Unsupervised segmentation of univariate time series datasets using motifs and shapers

Abstract

Embodiments of the present disclosure relate to unsupervised segmentation of univariate time series data sets using motifs and shapers. Systems and methods are provided for receiving a time series data set from a monitored processor and grouping the data set into a plurality of clusters. Using an unsupervised machine learning model, the system may combine subsets of the plurality of clusters by data signature similarity to form a plurality of motifs, and combine the plurality of motifs into one or more shapers. In some examples, the system may train a supervised machine learning model using the plurality of motifs and the one or more shapers as inputs to the supervised machine learning model. The system may perform various actions in response to the labeled time series data set, including predicting a second time series data set, determining that the monitored processor corresponds to overutilization at a particular time, or recommending reducing excess utilization of the monitored processor.

Description

Background Art

[0001] As computer systems increase in complexity, size, and processing power, the processes performed by these computer systems continue to grow. Monitoring systems are becoming increasingly popular in an attempt to manage the applications performed by computer systems and improve the overall efficiency of computer systems. However, this is a difficult task. The rate at which data is created is increasing, making it difficult to review. When review of the data is passed to a third party, the third party receiving the data may not have access to all environmental data at the computer system. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] According to one or more different embodiments, the present disclosure will be described in detail with reference to the following drawings. The drawings are provided for illustration purposes only and merely depict typical or example embodiments.

[0003] Figure 1 An action tagging computer system, a monitored processor, and a user device according to some examples of the present disclosure are shown.

[0004] Figure 2 Examples of time series data according to some examples of the present disclosure are provided.

[0005] Figure 3 Examples of minimum and maximum values ​​of time series data according to some examples of the present disclosure are provided.

[0006] Figure 4 Examples of time series data with identified outliers are provided according to some examples of the present disclosure.

[0007] Figure 5 Examples of time series data with identified clusters according to some examples of the present disclosure are provided.

[0008] Figure 6 A process for generating one or more clustering data according to some examples of the present disclosure is presented.

[0009] Figure 7 are example computing components that can be used to implement various features of the embodiments described in this disclosure.

[0010] Figure 8 Depicted is a block diagram of an example computer system in which various embodiments described herein may be implemented.

[0011] The drawings are not exhaustive and do not limit the disclosure to the precise forms disclosed. DETAILED DESCRIPTION

[0012] Sensor data, unlike other structured data from servers, is time-series in nature and presents the challenge of comprising a large volume of data that humans have little ability to comprehend. As a result, data center administrators are unable to read and understand this data. In addition to data center administrators, analytics teams face the same challenges when trying to perform analysis on unprocessed time series. Hence, there is a need to find solutions that can help identify areas of interest, recurring patterns, anomalies, and trends in time series datasets.

[0013] For example, a simple time series data set may include data points corresponding to the central processing unit (CPU) utilization (e.g., in GHz) of a personal computer, where the CPU utilization is recorded every second of every day. When the time series data set is plotted on a graph mapping time (X-axis) to utilization (Y-axis), the graph can show spikes or drops in CPU utilization over time. In other words, an application may be executed (e.g., a spike in CPU utilization) or the CPU may remain idle (e.g., a drop in CPU utilization) regardless of the current CPU utilization value. When a new application is executed, the CPU of the personal computer may respond by running the new application more slowly, resulting in generally inefficient use of the personal computer. In this example, the time series data set can be analyzed to provide a general understanding of how the CPU is utilized over a period of time (e.g., over a full day or month).

[0014] Continuing with this simplified example, a time series data set may be provided to a second computer. The second computer may analyze the time series data set to determine a pattern of CPU utilization over time in the time series data set. The second computer may then associate the pattern with a data signature of an application executed by the CPU. In this sense, the second computer may determine the timing and repeatability of a special purpose program when executed by the CPU without having access to a list of applications, the timing of the special purpose program when executed, or even specific components of the computer system associated with the CPU.

[0015] Expanding on this simplified example, the CPU may be part of a monitored distributed system having several monitored processors, and the second computer may be a system for optimizing the operation of the monitored processors. The time series data set may include information from the monitored processors other than (or in addition to) CPU utilization, including any time series data set corresponding to the use of sensors in conjunction with the monitored processors. The system may receive the time series data set from a sensor (e.g., a sensor, a sensor cluster, a monitored computer, etc.) of the monitored processor. The data may include a univariate time series data set.

[0016] To facilitate analysis of the time series data set of the monitored processor and optimize the use of the monitored system, the system can group the time series data set into multiple clusters. For example, a set of five time series data entries may correspond to the execution of a single application at the beginning of each hour throughout the day (e.g., corresponding to an automatic system check process). Each of these activations may cause a spike in the CPU utilization of the monitored processor. The system can identify spike patterns in the time series data set and group each spike in the data set into a cluster that corresponds to the same activity at the monitored processor. The time series data set can correspond to multiple of these clusters across several time intervals.

[0017] The system may further identify similarities across multiple clusters and combine subsets of multiple clusters by data signature similarity to form multiple motifs. The identified similarities across multiple clusters can be determined using various methods. For example, the system can implement an unsupervised machine learning model that is trained to identify similar data signatures in each cluster and match data signatures between clusters to form multiple motifs. In this sense, the system can extract motifs from a univariate time series dataset (e.g., using a custom K-means algorithm or other clustering algorithm for extraction). The extraction can identify and cluster similar data patterns in a univariate time series dataset and output motifs (e.g., representing repeated patterns and subsequences).

[0018] Next, the process can group motifs into shapelets (e.g., combinations of motifs). That is, a dynamic time warping algorithm can be used to compare motifs with other motifs to find the closest match that includes the motif. Motifs can be combined to form shapelets. Any anomalies in the processed data set relative to a motif or shapelet can be identified as an anomaly in the data as a whole.

[0019] Using multiple levels of grouped data, the system can use multiple motifs or shape sub-predictions for a second time series dataset. In a sense, both motifs or shape sub-predictions can be used as labels to help characterize related data that can be applied in an automatic and unsupervised manner without the need for manual annotation.

[0020] In some examples, the system can initiate an action based on the prediction of the second time series data set. For example, the action can include determining that the monitored processor corresponds to overutilization at a particular time and sending an electronic communication to an account associated with the monitored processor. The electronic communication can recommend reducing the additional utilization of the monitored processor after the particular time. In another example, the action can include determining that the monitored processor corresponds to overutilization at a particular time and sending an electronic communication to an account associated with a monitored processor different from the monitored processor. The electronic communication can include a prediction of overutilization for a different monitored processor. In another example, the action can include a prediction of a next plurality of motifs (e.g., using a trained machine learning model).

[0021] Technical improvements are implemented throughout the present disclosure. For example, the disclosed techniques can utilize underutilized processor data of a monitored processor to initiate actions on the monitored processor, including reducing excess utilization, predicting that overutilization may occur in the future, or other actions discussed herein. By predicting these future outcomes, the system can adjust operations to prevent the predicted inefficiencies from occurring in the future.

[0022] Figure 1 Computer systems, monitored processors, and user devices according to some examples of the present disclosure are shown. In this example, the computer system is shown as a special-purpose computer system, labeled as an action tag computer system 100. The action tag computer system 100 is configured to interact with (multiple) monitored processors 130 using a processor 104, a memory 105, and a machine-readable storage medium 106. The (multiple) monitored processors 130 can interact with one or more user devices 132. The action tag computer system 100 can be implemented as a cloud system, a data center computer server, a service, etc., although such limitations are not required for every embodiment of the present disclosure.

[0023] The processor 104 may include a general or special purpose processing engine such as, for example, a microprocessor, a controller or other control logic. The processor 104 may be connected to a bus, although any communication medium may be used to facilitate interaction with other components of the scanning and 3D model generation user device 102, or to conduct external communications.

[0024] Memory 105 may include random access memory (RAM) or other dynamic storage for storing information and instructions to be executed by processor 104. Memory 105 may also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by processor 104. Memory 105 may also include read-only memory ("ROM") or other static storage device coupled to the bus for storing static information and instructions for processor 104.

[0025] The machine-readable storage medium 106 is configured as a storage device, which may include one or more interfaces, circuits, and modules for implementing the functionality discussed herein. The machine-readable storage medium 106 may carry one or more sequences of instructions to the one or more processors 104 for execution. Such instructions embodied on the machine-readable storage medium 106 may enable interaction with the monitored processor(s) 130 to perform features or functions of the disclosed technology discussed herein. For example, the interfaces, circuits, and modules of the machine-readable storage medium 106 may include, for example, a data processing component 108, a time series centroid component 110, a distance component 112, a clustering component 114, a detection component 116, and a monitored processor action component 118.

[0026] The data processing component 108 is configured to receive a time series data set and store the data in a time series data repository 120. The time series data set may be received from a sensor of a monitored processor 130 and include various data signatures at different times. In some examples, the data received from the monitored processor 130 is limited to data that a third party responsible for the monitored processor 130 is willing to provide. Therefore, when the time series data set is received, the complete data history or components of the data may not be available.

[0027] An illustrative example of a time series data set is provided. For example, the time series data set may correspond to a monitored processor 130 of input power to a server, where the input power is provided to the server and sampled in hours. Another example of a time series data set may correspond to processor utilization, as the processor is executing instructions of multiple software applications, such as a processor 130 that is used to execute ... Figure 2 As displayed.

[0028] The time series centroid component 110 is configured to determine each centroid of the data set in anticipation of grouping the data into a plurality of clusters. The centroids may be initialized using a variety of methods, including random selection (e.g., randomly selecting data points in the received data set), K-means clustering algorithm or K-means++ (e.g., by assigning each data point to the cluster with the closest mean rather than the minimum / maximum value), or by initializing the centroids with outliers in a custom K-means clustering algorithm.

[0029] In some examples, a clustering algorithm (e.g., a custom K-means algorithm) can be configured to analyze small subsets of a univariate time series dataset to find local minima and maxima for the subset of the time series dataset, which can then be associated with the closest centroid using a skewed Euclidean distance function. This creates a number of clusters, after which the positions of these closest centroids are calculated again until the data associated with the centroids no longer change, but remain consistent. These become the clusters that are analyzed to identify the motifs, shape sub-clusters, and ultimately anomalies described above.

[0030] The custom K-means clustering algorithm can take into account the linear manner in which the time series data set is recorded when determining each cluster centroid. In this sense, the time series centroid engine 110 can group data points that are close to each other in time, so they are more likely to be grouped with other readings from the same application, which are stored in the detected grouped data repository 122. Clusters can include centroids, outliers, and local maxima and local minima. Local maxima and local minima can be determined to isolate clusters into smaller clusters, where each smaller cluster can include a significant minimum or maximum point.

[0031] In order to find local minima and maxima on a very small subset of the time series data, the time series centroid engine 110 can use an outlier centroid initialization method. For example, first, the time series centroid engine 110 can assume that the number of recently discovered centroids is k. Next, each data point can be associated with the closest centroid (e.g., using a slanted Euclidean distance function). This will divide the data points into k clusters. With these clusters, the time series centroid engine 110 can then recalculate the position of the centroid using a slanted Euclidean distance function. Any of these steps can be repeated until there is no longer a change in the membership of the data point, including dividing the data point into k clusters and calculating the position of the centroid using a slanted Euclidean distance function. The time series centroid engine 110 can provide or output data points with cluster membership.

[0032] In some examples, as opposed to the standard K-means random centroid initialization method, the time series centroid engine 110 can determine the number of clusters in an automatic and dynamic process. The clusters may not be manually defined. In other words, the number of clusters can be based on the number of maximum and minimum points in the time series data. Figure 3 Illustrative examples of minimum and maximum values ​​are provided in .

[0033] In some examples, the minimum and maximum values ​​determined by the time series centroid engine 110 may correspond to actual values ​​from the time series data set. The centroid of the cluster may not be selected from values ​​not included with the data set (e.g., the mean or average). Instead, the minimum and maximum values ​​may correspond to actual data points received from the monitored processor 130.

[0034] The distance component 112 is configured to determine the distance between each of the data points and the centroid in the cluster relative to the time series constraint (e.g., along a linear time series). This can improve the standard distance function, which may not cluster the data points incorrectly with respect to the linear nature of the time series data.

[0035] The distance formula can determine that changes on the time axis (e.g., x-axis) are weighted less than the same changes on the performance indicator axis (e.g., y-axis), so that the data points can be clustered along the time axis. An example of the type of distance formula that can be used is:

[0036]

[0037] Where "4" may be replaced with an "n" value that is an even number and greater than or equal to 4. The value may be configured and customized by a user operating the user device 132. The value may be an exponential multiplier of the "y" portion of the formula that is typically set to a fractional value. As the fractional value is raised to a higher power "n", the "y" portion of the formula may become smaller. More weights may correspond to the x-axis, which corresponds to time values ​​and may group the time series data along a linear path.

[0038] The clustering engine 114 is configured to determine one or more clusters. For example, the clustering engine 114 may receive the local minima and maxima of a subset of the time series data set and the closest centroid (determined from the time series centroid engine 110). The two data sets may be associated to form multiple clusters, and then the location of the closest centroid may be calculated again until the calculated centroid no longer changes, but remains consistent. These become the clusters that are analyzed to identify motifs, shape sub-segments, and ultimately anomalies.

[0039] The detection engine 116 is configured to implement a dynamic time warping (DTW) process on the defined clusters to detect similarities between the clusters (e.g., in terms of data points that form a shape within each cluster) and generate one or more motifs. The DTW process can calculate the best match between two time series data sets by measuring the similarity between the two data sets along a linear time order. The best match can satisfy various constraints, including, for example, that each index from the first order must match one or more indexes from the other order, and vice versa, the first index from the first order must match the first index from the other order (but it is not necessarily its only match), the last index from the first order must match the last index from the other order (but it is not necessarily its only match), or the mapping of indices from the first order to indices from the other order must be monotonically increasing, and vice versa. The best match can also satisfy a minimum cost, where the cost is calculated as the sum of the absolute differences between the values ​​of each pair of matching indices.

[0040] The detection engine 116 is configured to also determine outliers. Figure 4 Examples of the motif determination process, shape subdetermination process, and outlier determination process are shown in .

[0041] The monitored processor action engine 118 is configured to initiate an action based on the prediction of the second time series data set. For example, the action may include determining that the monitored processor 130 corresponds to excessive utilization at a specific time and sending an electronic communication to an account associated with the monitored processor. The electronic communication may recommend reducing the excess utilization of the monitored processor after the specific time.

[0042] In another example, the action may include determining that a monitored processor corresponds to overutilization at a particular time and sending an electronic communication to an account associated with a monitored processor different from the monitored processor. The electronic communication may include a prediction of overutilization of the different monitored processor.

[0043] In another example, the action may include prediction of the next multiple motifs (eg, using a trained machine learning model).

[0044] Figure 2Some examples of time series data are provided according to the present disclosure. In example 200, the processor time of the monitored processor running three different applications during 15 seconds is identified, showing a first application 210 (e.g., antivirus scanning), a second application 220 (e.g., a web browser video), and a third application 230 (e.g., a notepad application). Each of the applications is run without overlapping processor time to show the differences between the signatures. In this example, applications 210, 220, and 230 are run independently, exclusively, and continuously to observe the differences in the time series signatures of each application.

[0045] Figure 3 Examples of minimum and maximum values ​​for time series data according to some examples of the present disclosure are provided. In example 300, an illustrative time series data set with an illustrative maximum data point 310 and an illustrative minimum data point 320 is provided. For example, at each instance where a point in the data set changes direction along a linear progression of the time series (e.g., progresses from increasing to decreasing, or from decreasing to increasing, etc.), a minimum point or a maximum point may be identified. In some examples, the time series centroid engine 110 is configured to store the minimum or maximum value in the time series data repository 120.

[0046] Figure 4 An example of time series data with identified outliers according to some examples of the present disclosure is provided. In example 400, the time series data is Figure 2 Example 200 is repeated, where processor time is determined for a monitored processor running three different applications during a 15 second period, including a first application 410 (e.g., antivirus scanning), a second application 420 (e.g., web browser video), and a third application 440 (e.g., notepad application). In addition, an outlier is identified between the second application and the third application, shown as outlier 430.

[0047] Figure 5 An example of time series data with identified clusters according to some examples of the present disclosure is provided. In example 500, time series data is analyzed and grouped into multiple clusters, where data signature similarity is used to form multiple motifs using an unsupervised machine learning model. Illustrative clusters are provided, shown as a first cluster 510 and a second cluster 520. These clusters can help create labeled time series data, where each cluster corresponds to a different label (e.g., a different application or data signature, etc.). A cluster similar to the first cluster 510 is identified as a third cluster 530, which has a similar data signature determined using an unsupervised machine learning model. The model can be trained to identify similar data signatures in each cluster and match the data signature.

[0048] In this case, each group of similar curves can generate a motif. As discussed herein, each motif can represent a recurring pattern and sub-sequence in the data points grouped into each cluster. Figure 4 As shown, a plurality of similarly shaped data points in the first application 410 (eg, antivirus scanning) are each motif of the data set. The plurality of motifs may be combined into a shape sub-shape, which may correspond to the entire data set corresponding to the first application 410.

[0049] Clusters can be formed using a variety of procedures, including Figure 6 , to implement a custom K-means clustering algorithm with outlier centroid initialization and skewed Euclidean distance function. In illustrative example 600, clustering engine 114 may perform one or more steps to determine a plurality of clusters.

[0050] At block 610, the inputs may include algorithm parameters, some of which may be operated by Figure 1 The input may include, for example, an input data point D, an order parameter θ, and a time component N to generate a data point having cluster membership.

[0051] At block 615, a time series data set may be received (eg, by the data processing component 108). The time series data set may be received from sensors of the monitored processor 130 and include various data features at different times.

[0052] At block 620, the data can be processed, including performing feature normalization on the time series data set. For example, feature normalization can scale individual data samples from the time series data set to have a common and consistent unit measurement.

[0053] At block 625, the data may be further processed, including implementing a scaler process on the time series data set. The scaler process may help improve wide variations in the data, to create small standard deviations of features and to preserve zero entries in sparse data.

[0054] At block 630, the clustering component 114 may use an outlier centroid initialization method to receive local minima and maxima to obtain centroids c1, c2, ... ck. Figure 1 The distance component 112 performs the process discussed above and may adjust sequential parameters to determine various centroids.

[0055] At block 640, for each data point x i , use the slanted Euclidean distance function to find the closest centroid (c1, c2, ... ck) and assign the point to that cluster. The slanted Euclidean distance function can include Figure 1 The distance formula discussed in distance component 112.

[0056] At block 650, blocks 630 and 640 are repeated with different values ​​of the order parameter θ and the time index N, and these groups of values ​​become clusters that are analyzed to identify motifs, shape sub-segments, and ultimately anomalies, and then stored in Figure 1 The detected group data is stored in the storage library 122.

[0057] It should be noted that the terms "optimize," "optimal," and the like as used herein may be used to refer to making or achieving as efficient or preferred performance as possible. However, as will be appreciated by those of ordinary skill in the art reading this document, preference may not always be achieved. Therefore, these terms may also include making or achieving the best or most efficient performance possible in a given situation, making or achieving better performance than can be achieved with other settings or parameters, or making or achieving better performance than a predefined threshold.

[0058] Figure 7 Example computational components that can be used to perform unsupervised segmentation of a univariate time series dataset using motifs and shape sub-models according to various embodiments are shown. Figure 7 , computing component 700 may be, for example, a server computer, a controller, or any other similar computing component capable of processing data. Figure 7 In the example embodiment of FIG. 7 , computing component 700 includes a hardware processor 702 , and a machine-readable storage medium for 704 .

[0059] The hardware processor 702 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in the machine-readable storage medium 704. The hardware processor 702 may retrieve, decode, and execute instructions, such as instructions 706-712, to control processes or operations for implementing a dynamically modular and customizable computing system. Alternatively or in addition to retrieving and executing instructions, the hardware processor 702 may include one or more electronic circuits including electronic components for performing the functions of one or more instructions, such as a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other electronic circuits.

[0060] A machine-readable storage medium, such as machine-readable storage medium 704, may be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. Thus, machine-readable storage medium 704 may be, for example, a random access memory (RAM), a non-volatile RAM (NVRAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, etc. In some embodiments, machine-readable storage medium 704 may be a non-transitory storage medium, where the term "non-transitory" does not include transient propagating signals. As described in detail below, machine-readable storage medium 704 may be encoded with executable instructions, for example, instructions 706-712.

[0061] The hardware processor 702 may execute instructions 706 to receive a time series data set. The time series data set may be received from a sensor of a monitored processor. For example, the time series data set may include various data signatures at different times. In some examples, the data received from the monitored processor is limited to data that a third party responsible for the monitored processor is willing to provide, and may be limited from a complete data history.

[0062] The hardware processor 702 may execute instructions 708 to generate the time series data set into clusters. For example, the method may group the time series data set into a plurality of clusters.

[0063] The hardware processor 702 may execute instructions 710 to combine subsets of clusters by data signature similarity to form motifs. For example, the method may combine subsets of multiple clusters by data signature similarity to form multiple motifs. In some examples, the method may determine each centroid of the data set in anticipation of grouping the data into multiple clusters.

[0064] Centroids can be initialized using a variety of methods, including a custom K-means clustering algorithm. The custom K-means clustering algorithm can consider the linear manner in which the time series data set is recorded when determining the centroid of each cluster. This method can initialize the centroid of each cluster with outliers to determine local maxima and local minima that correspond to actual values ​​from the time series data set. Through this, the time series data can be isolated into smaller cluster regions, where each smaller cluster can include a significant minimum or maximum point.

[0065] The method can also determine the distance between each of the data points and the centroid relative to a time series constraint (e.g., along a linear time series), which can help improve a standard distance function that may incorrectly cluster data points without regard to the linear nature of the time series data. The distance formula can determine that a change on a time axis (e.g., an x-axis) is weighted less than the same change on a performance metric axis (e.g., a y-axis), so that the data points can be clustered along the time axis (e.g., using a formula described herein).

[0066] The hardware processor 702 may execute instructions 712 to predict a second time series data set. The method may use a plurality of motifs to predict the second time series data set, for example, using a dynamic time warping (DTW) process on the defined clusters to detect similarities between clusters (e.g., in terms of the shapes that the data points form within each cluster). The DTW process may calculate the best match between the two time series data sets by measuring the similarity of the two data sets along a linear time series. The best match may also satisfy the minimum cost, where for each pair of matching indexes, the cost is calculated as the sum of the absolute differences between their values. Each group of similar curves may generate a motif that represents the repetitive patterns and sub-orders of the data points grouped into each cluster.

[0067] The hardware processor 702 may execute instructions 714 to initiate an action. For example, the method may initiate an action based on a prediction of a second time series data set. For example, the action may include determining that the monitored processor corresponds to overutilization at a particular time and sending an electronic communication to an account associated with the monitored processor, as well as a recommendation to reduce additional utilization of the monitored processor after the particular time. In another example, the action may include determining that the monitored processor corresponds to overutilization at a particular time and sending an electronic communication to an account associated with a monitored processor different from the monitored processor. In another example, the action may include a prediction of a next plurality of motifs (e.g., using a trained machine learning model).

[0068] Figure 8 A block diagram of an example computer system 800 is depicted in which various embodiments described herein may be implemented. The computer system 800 includes a bus 802 or other communication mechanism for communicating information, and one or more hardware processors 804 coupled to the bus 802 for processing information. The hardware processor(s) 804 may be, for example, one or more general purpose microprocessors.

[0069] The computer system 800 also includes a main memory 806, such as a random access memory (RAM), cache, and / or other dynamic storage device, coupled to the bus 802 for storing information and instructions to be executed by the processor 804. The main memory 806 may also be used for storing temporary variables or other intermediate information during the execution of instructions to be executed by the processor 804. Such instructions, when stored in a storage medium accessible to the processor 804, make the computer system 800 a special-purpose machine customized to perform the operations specified in the instructions.

[0070] The computer system 800 also includes a read only memory (ROM) 808 or other static storage device coupled to the bus 802 for storing static information and instructions for the processor 804. A storage device 810, such as a magnetic disk, optical disk, or USB thumb drive (flash drive), is provided and coupled to the bus 802 for storing information and instructions.

[0071] The computer system 800 may be coupled to a display 812, such as a liquid crystal display (LCD) (or touch screen), via the bus 802 for displaying information to a computer user. An input device 814, including alphanumeric and other keys, is coupled to the bus 802 for communicating information and command selections to the processor 804. Another type of user input device is a cursor control 816, such as a mouse, trackball, or cursor direction keys, for communicating direction information and command selections to the processor 804 and controlling movement of a cursor on the display 812. In some embodiments, the same direction information and command selections as a cursor control may be implemented via receiving touches on a touch screen without a cursor.

[0072] The computing system 800 may include a user interface module to implement a GUI, which may be stored in a mass storage device as executable software code executed by the computing device(s). This module and other modules may include, by way of example, components such as software components, object-oriented software components, class components and task components, processes, functions, properties, procedures, subroutines, program code segments, drivers, firmware, microcode, circuit systems, data, databases, data structures, tables, arrays, and variables.

[0073] In general, the words "component", "engine", "system", "database", "data storage", etc. used herein may refer to logic embodied in hardware or firmware, or to a collection of software instructions that may have entry and exit points, which are written in a programming language such as, for example, Java, C or C++. Software components can be compiled and linked into executable programs, installed in dynamic link libraries, or can be written in interpreted programming languages ​​such as, for example, BASIC, Perl or Python. It should be understood that software components can be called out from other components or themselves, and / or can be called in response to detected events or interrupts. Software components configured for execution on a computing device can be provided on a computer-readable or machine-readable storage medium, such as a compact disc, a digital video disc, a flash drive, a disk, or any other tangible medium, or as a digital download (and may be initially stored in a compressed or installable format that requires installation, decompression or decryption before execution). Such software code may be stored in part or in whole on a memory device of the executing computing device for execution by the computing device. Software instructions may be embedded in firmware, such as an EPROM. It will be further understood that hardware components may be composed of connected logic units, such as gates and flip-flops, and / or may be composed of programmable units, such as a programmable gate array or a processor.

[0074] The computer system 800 can implement the techniques described herein using custom hard-wired logic, one or more ASICs or FPGAs, firmware, and / or program logic that, in combination with the computer system, makes the computer system 800 a special purpose machine or programs it as a special purpose machine. According to one embodiment, the techniques herein are performed by the computer system 800 in response to the processor(s) 804 executing one or more sequences of one or more instructions contained in the main memory 806. Such instructions may be read into the main memory 806 from another storage medium such as the storage device 810. Executing the sequence of instructions contained in the main memory 806 causes the processor(s) 804 to perform the process steps described herein. In alternative embodiments, hard-wired circuits may be used in place of or in combination with software instructions.

[0075] As used herein, the term "non-transitory medium" and similar terms refer to any medium that stores data and / or instructions that cause a machine to operate in a specific manner. Such non-transitory media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 810. Volatile media include dynamic memory, such as main memory 806. Common forms of non-transitory media include, for example, floppy disks, flexible disks, hard disks, solid-state drives, magnetic tapes or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with a mold having holes, RAM, PROM and EPROM, Flash EPROM, NVRAM, any other storage chip or cartridge, and networked versions of these media.

[0076] Non-transient media are distinct from but may be used in conjunction with transmission media. Transmission media participate in the transfer of information between non-transient media. For example, transmission media include coaxial cables, copper wire, and optical fiber, including the wires that comprise bus 802. Transmission media may also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0077] Computer system 800 also includes a communication interface 818 coupled to bus 802. Communication interface 818 provides two-way data communication coupled to one or more network links connected to one or more local networks. For example, communication interface 818 can be an integrated services digital network (ISDN) card, a cable modem, a satellite modem or a modem to provide a data communication connection with a corresponding type of telephone line. As another example, communication interface 818 can be a local area network (LAN) card to provide a data communication connection with a compatible local area network (or a WAN component communicating with a WAN). Wireless links can also be implemented. In any such embodiment, communication interface 818 sends and receives electrical, electromagnetic or optical signals carrying digital data streams representing various types of information.

[0078] A network link typically provides data communication to other data devices through one or more networks. For example, a network link can provide a connection to a host computer or data equipment operated by an Internet Service Provider (ISP) through a local network. The ISP in turn provides data communication services through a worldwide packet data communication network now commonly referred to as the "Internet." Both the local network and the Internet use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks, as well as the signals on the network link and the signals through the communication interface 818, which carry digital data into and out of the computer system 800, are example forms of transmission media.

[0079] Computer system 800 can send messages and receive data, including program code, through the network(s), network links and communication interface 818. In the Internet example, a server may transmit the requested code for an application through the Internet, an ISP, a local network and communication interface 818.

[0080] The received code may be executed by processor 804 as it is received, and / or stored in storage device 810 or other non-volatile storage for later execution.

[0081] Each of the processes, methods and algorithms described above can be embodied in a code component executed by one or more computer systems or a computer processor including computer hardware, and fully or partially automated. The one or more computer systems or computer processors can also operate in a "cloud computing" environment or as a "software as a service" (SaaS) to support the execution of related operations. These processes and algorithms can be implemented in part or in whole in a dedicated circuit system. The various features and processes described above can be used independently of each other, or can be combined in various ways. Different combinations and sub-combinations are intended to fall within the scope of the present disclosure, and some methods or process blocks can be omitted in some embodiments. The methods and processes described herein are also not limited to any particular order, and the blocks or states associated therewith can be executed in other appropriate orders, or can be executed in parallel, or in some other way. Blocks or states can be added to or removed from the disclosed exemplary embodiments. The execution of certain operations or processes can be distributed between computer systems or computer processors, not only residing in a single machine, but also deployed across multiple machines.

[0082] As used herein, circuits can be implemented using any form of hardware, software or a combination thereof. For example, one or more processors, controllers, ASIC, PLA, PAL, CPLD, FPGA, logic components, software routines or other mechanisms may be implemented to form circuits. In an embodiment, the various circuits described herein may be implemented as discrete circuits, or the functions and features described may be partially or entirely shared in one or more circuits. Even if various features or functional elements may be individually described or claimed as separate circuits, these features and functions may be shared in one or more common circuits, and such descriptions should not require or imply the need for separate circuits to implement such features or functions. In the case where the circuit is implemented in whole or in part using software, such software may be implemented to operate together with a computing or processing system that can perform the functions described therein, such as computer system 800.

[0083] As used herein, the term "or" may be interpreted as inclusive or exclusive. In addition, the singular description of a resource, operation, or structure should not be understood to exclude the plural. Conditional language, such as, among others, "can," "could," "might," or "may," unless otherwise specifically stated or otherwise understood within the context of use, is generally intended to express that certain embodiments include, while other embodiments do not include, certain features, elements, and / or steps.

[0084] Terms and phrases used in this document, and variations thereof, unless expressly stated otherwise, should be construed as open ended and not restrictive. Adjectives such as "conventional," "traditional," "normal," "standard," "known," and the like, and terms of similar meaning should not be construed to limit the items described to those available in a given time period or as of a given time, but should be construed to include conventional, traditional, normal, or standard technology that may be available or known at any time now or in the future. In some cases, the presence of broad words and phrases such as "one or more," "at least," "but not limited to," or other similar phrases should not be construed to mean that a narrower situation is intended or required where such broad phrases may not be present.

Claims

1. A system comprising: one or more processors; as well as a machine-readable storage medium storing instructions that, when executed by the one or more processors, cause the system to: receiving a first time series data set from a sensor of a monitored processor; grouping the first time series data set into a plurality of clusters; combining subsets of the plurality of clusters by data signature similarity to form a plurality of motifs using an unsupervised machine learning model; combining the plurality of motifs into one or more shape sub-elements, wherein the one or more shape sub-elements correspond to similar data signatures across different times, wherein a same software application is executed at the monitored processor and the similar data signatures correspond to the same software application; training a supervised machine learning model using the plurality of motifs and the one or more shape sub-models as input to the supervised machine learning model; predicting a second time series dataset using the plurality of motifs; as well as Initiating an action based on the prediction of the second time series data set, wherein the action comprises: determining that the monitored processor corresponds to overutilization at a particular time; as well as An electronic communication is sent to an account associated with the monitored processor, wherein the electronic communication recommends reducing excess utilization of the monitored processor after the specified time. 2 . The system of claim 1 , wherein each of the plurality of clusters comprises a local minimum data point and a local maximum data point of the first time series data set.

3. The system according to claim 2, wherein the system is further configured to: A centroid of each of the plurality of clusters is determined using the local minimum data point and the local maximum data point for each of the plurality of clusters from the first time series data set. 4 . The system of claim 3 , wherein the determining of the centroid of each of the plurality of clusters uses a custom K-means clustering algorithm that takes into account a linear approach to the first time series data set.

5. The system of claim 1, wherein the actions include: An electronic communication is sent to an account associated with a monitored processor different from the monitored processor, wherein the electronic communication predicts overutilization of the different monitored processor.

6. The system of claim 1, wherein the system is further configured to: Feature normalization is performed on the first time series dataset to scale individual data samples from the first time series dataset to have a common and consistent unit measurement.

7. The system of claim 1, wherein the system is further configured to: A scaler process is implemented on the first time series dataset to create a small standard deviation of the features and retain zero entries in sparse data.

8. A computer-implemented method comprising: receiving a first time series data set from a sensor of a monitored processor; grouping the first time series data set into a plurality of clusters; combining subsets of the plurality of clusters by data signature similarity to form a plurality of motifs using an unsupervised machine learning model; combining the plurality of motifs into one or more shape sub-elements, wherein the one or more shape sub-elements correspond to similar data signatures across different times, wherein a same software application is executed at the monitored processor and the similar data signatures correspond to the same software application; training a supervised machine learning model using the plurality of motifs and the one or more shape sub-models as input to the supervised machine learning model; predicting a second time series dataset using the plurality of motifs; as well as Initiating an action based on the prediction of the second time series data set, wherein the action comprises: determining that the monitored processor corresponds to overutilization at a particular time; as well as An electronic communication is sent to an account associated with the monitored processor, wherein the electronic communication recommends reducing excess utilization of the monitored processor after the specified time. 9 . The method of claim 8 , wherein each of the plurality of clusters comprises a local minimum data point and a local maximum data point of the first time series data set.

10. The method of claim 9, wherein the system is further configured to: A centroid of each of the plurality of clusters is determined using the local minimum data point and the local maximum data point for each of the plurality of clusters from the first time series data set.

11. The method of claim 10, wherein the determining of the centroid of each of the plurality of clusters uses a custom K-means clustering algorithm that takes into account a linear approach to the first time series data set.

12. The method of claim 8, wherein the actions include: An electronic communication is sent to an account associated with a monitored processor different from the monitored processor, wherein the electronic communication predicts overutilization of the different monitored processor.

13. The method according to claim 8, further comprising: Feature normalization is performed on the first time series dataset to scale individual data samples from the first time series dataset to have a common and consistent unit measurement.

14. The method according to claim 8, further comprising: A scaler process is implemented on the first time series dataset to create a small standard deviation of the features and retain zero entries in sparse data.

15. A non-transitory computer-readable storage medium storing a plurality of instructions executable by one or more processors, the plurality of instructions, when executed by the one or more processors, causing the one or more processors to: receiving a first time series data set from a sensor of a monitored processor; grouping the first time series data set into a plurality of clusters; combining subsets of the plurality of clusters by data signature similarity to form a plurality of motifs using an unsupervised machine learning model; combining the plurality of motifs into one or more shape sub-elements, wherein the one or more shape sub-elements correspond to similar data signatures across different times, wherein a same software application is executed at the monitored processor and the similar data signatures correspond to the same software application; training a supervised machine learning model using the plurality of motifs and the one or more shape sub-models as input to the supervised machine learning model; predicting a second time series dataset using the plurality of motifs; as well as Initiating an action based on the prediction of the second time series data set, wherein the action comprises: determining that the monitored processor corresponds to overutilization at a particular time; as well as An electronic communication is sent to an account associated with the monitored processor, wherein the electronic communication recommends reducing excess utilization of the monitored processor after the specified time. 16 . The non-transitory computer-readable storage medium of claim 15 , wherein each cluster of the plurality of clusters comprises a local minimum data point and a local maximum data point of the first time series data set.

17. The non-transitory computer readable storage medium of claim 16, wherein the one or more processors are further configured to: A centroid of each of the plurality of clusters is determined using the local minimum data point and the local maximum data point for each of the plurality of clusters from the first time series data set.

18. The non-transitory computer-readable storage medium of claim 17, wherein the determining of the centroid of each of the plurality of clusters uses a custom K-means clustering algorithm that takes into account a linear approach to the first time series data set.

19. The non-transitory computer readable storage medium of claim 15, wherein the one or more processors are further configured to: An electronic communication is sent to an account associated with a monitored processor different from the monitored processor, wherein the electronic communication predicts overutilization of the different monitored processor.

20. The non-transitory computer readable storage medium of claim 15, wherein the one or more processors are further configured to: Feature normalization is performed on the first time series dataset to scale individual data samples from the first time series dataset to be measured in common and consistent units.

Images