Hierarchical Forensics of IoT Systems in the Cloud and Time Series Databases

Abstract

An exemplary method includes: creating an empty reconstructed stream database; identifying a data time interval; identifying a data source that stores data during the data time interval; reading data from the data source, wherein the data read from the data source is associated with a corresponding timestamp that falls within the data time interval; inserting the read data into the empty reconstructed stream database to create a high-resolution data stream, wherein the data is sorted in the empty reconstructed stream database according to the timestamp; processing the data in the high-resolution data stream; and based on the processing of the data, identifying and resolving issues related to the operating environment in which the data was originally generated.

Description

Technical Field

[0001] Embodiments of the present invention generally relate to data protection. More specifically, at least some embodiments of the present invention relate to systems, hardware, software, computer-readable media, and methods for the following process, which is used to reconstruct a time series data stream using data from multiple different sources. Background Art

[0002] As the so-called Internet of Things (IoT) grows in popularity, the size and number of data streams generated by IoT devices and transmitted to local or cloud data centers continue to increase. In many cases, the data streams are appended to time series databases, which typically save only the most recent data at the highest resolution, while merging or pruning older data. This method of storing data limits the quality of forensics that can be performed in IoT systems after a problem occurs, and can also negatively affect the retraining of machine learning algorithms on lost data.

[0003] To illustrate, when an event occurs that affects an IoT system, IoT device, and / or associated data, it may be desirable to be able to access backed-up IoT data at a relatively high resolution. However, at least in part because portions of the data may exist in a variety of different locations, it may be difficult to acquire and reconstruct the data. Therefore, the location where the data is intended to be stored may not always have all the data required. This may occur due to data policies in a time series database, such as policies that cause older data to be deleted or downsampled. A related issue is that the data policy may not provide for storing all data at a high resolution.

[0004] Likewise, IoT devices do not typically have large data storage capabilities. Therefore, IoT devices cannot be relied upon to store large amounts of data. This in turn may be a reason to implement data strategies such as downsampling, which, as mentioned above, are themselves problematic.

[0005] Finally, backups of time series DBs (databases) or IoT devices may not be coordinated. That is, time series DB backups may contain older data, but the runtime system may not be able to access these backups. Similarly, some larger devices (such as surveillance cameras) may even have backups of historical data. However, once again, the runtime system usually cannot access this backup data. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] In order to describe the way in which at least some advantages and features of the present invention can be obtained, embodiments of the present invention will be described in more detail with reference to the specific embodiments of the present invention shown in the accompanying drawings. It should be understood that these drawings depict only typical embodiments of the present invention and therefore should not be considered as limiting the scope of the present invention, and embodiments of the present invention will be described and explained with additional features and details through the use of the accompanying drawings.

[0007] Figure 1 Aspects of an exemplary operating environment for some embodiments of the invention are disclosed.

[0008] Figure 2 Aspects of exemplary host configurations are disclosed.

[0009] Figure 3 is a flow chart disclosing aspects of an exemplary method for reconstructing a high-resolution data stream according to various embodiments of the present invention. DETAILED DESCRIPTION

[0010] Embodiments of the present invention generally relate to data protection. More specifically, at least some embodiments of the present invention relate to systems, hardware, software, computer-readable media, and methods for a process for reconstructing a time series data stream using multiple portions of data present at multiple different sources. The portions of the data may be associated with respective different resolutions, for example, a portion of the data may be backed up at a first resolution and another portion of the data may be backed up at a second resolution different from the first resolution.

[0011] Typically, embodiments of the present invention stitch together data from multiple sources to reconstruct a data stream at high resolution. Regardless of where the data is stored or the resolution of the stored data, the data stream can be reconstructed by combining the data in a desired order or sequence using metadata (e.g., a unique ID (identifier) ​​value or a timestamp). Some embodiments of the present invention can construct a data stream of any desired size in a temporary manner, even if such a data stream did not exist previously. For illustration, a database (DB) may only be large enough to hold 1M samples, but 3M samples are required for analysis or some other purposes. In cases such as this, embodiments of the present invention can construct a data stream of any desired size (e.g., 3M samples), without being limited by the size of the DB. It should be noted that although a 3M data stream, for example, may never have existed in the DB, such a data stream may still be referred to as having been reconstructed in this article. In addition, when reconstructing a data stream, embodiments of the present invention can ensure that the reconstructed stream will be able to fit into the database. To this end, embodiments of the present invention can set or override a database storage policy when applicable to ensure that the reconstructed data stream measured in terms of disk space, DB record count, or any other metric can be accommodated by the database.

[0012] Thus, advantageously, embodiments of the present invention can provide various benefits relative to conventional systems and methods. To illustrate, embodiments of the present invention enable forensics, troubleshooting, and other processes that require high-resolution data streams to obtain optimal results, such as retraining of machine learning algorithms. The results of these forensics and troubleshooting processes can be used to identify and solve operational problems of systems, applications, or devices, such as in IoT or other environments. Similarly, embodiments of the present invention include data recovery processes that use high-resolution data streams that have been reconstructed as disclosed herein. In addition, embodiments of the present invention are capable of reconstructing high-resolution data streams, even if some portions of the data used for reconstruction are relatively low-resolution (e.g., due to downsampling or other downscaling processes) and / or are stored in various different locations. Similarly, embodiments of the present invention enable the construction / reconstruction of data streams of any desired size. In this way, data streams that trace back far in time can be reconstructed as needed.

[0013] As shown in the foregoing examples, embodiments of the present invention can improve the operation of a computing system or an element of a computing system, for example, by reducing or eliminating the need or requirement for a large database to maintain a high-resolution data stream in its entirety. In addition, embodiments of the present invention enable diagnosis and resolution of problems in a computing system by reconstructing a high-resolution data stream. Other aspects of the disclosed processes and methods are discussed below in conjunction with various illustrative examples.

[0014] A. Aspects of an Exemplary Operating Environment

[0015] The following is a discussion of aspects of an exemplary operating environment for various embodiments of the invention. This discussion is not intended to limit the scope of the invention or the applicability of the embodiments in any way.

[0016] At least some specific embodiments of the present invention may be used in conjunction with an IoT environment having one or more IoT edge components, which may include, for example, IoT sensors, IoT actuators, and / or any other IoT devices that collect and / or generate information and / or transmit information about the environment in which they are located, and the IoT environment may also include IoT devices that respond to commands to modify certain aspects of their environment. For illustration, IoT edge components include IoT sensors for physical security and disaster detection. Other IoT edge components include surveillance cameras, motion detection sensors, and other edge devices that can be used to detect intruders and sound burglar alarms. Smoke and gas detectors can be used to trigger fire alarms and activate fire extinguishers. Regardless of their configuration or intended use, IoT edge devices may also be configured to retrievably store data about their environment, operations, and / or commands received from external systems or devices. More details about exemplary operating environments in which IoT edge devices can be used are provided below.

[0017] In the case of performing data protection operations, such as backup and / or recovery operations, using, for example, reconstructed high-resolution data streams, at least some embodiments may be used in conjunction with a data protection environment (e.g., a Dell-EMC DataDomain environment) that may implement backup, archiving, recovery, and / or disaster recovery functions. However, the scope of the present invention is not limited to this exemplary data protection environment, and more generally extends to any data protection environment associated with creating, saving, backing up, and / or recovering data.

[0018] The data protection environment can take the form of a cloud storage environment, a local storage environment, and a hybrid storage environment including public and private elements, although the scope of the present invention also extends to any other type of data protection environment. Any of these exemplary storage environments can be partially or completely virtualized. The storage environment can include or consist of a data center that is operable to service read and write operations initiated by one or more clients.

[0019] In addition to the storage environment, the operating environment may also include one or more host devices, such as clients, each of which hosts one or more applications. In this way, a particular client may use one or more instances of each application in the one or more applications, or otherwise be associated with one or more instances of each application in the one or more applications. Typically, the applications used by the client are not limited to any specific function or type of function. For example, some exemplary applications and data include email applications (such as MS Exchange), file systems, and databases (such as Oracle databases and SQL Server databases). The application on the client may generate new data and / or modified data that is desired to be protected.

[0020] Any device in the operating environment, including clients, servers, and hosts, may take the form of software, physical machines, or virtual machines (VMs), or any combination of these forms, although no implementation requires a specific device implementation or configuration. Similarly, data protection system components (such as databases, storage servers, storage volumes, storage disks, replication services, backup servers, recovery servers, backup clients, and recovery clients) may also take the form of software, physical machines, or virtual machines (VMs), although no implementation requires a specific component implementation. In the case of using VMs, a hypervisor or other virtual machine monitor (VMM) may be used to create and control the VMs.

[0021] As used herein, the term "data" is intended to be broad in scope. Thus, the term includes, by way of example and not limitation, data segments (such as may be generated by a data stream segmentation process), data chunks, data blocks, atomic data, emails, objects of any type, files, contacts, directories, subdirectories, volumes, and any combination of one or more of the foregoing.

[0022] The exemplary embodiments of the present invention are applicable to any system capable of storing and processing various types of objects in analog, digital or other forms. Although terms such as documents, files, blocks or objects may be used by way of example, the principles of the present invention are not limited to any particular form of representing and storing data or other information. Rather, these principles are equally applicable to any object capable of representing information.

[0023] Pay special attention now Figure 1, the operating environment 100 may typically include or consist of a general IoT system that incorporates edge devices into a gateway and then into a central backend where most of the processing is done. After initial processing, the data is typically saved in a time series database for analysis. An example of such a time series database that may be used in embodiments of the present invention, but is not required to be used, is InfluxDB , Dalmantiner DB and OpenTSDB .

[0024] like Figure 1 As shown, the operating environment 100 may include a system 200, which may include an array 202 of one or more IoT edge devices 202a...202n, one, some, or all of which may be IoT sensors, although there is no requirement that all IoT edge devices include or consist of sensors. More generally, as contemplated herein, an IoT edge device includes, but is not limited to, any physical device that includes, but is not limited to, one, some, or all of electronics, software, sensors, and connectivity that enables the IoT edge device to connect and exchange data with other devices, including but not limited to other IoT edge devices. As such, the sensors disclosed herein are non-limiting examples of IoT edge devices associated with the use of embodiments of the present invention.

[0025] Continue to refer Figure 1 , any number of arrays may be used, and thus, the exemplary system 200 includes additional arrays that may include a sensor array 204 having one or more sensors 204a…204n, one, some, or all of which may be IoT sensors. IoT sensors may alternatively be referred to as IoT edge sensors, and include, but are not limited to, sensors, actuators, or any other device that generates information and / or responds to commands that control the environment in which they are located. As used herein, the term sensor includes sensors (such as those examples listed immediately below) and alarms, and sensors within the scope of the present invention may operate automatically and / or may be manually activated. In general, the type, number, location, and combination of sensors may be based on considerations including, but not limited to, the type(s) of threats most likely to be encountered and the proximity of potential threat sources to the data center, and the amount of time required to implement one or more preemptive actions once a threat is identified.

[0026] IoT sensors that may be used in conjunction with embodiments of the present invention include, but are not limited to, fire and smoke detectors, gas detectors, leak and flood detectors, hygrometers, thermometers, seismometers, motion detectors, security cameras with automatic motion / threat detectors, burglar alarms, voltage and current detectors, pressure sensors, airflow meters, noise detectors, and chemical detectors and sensors. Other IoT sensors within the scope of the present invention may be manually activated, such as a manually activated fire alarm, or an intruder alarm or panic button as another example. The foregoing and / or other IoT sensors may be used in any combination, type, and quantity.

[0027] Continue to refer Figure 1 , system 200 may optionally include one or more gateways, such as gateway 206 and gateway 208. Any number "n" of gateways may be used. In general, a gateway refers to a system and / or device configured to consolidate the communication and management of multiple edge devices (e.g., sensors in IoT sensor arrays 202 and 204). A gateway may be used, for example, where the edge device networking capabilities are local in nature (whether in terms of power and / or connectivity) and the edge device uses the gateway to connect to the Internet and / or another communication network.

[0028] As shown, a gateway may be dedicated to a particular array or group of sensors, although this is not required. In the example shown, sensor array 202 communicates via gateway 206 , while sensor array 204 communicates via gateway 208 . Figure 2 Any connection between the elements shown can be a wireless or hardwired connection. Also as indicated, gateways (e.g., gateway 206 and gateway 208) can be said to correspond to corresponding layers, such as layer 1 and layer "n". These layers can be layers in a communication configuration. In addition, a gateway in the highest layer in the communication configuration (e.g., gateway 208) can communicate with one or more other gateways (e.g., gateway 206) in a lower layer. Likewise, the gateways can be arranged in series with each other, although this is not necessary, and parallel gateway arrangements can also be used. In the exemplary configuration shown, layer "n" gateway 208 merges all communications from the lower layers (e.g., layer 1).

[0029] like Figure 1As further indicated in , the data storage functionality associated with the system 200 can be implemented by a data center 300, which can be a cloud data center, although this is not required. The data center 300 may include a memory 400, which may include or be composed of one or more time series databases (DBs) and / or data lake configurations, one or both of which may also be elements of the data center. In general, the memory 400 includes any system and / or component that is operable to store data in a high-resolution time series and respond to read and write requests. In more detail, the memory 400 can be used to save the data after at least some of the input data from the sensors in the IoT sensor arrays 202 and 204 have been processed by a processing server 500 that is capable of communicating with the memory 400. As described herein, the sensors in the IoT sensor arrays 202 and 204 may also store data.

[0030] In general, the processing server 500 and / or other components may be programmed to receive sensor input in the form of data (e.g., via one or more gateways) and perform processing and / or analysis on the sensor data. That is, the raw data provided by the sensors may be received and processed by the processing server 500. The processing server 500 may, but need not, be an element of the data center 300.

[0031] In general, and as discussed in more detail elsewhere herein, processing server 500 may be operable to sample and / or reconstruct data streams at a high resolution, or at the highest resolution possible. Such reconstruction may involve, among other things, accessing data stored in an IoT sensor array, and accessing data stored in one or more time series databases. In some embodiments, data stream reconstruction and / or data stream sampling may be performed by an entity other than processing server 500 or an entity that collaborates with processing server 500. For example, data stream reconstruction and / or data stream sampling may be performed by processing server 500 and memory 400 in collaboration.

[0032] B. Example Host and Server Configuration

[0033] Now briefly refer to Figure 2 , any one or more of the IoT edge devices 202a ... 202n, 204a ... 204n, gateway 206, gateway 208, data center 300, storage 400, and processing server 500 may take the form of a physical computing device, or include a physical computing device, an example of which is represented by 600. Similarly, in the case where any of the above elements includes a virtual machine (VM) or is composed of a virtual machine (VM), the VM may constitute Figure 3 Virtualization of any combination of physical components disclosed in.

[0034] exist Figure 2 In the example of , the physical computing device 600 includes a memory 602, which may include a random access memory (RAM), a non-volatile random access memory (NVRAM) 604, a read-only memory (ROM), and a permanent memory, one or more hardware processors 606, a non-transitory storage medium 608, an I / O device 610, and one, some, or all of a data memory 612. One or more of the memory components of the physical computing device may take the form of a solid-state device (SSD) memory. Similarly, one or more applications 614 including executable instructions are provided. Such executable instructions may take various forms, including, for example, instructions that can be executed by the processing server 500 to reconstruct a high-resolution data stream.

[0035] C. Time Series Databases and Related Operations and Data Aspects

[0036] Continue to refer Figure 1 In an example, the memory 400, which may take the form of or include one or more time series databases, may maintain a certain amount of raw data at the highest resolution over a period of time (e.g., several days). In order to best use the storage space in the time series database of the memory 400, the processing server 500 may use various data parsing operators to prune, i.e., delete older data and / or reduce the size of older data, such as by downsampling, reducing the number of bits per sample, and / or increasing the image compression rate. This process (including downsampling) is a specific example of a reduction process.

[0037] Typically, the reduction of old data reflects the convention that the most recent data is the most important data and should therefore be retained at the highest possible resolution. However, it is often the case that older data at a lower resolution may be useful. For example, older data may be used for forensics after an event of significant significance is discovered to have occurred or initiated in the past. Depending on the IoT application, such events may be, for example, equipment failures, code problems, medical events, extreme weather conditions. Older data may also be used to retrain machine learning applications after it is discovered after the fact that an event was not what was originally thought. As used herein, forensics refers to the examination of stored data and / or associated data storage media to identify, preserve, recover, and analyze the data and / or associated data storage media.

[0038] In more detail, a time series database is configured to store events or data provided to the time series database in chronological order based on increasing time. Such functionality is useful, for example, in situations where a query needs to be performed to determine when one event occurred relative to another event. Thus, the chronology of events may be relative, rather than absolute (in which case event times are determined relative to a common clock), although either / both of these chronologies may be reflected in the stored data. The time intervals between events may be constant and / or may vary. The time series database may include or have access to a table that cross-references events with their respective timestamps, wherein the timestamp may indicate the time at which a particular event involving the data occurred and / or when the event / data was stored in the time series database.

[0039] At some point, the time series database will fill up, resulting in the need to scale down so that new data can continue to be saved without exceeding the storage capacity of the time series database. In general, downsampling, as an example of downscaling, may involve implementing one or more changes to the ratio at which different portions of a data stream are stored in the time series database.

[0040] To illustrate, an aircraft jet engine may have approximately 100K sensors, each generating data that is desired to be retained. Because the associated database has a limited capacity, different sampling rates may be applied to the data stream to ensure that useful data is still collected, but not too much data is collected to reach the database capacity. Therefore, the first portion of the jet engine data stream may be sampled, that is, the data from the first portion of the data stream may be saved in the time series database once per second. The second portion of the data stream received later in time than the first portion in the database may be sampled once every 10 seconds, and the third portion of the data stream received after the second portion in the database may be sampled only once per minute. In this way, the data from the jet engine will continue to be sampled, but not all at high resolution, because doing so would quickly exhaust the capacity of the database.

[0041] It will be apparent from this example that the resolution of the sampled data decreases from the maximum value in the first portion to the minimum value in the third portion. Each portion of the data may reflect a particular time period. For example, the first portion of the data may be data arriving within the initial one minute time period, while the second portion may be data arriving within the next five minutes, and the third portion may be data arriving between the 5th and 10th minutes.

[0042] The available storage capacity of the time series database, along with parameters such as sampling rate and sampling schedule, can be used to define the sampling and storage strategy for the data stream. The storage strategy can, but does not have to, be calculated to ensure that at least high-resolution data is stored in the time series database. The storage strategy can also reflect, for example, a first-in, first-out (FIFO) retention policy to help ensure that only recent data is retained in the database.

[0043] When new data enters the time series database, it can replace older data, and the older data can be backed up to another database / location. Therefore, at least in some cases, the time series database can maintain relatively high-resolution data of the data stream, such as the most recent 1 minute of data in the above example, while the lower-resolution data of the data stream is stored elsewhere. Regardless of the sampling rate or sampling interval, all data in the data stream can be saved even if it is not sampled, although the saved data can be scattered in various different entities and / or storage locations, all of which can be collectively referred to as data sources in this article. For example, even if one or more parts of the data stream are not sampled, such as due to a defined sampling interval, so that these parts do not exist in the time series database, these parts are still backed up. In this way, unsampled data can be restored from these data sources and used for the reconstruction of high-resolution data streams. Finally, it should be noted that the various parts of the data stream can have different corresponding resolutions, which reflect the (one or more) sampling rates associated with each of these parts.

[0044] D. Data Flow Reconstruction and Methodological Aspects

[0045] In view of the foregoing discussion, attention is now turned to the discussion of various aspects of data stream reconstruction and related methods. In general, embodiments of the present invention can be used to restore information in a high-resolution form by coordinating information or data generated by various sources and / or stored in various locations and stitching them together. Various data portions may have different corresponding resolutions. Data for reconstructing high-resolution data streams can be obtained from any of a variety of different sources, including, for example, a time series database that maintains data stream information, any IoT device and / or gateway that can still maintain relevant data, a DB backend data protection system, and an IoT device data protection system. The data stored in these sources can be used to reconstruct old data at full resolution for forensics, troubleshooting, and other situations. Embodiments of the present invention are not limited to any particular certain time series DB implementations or data protection applications.

[0046] Initially, various preparations may be made prior to the data stream reconstruction process. For example, to facilitate automatic reconstruction of high-resolution data streams, the data backup system should be accessible for program access. Lacking such access, manual or semi-manual operations may need to be performed. Therefore, simplicity and recovery time may be improved by providing such program access.

[0047] Likewise, it is desirable that time series database backups include information about the data time intervals for the backups of high resolution data in the metadata associated with those backups. The order of data within a data time interval may be shown or derived from, for example, a timestamp associated with the backed up data. To illustrate, a data time interval may define a time period during which the data of interest is backed up. Thus, a data time interval of two days may mean that all backed up data within a time period of two days back from a particular date / time of interest is to be retrieved and reconstructed. As another example, a data time interval may end at the most recent data and extend as far back in time as desired. More generally, a data time interval may have any start date and any end date. A data time interval may be defined independently of where the data contained in the data time interval is stored and independently of the resolution of the data contained in the data time interval.

[0048] Typically, high-resolution data exists around the time of the backup creation date. If no interval metadata exists, this information can be reconstructed by restoring the backup to the location being queried or by analyzing the backup data itself. Once such analysis occurs, the results of the analysis (i.e., the identification of the interval metadata) can be stored in the metadata for future restores.

[0049] As described herein, some of the data used in the reconstruction of the high-resolution data stream may be present on one or more IoT devices. Thus, the IoT device may have an interface added to it to allow external parties to query any data present on the device. The inclusion of an interface is not required, but allows the IoT device to be used as an additional data source for the data stream reconstruction process. Typically, the backup copy of the IoT device data may include metadata, such as the metadata described above in conjunction with the time series database.

[0050] Combined with the following Figure 3The discussion of provides details regarding a specific exemplary process for data stream reconstruction (also referred to herein simply as "reconstruction"), however, a brief general discussion is provided here by way of introduction. In general, the data stream reconstruction process can begin when a time interval of data to be retrieved is defined. As previously described, in one illustrative example, the data time interval can be up to the most recent data and can be traced back in time as far as necessary. The data time interval can also be defined based on the backups performed, i.e., the relative time position of one backup relative to the time position of another backup. For example, the data time interval may extend from the most recent backup of the data to the earlier of two previous backups of the data, regardless of the actual time at which either of those backups occurred.

[0051] A property of a time series database (also referred to as a stream database, such as those disclosed herein) is that each entry is unique through metadata, which can be added during storage or backup, and is, for example, an ID or timestamp. The metadata can be used to determine which time interval of data backed up is the high-resolution portion. Other backups or portions of the data, sorted by timestamp or other data, can then be added to the high-resolution portion in sequence based on their corresponding time intervals.

[0052] Therefore, during the data stream reconstruction process, overlapping data between the sources of the stored data can be easily resolved, and the insert operation is idempotent, so even overlaps will not cause problems. Typically, the reconstruction of the data stream is performed by reinserting the backed-up data into the stream DB. Note that the data retrieved from the database or database backup can already be fully time-synchronized.

[0053] Data retrieved from the IoT device or its backup can be inserted into the data stream of the database based on the timestamp when the sample data was obtained. Reconstruction does not need to be performed on all data in the database. For example, in some embodiments, reconstruction can be performed on a subset of the data stream whose data is partially or completely stored in the database.

[0054] In some embodiments, the data sources storing data available in the reconstruction of the data stream may be accessed in a particular order, although this is not required, and in other embodiments, the order in which the data sources are accessed may be arbitrary. In one exemplary but non-limiting embodiment, the data sources may be accessed as follows: first, the active time series DB; second, data in (one or more) IoT devices, which may store data that has not yet been sent (i.e., data that has not yet been backed up) to the backend DB; third, DB backups from the newest to the oldest; and fourth, IoT device backups from the newest (most recent) to the oldest (least recent). In this example, the ordering of the backups may be specified based on the need to provide cost / speed optimization when reconstructing a high-resolution data stream, because older backups may be relatively difficult to retrieve compared to newer backups, and / or older backups may take relatively longer to retrieve compared to newer backups. Additional or alternative criteria may be used as a basis for determining the order in which to access backups for reconstructing a high-resolution data stream.

[0055] Follow now Figure 3 , details of some exemplary methods for reconstructing a data stream (e.g., a high-resolution data stream) are provided, one example of which is generally indicated at 700. In general, the exemplary method (e.g., method 700) may be performed in whole or in part by and / or at a processing server. In other embodiments, the method (e.g., method 700) may be performed in whole or in part by and / or at a time series database. In other embodiments, the method (e.g., method 700) may be performed in whole or in part by and / or at a time series database. In other embodiments, the method (e.g., method 700) may be performed in whole or in part by and / or collaboratively at a time series database and a processing server. As such, it will be understood that Figure 3 The distribution of functionality disclosed in is provided by way of example only, and these functionality, as well as other functionality disclosed herein, may be distributed among or across the disclosed systems and devices in any other suitable manner.

[0056] like Figure 3 As shown in the example of , method 700 can begin when creating 702 an empty reconstruction stream database. The empty reconstruction stream database can exist in a memory at a cloud data center, locally at a client location, and / or in any other location. The creation 702 of the empty reconstruction stream database can be initiated by a user (e.g., an administrator) using an interface (e.g., a graphical user interface (GUI) or a command line interface (CLI) located at a processing server). In some embodiments, the creation of the empty reconstruction stream database can occur automatically in response to the occurrence of an event, examples of which include data spikes, operational errors, or any other problems related to the system, components, and / or operating environment. The empty reconstruction stream database can correspond to a specific discrete data stream, or can be temporarily defined.

[0057] Next, a data time interval and an associated data source are identified 704. As disclosed herein, in some embodiments, a data time interval may be a time period during which a portion of a high-resolution data stream is desired to be reconstructed, which portion may be, for example, a portion or all of an associated data stream originally created by an IoT device. As such, the data time interval defines the limits of the high-resolution data stream to be reconstructed, and the data time interval may correspond to a particular discrete data stream, or may be temporarily defined. The data time interval may span a time period during which a problem or other event occurs, which may, for example, be associated with or detected by an IoT edge sensor or other device.

[0058] The data time interval may be manually specified by a user, or may also be automatically specified, for example, by a processing server. In conjunction with the identification of the data time interval, (one or more) data sources for data stored or backed up during the data time interval are identified (704). Examples of data sources include, but are not limited to, IoT edge devices and time series databases.

[0059] A check 705 may be performed to determine if there are any other data sources to be identified. If not, the method 700 may proceed to 716 and stop. On the other hand, if the check 705 reveals that there are any remaining data sources to be identified, the method 700 proceeds to 706.

[0060] In particular, when a data time interval is specified and the associated data sources are known, data corresponding to these data sources for the specified data time interval can be read 706. As described herein, when stored / backed up, the data can be date stamped or otherwise uniquely identified with some type of metadata so that when the data is read 706, even if the data is stored in multiple sources, the associated time order of each piece of data relative to other data in the data stream will be apparent.

[0061] As needed / if desired, the timestamps assigned by the data sources may be aligned to match the reconstruction 708, ie, the data may be aligned in chronological order. After the data is sorted 708, the data may then be inserted 710 into the reconstruction stream database.

[0062] In some embodiments, the process 704 ... 710 may be repeated for each data source. Thus, one or more checks 712 may be performed in which it is determined whether the high-resolution data stream has been completely reconstructed such that there are no remaining data sources associated with the data time interval from which the stored data has not been retrieved. If the high-resolution data stream has not been completely reconstructed, the method 700 returns to 705. On the other hand, if the high-resolution data stream has been completely reconstructed, the method 700 proceeds to 714, indicating that the high-resolution data stream is complete. The method 700 then ends at 716.

[0063] When the method 700 is complete, the reconstructed high-resolution data stream may then be accessed and various forensic, analytical, and / or other processing performed 718 on the data in the high-resolution data stream. Problems identified as a result of the analytical or other process may then be identified and resolved 720.

[0064] As indicated by exemplary method 700, the exemplary systems and methods disclosed herein operate to reconstruct time series data at the highest possible resolution by combining data from multiple data sources that are currently inaccessible, decorating the data with metadata, and aligning data timestamps, even when the time series database no longer contains some or all of the defined data associated with the reconstructed stream. The data of the high-resolution data stream can be used, for example, for forensics, scene reconstruction, and testing.

[0065] F. Exemplary Computing Devices and Associated Media

[0066] As discussed in more detail below, embodiments disclosed herein may include the use of a special or general purpose computer including various computer hardware or software modules. The computer may include a processor and a computer storage medium carrying instructions that, when executed by the processor and / or caused to be executed by the processor, perform any one or more of the methods disclosed herein.

[0067] As described above, embodiments within the scope of the present invention also include computer storage media, which are physical media for carrying or having computer executable instructions or data structures stored thereon. Such computer storage media can be any available physical media accessible by general or special purpose computers.

[0068] By way of example and not limitation, such computer storage media may include hardware memory, such as solid state disks / devices (SSDs), RAM, ROM, EEPROM, CD-ROMs, flash memory, phase change memory (“PCM”) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other hardware storage device that can be used to store program code in the form of computer-executable instructions or data structures that can be accessed and executed by a general or special purpose computer system to implement the functionality of the disclosed invention. Combinations of the above are also intended to be included within the scope of computer storage media. Such media are also examples of non-transitory storage media, and non-transitory storage media also include cloud-based storage systems and structures, although the scope of the invention is not limited to these examples of non-transitory storage media.

[0069] Computer executable instructions include, for example, instructions and data that cause a general-purpose computer, a special-purpose computer, or a special-purpose processing device to perform certain functions or groups of functions. Although the subject matter has been described in language specific to structural features and / or methodological actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions disclosed herein are disclosed as exemplary forms of implementing the claims.

[0070] As used herein, the term "module" or "component" may refer to a software object or routine executed on a computing system. The different components, modules, engines, and services described herein may be implemented as objects or processes executed on a computing system, for example, as separate threads. Although the systems and methods described herein may be implemented in software, it is possible and contemplated to implement them in hardware or a combination of software and hardware. In the present invention, a "computing entity" may be any computing system as previously defined herein, or may be any module or combination of modules running on a computing system.

[0071] In at least some cases, a hardware processor is provided that is operable to execute executable instructions for performing a method or process, such as the methods and processes disclosed herein. The hardware processor may or may not include other hardware elements, such as the computing devices and systems disclosed herein.

[0072] In terms of computing environment, embodiments of the present invention may be performed in a client-server environment (whether in a network environment or a local environment), or in any other suitable environment. Suitable operating environments for at least some embodiments of the present invention include cloud computing environments in which one or more of the client, server, or other machines may exist and operate in a cloud environment.

[0073] The present invention may be embodied in other specific forms without departing from the spirit or essential characteristics of the present invention. The described embodiments should be considered in all respects only as illustrative and not restrictive. Therefore, the scope of the present invention is indicated by the appended claims rather than the preceding description. All changes falling within the equivalent meaning and scope of the claims should be included within their scope.

Claims

1. A method comprising: identifying a data time interval, wherein the data time interval defines a set of limits for data resolution; identifying a data source storing data during the data time interval, wherein the data is associated with a corresponding time stamp falling within the data time interval, the data includes a first portion of the data having a first resolution, and the data includes a second portion of the data having a second resolution less than the first resolution, wherein the first portion of the data is received and stored prior to receiving and storing the second portion of the data, and wherein the first storage ratio and the second storage ratio are based in part on a target resolution of a data stream to be reconstructed using the first portion of the data and the second portion of the data; Read the data from the data source; performing a portion of a full data stream reconstruction process by sorting the read data according to their corresponding timestamps, inserting the sorted data into an empty reconstructed stream database, and combining the inserted data from the data source with corresponding data read from one or more other data sources to create at least a portion of the full data stream having the target resolution, the target resolution being higher than a resolution of the second portion of the data; Checking whether the full data stream has been reconstructed; When it is determined that the full data stream is reconstructed, processing data of the full data stream; and Based on the processing of the data, issues related to the operating environment in which the data was originally generated are identified and resolved.

2. The method according to claim 1, wherein: The data source and / or one of the other data sources is an IoT edge device including a sensor.

3. The method according to claim 1, wherein: The resolution of the full data stream is full resolution.

4. The method according to claim 1, wherein: Checking whether the full data stream has been reconstructed comprises determining whether the full data stream has been completely reconstructed such that there are no remaining data sources from which data stored during the time interval has not been read out and combined into the full data stream.

5. The method according to claim 1, wherein: The first storage ratio and the second storage ratio are also based in part on a storage capacity of the data source.

6. The method according to claim 1, wherein: Depending on the data time interval, first data of the full data stream are stored during the data time interval at a higher resolution than a subsequent portion of the full data stream stored later within the data time interval.

7. The method according to claim 1, wherein: The data is retrieved from the data source in a specific order of the data source.

8. The method according to claim 1, wherein: The data stored in the data source is generated by the data source.

9. The method according to claim 1, wherein: Retrieving data from the data sources in the following order from earliest to latest: an active time series database; an IoT device; one or more database backups from latest to oldest; And one or more IoT device backups from newest to oldest.

10. The method according to claim 1, wherein: One of the data sources is a time series database, and data stored in the time series database is relatively newer than data stored in the other data sources.

11. A non-transitory storage medium having computer executable instructions stored therein, the computer executable instructions, when executed by one or more hardware processors, performing the following operations: Identify the data time interval, where The data time interval defines a set of limits on data resolution; identifying a data source storing data during the data time interval, wherein the data is associated with a corresponding time stamp falling within the data time interval, the data includes a first portion of the data having a first resolution, and the data includes a second portion of the data having a second resolution less than the first resolution, wherein the first portion of the data is received and stored prior to receiving and storing the second portion of the data, and wherein the first storage ratio and the second storage ratio are based in part on a target resolution of a data stream to be reconstructed using the first portion of the data and the second portion of the data; Read the data from the data source; performing a portion of a full data stream reconstruction process by sorting the read data according to their corresponding timestamps, inserting the sorted data into an empty reconstructed stream database, and combining the inserted data from the data source with corresponding data read from one or more other data sources to create at least a portion of the full data stream having the target resolution, the target resolution being higher than a resolution of the second portion of the data; Checking whether the full data stream has been reconstructed; When it is determined that the full data stream is reconstructed, processing data of the full data stream; and Based on the processing of the data, issues related to the operating environment in which the data was originally generated are identified and resolved.

12. The non-transitory storage medium according to claim 11, wherein: The data source and / or one of the other data sources is an IoT edge device including a sensor.

13. The non-transitory storage medium according to claim 11, wherein: The resolution of the full data stream is full resolution.

14. The non-transitory storage medium according to claim 11, wherein: Checking whether the full data stream has been reconstructed comprises determining whether the full data stream has been completely reconstructed such that there are no remaining data sources from which data stored during the time interval has not been read out and combined into the full data stream.

15. The non-transitory storage medium according to claim 11, wherein: The first storage ratio and the second storage ratio are also based in part on a storage capacity of the data source.

16. The non-transitory storage medium according to claim 11, wherein: Depending on the data time interval, first data of the full data stream are stored during the data time interval at a higher resolution than a subsequent portion of the full data stream stored later within the data time interval.

17. The non-transitory storage medium according to claim 11, wherein: The data is retrieved from the data source in a specific order of the data source.

18. The non-transitory storage medium according to claim 11, wherein: The data stored in the data source is generated by the data source.

19. The non-transitory storage medium according to claim 11, wherein: Retrieving data from the data sources in the following order from earliest to latest: an active time series database; an IoT device; one or more database backups from latest to oldest; And one or more IoT device backups from newest to oldest.

20. The non-transitory storage medium according to claim 11, wherein: One of the data sources is a time series database, and data stored in the time series database is relatively newer than data stored in the other data sources.

Images