operational characteristic of a data communication device within a network includes sampling an operational characteristic of the data communication device at a fine-grain sample rate over a first sampling interval to produce fine-grain samples of the operational characteristic of the data communication device, training a machine learning algorithm using the fine-grain samples of the operational characteristic of the data communication device, the fine-grain sample rate, and a coarse-grain sample rate that is less than the fine-grain sample rate, sampling the operational characteristic of the data communication device at the coarse-grain sample rate over a second sampling interval to produce coarse-grain samples of the operational characteristic of the data communication device, and using the machine learning algorithm to process the coarse-grain samples of the operational characteristic of the data communication device to produce accuracy-enhanced samples of the operational characteristic of the data communication device.

A system and method for sampling application programming interface (API) execution traces in a computer system uses feature vectors of the API execution traces that are generated using trace-context information. The feature vectors are then used to group the API execution traces into clusters. For the cluster, sampling rates are generated so that a sampling rate is assigned to each of the clusters. The sampling rates are then applied to the API execution traces to adaptively sample the API execution traces based on the clusters to which the API execution traces belong.