Systems and methods for event detection

Abstract

A system accesses a log of events on more than one computing system and scans these logs in an effort to determine the likely cause of various items of interest, events, or problems. These items of interest often include improper or frustrating behavior of a computer system, but may also include delightful or beneficial behaviors for which a user, group of users, company, service, or help desk seeks a cause. Once the likely source of the item of interest is found, a test may be performed to confirm the source of the problem and warning or corrective action taken.

Description

CROSS REFERENCE TO RELATED APPLICATIONS[0001]This application is a continuation application of copending U.S. patent application Ser. No. 11 / 096,659 filed on Mar. 31, 2005, the contents of which are hereby fully incorporated by reference in its entiretyFIELD OF THE INVENTION[0002]The present invention relates generally to systems and methods for event detection and analysis. More specifically, this invention relates to determining causes of concerns encountered by users of computing systems.BACKGROUND OF THE INVENTION[0003]Computer use is becoming increasingly complex, as traditional operating systems are under continual attack by a panoply of malicious software agents including viruses, nonviral “malware,” adware, spyware, and Web browser hijackers. Viral and nonviral threats are very serious concerns for consumers, service providers, help desks, and computer and software manufacturers. Additionally, operating systems may contain inefficiencies and errors that cause them to fail wh...

AI Technical Summary

Benefits of technology

The present invention provides a system and method for detecting events in computer systems and analyzing them to determine the likely cause. The system accesses logs of events from multiple computers and scans them for patterns. The system can detect both problematic and beneficial events. The detection service can be provided as a fee by a service provider and may involve a shared server or peer model. The system can also isolate and test potential causes of events without harming the host computer. The invention allows for automated testing and experimentation without human intervention and can provide a roll-back feature to restore computer systems to a previous state.

Problems solved by technology

Computer use is becoming increasingly complex, as traditional operating systems are under continual attack by a panoply of malicious software agents including viruses, nonviral “malware,” adware, spyware, and Web browser hijackers.

Viral and nonviral threats are very serious concerns for consumers, service providers, help desks, and computer and software manufacturers.

Additionally, operating systems may contain inefficiencies and errors that cause them to fail when a user runs a program or takes other seemingly innocuous actions.

Consumer phone calls to help centers regarding spyware adware typically require significant troubleshooting time.

Usually the complaint is that the computer is performing slowly.

Consumers often do not understand the differences among adware, spyware, worms, and viruses—and the lack of knowledge costs Internet service providers significant money.

Problems may arise on certain computer systems as a result of various kinds of user actions that trigger the installation of malicious software or computer registry changes.

The problem may not appear when the user visits a web site, but might appear when the user clicks a link from that web site that redirects the browser to another site, in a nonobvious manner, that contains the offending software.

However, it is not always clear as to which one of a number of steps or events prior to a problem is the true cause of the problem.

Computer terrorism may involve attacks that modify the logic of a computing system in order to introduce delays or to make the system unpredictable.

Images