Computing device, method and storage medium for processing health information

Abstract

Examples disclosed herein relate to processing health information of a computing device according to a deep learning model to determine whether an anomaly has occurred. Multiple computing devices may be part of a system. One of the computing devices includes a host processing element, a management controller separate from the host processing element, and a deep learning model that includes parameters trained to identify abnormal behavior of the computing device. The management controller may receive health information from multiple components of the computing device and process the health information according to the deep learning model to determine whether an anomaly has occurred.

Description

Technical Field

[0001] The present disclosure generally relates to processing health information to determine whether an abnormality has occurred. Background Art

[0002] Information technology companies and manufacturers are challenged to provide quality and value to consumers by, for example, providing computing devices with high availability and / or security. High availability is a property designed to ensure a certain level of operational performance, such as greater uptime than systems without high availability properties. Systems may be infected with malware or exhibit other anomalies that could be harmful to consumers. Summary of the invention

[0003] According to some embodiments of the present disclosure, a first computing device is provided, comprising: a host processing element; and a management controller separate from the host processing element, wherein the management controller is powered by a power rail separate from the host processing element, wherein a deep learning model is implemented at the first computing device, the deep learning model comprising parameters, the parameters being trained to identify abnormal behavior of the first computing device, and wherein the management controller is used to execute instructions to: receive health information from multiple components of the first computing device; process the health information according to the deep learning model to determine whether an abnormality has occurred; take action in response to determining that the abnormality has occurred; receive from an analysis platform an updated version of the deep learning model updated by the analysis platform based on an administrator response in response to the action, wherein the update of the deep learning model is based on health information parameter feedback from multiple computing devices after the action occurs; and process further health information according to the updated version of the deep learning model.

[0004] According to some embodiments of the present disclosure, a method for processing health information is provided, the method comprising: receiving, by a first management controller of a first computing device among a plurality of computing devices, first health information from a plurality of components of the first computing device, wherein the first computing device comprises a first host processing element separate from the first management controller, and wherein the first management controller is powered by a power rail separate from the first host processing element; processing, by the first management controller, the first health information according to a deep learning model to determine whether a first anomaly has occurred, wherein the deep learning model comprises parameters, the parameters being trained to identify abnormal behavior of the first computing device; sending a portion of health information parameter feedback from the first computing device to an analysis platform, wherein the analysis The health information parameter feedback received at the platform comes from the multiple computing devices; an updated version of the deep learning model updated based on the health information parameter feedback is received from the analysis platform at the first computing device; the updated version of the deep learning model is received at a second management controller of a second computing device among the multiple computing devices, wherein the second computing device includes a second host processing element separate from the second management controller, and wherein the second management controller is powered by a power rail separate from the second host processing element; second health information is received from multiple components of the second computing device at the second management controller; and the second health information is processed according to the updated version of the deep learning model to determine whether a second anomaly has occurred.

[0005] According to some embodiments of the present disclosure, there is provided a non-transitory machine-readable storage medium storing instructions, which, when executed by a management controller of a computing device, causes the management controller to: receive health information from multiple components of the computing device, wherein the computing device includes a host processing element separate from the management controller, and wherein the management controller is powered by a power rail separate from the host processing element; process the health information according to a deep learning model to determine whether a first anomaly has occurred, wherein the deep learning model includes parameters that are trained to identify abnormal behavior of the computing device; generate health information parameter feedback; send the health information parameter feedback to an analysis platform; receive from the analysis platform an updated version of the deep learning model that is updated based on the health information parameter feedback and another health information parameter feedback from another computing device; determine that a second anomaly has occurred based on the updated version of the deep learning model and additional health information collected from the multiple components; determine a classification of the second anomaly; and take action in response to the determination that the second anomaly has occurred and based on the classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The following is a detailed description with reference to the accompanying drawings, in which:

[0007] Figure 1 is a block diagram of a computing device having a management controller capable of processing health information associated with the computing device according to a deep learning model to determine whether an anomaly has occurred according to an example;

[0008] Figure 2 is a block diagram of a system capable of updating and using a deep learning model to determine whether an anomaly has occurred according to an example;

[0009] Figure 3 is a flow chart of a method for determining whether an anomaly has occurred at a computing device using a management controller and a deep learning model according to an example;

[0010] Figure 4 is a block diagram of a management controller capable of determining whether an anomaly has occurred on a computing device according to one example;

[0011] Figure 5 is a flow chart of a method for taking action in response to determining that an anomaly exists on a computing device, according to one example;

[0012] Figure 6 is a flow chart of a method for taking administrator action in response to determining that an anomaly exists on a computing device according to one example; and

[0013] Figure 7 is a block diagram of an analytics platform capable of updating and / or managing a deep learning model to identify anomalies according to an example.

[0014] In all drawings, the same reference numerals may represent similar but not necessarily identical elements. The index numeral "N" attached to some reference numerals may be understood to represent only a plurality, and each reference numeral with such an index numeral "N" may not necessarily represent the same quantity. In addition, the reference numerals without index numerals used herein (where such reference numerals are referred to by index numerals elsewhere) may be a general or separate general term for the corresponding plurality of elements. In another example, the index numeral "I", "M", etc. may be used instead of the index numeral N.

[0015] In all drawings, the same reference numerals denote similar, but not necessarily identical, elements. The drawings are not necessarily drawn to scale, and the dimensions of some parts may be exaggerated to more clearly illustrate the examples shown. In addition, the drawings provide examples and / or implementations consistent with the description; however, the description is not limited to the examples and / or implementations provided in the drawings. DETAILED DESCRIPTION

[0016] In the present disclosure, the use of the terms "a" or "an" or "the" is also intended to include the plural forms unless the context clearly indicates otherwise. In addition, when used in the present disclosure, the terms "includes or including", "comprises or comprising", or "have or having" specify the presence of stated elements, but do not exclude the presence or addition of other elements.

[0017] Information technology companies and manufacturers are challenged to provide quality and value to consumers by, for example, providing computing devices with high availability and / or security. High availability is a feature designed to ensure a certain level of operational performance, such as greater uptime than systems that do not have high availability features. Additionally, systems may be infected with malware or exhibit other anomalies that could be harmful to consumers.

[0018] Modern network security practices are well equipped for external threats, such as distributed denial of service attacks. However, one challenge that networks face is physical intrusions, where malware is able to penetrate the physical perimeter and spread throughout the network from the inside. Regardless of the purpose and company procedures, these physical intrusions can be targeted or accidental, such as a universal serial bus (USB) flash drive being able to enter the most secure network perimeter. If malware is present on the USB flash drive, it can infect a computing device, which can then infect other devices on the network.

[0019] A management controller (e.g., a baseboard management controller) of a computing device on a network system can utilize out-of-band positioning to directly connect to a host network, processor, storage, memory, power supply, etc. Therefore, the management controller has a trusted view of the device configuration, status, and performance metrics of the computing device. The monitoring techniques described herein can enhance system security by detecting behavioral anomalies in real time. When anomalies occur, actions can be taken, such as alerting a supervisor, approving corrective actions, updating a model to include allowed anomalies, etc.

[0020] In some examples, the management controller can monitor the device through direct channels, such as (Peripheral Component Interconnect) PCIexpress, USB, channel interface drivers, etc. to ensure that data is not compromised. These data points can be measured according to desired thresholds or intelligently built models to determine whether the threat is valid and whether a response is required. In some examples, the threat response can be an alert, a reactive attempt to quell the threat, a preemptive effort to mitigate a significant threat or perceived vulnerability, etc.

[0021] For a specific workload, machine learning can be used to create an intelligently created model. A model can be trained for a group of computing devices that are expected to work on a specified workload. In some examples, a benchmark load of the workload can be used in the training group to create the model. During the benchmark test, the management controller of each computing device being monitored can obtain health information from the components of the corresponding computing device. The health information can then be sent to the analysis platform. The analysis platform can obtain a large amount of health information from multiple computing devices to create a deep learning model of the normal operation of the computing devices during the workload.

[0022] The deep learning model can be implemented in a production environment of a management controller. In some examples, a computing device can be monitored by a management controller on the computing device using a deep learning model. If the management controller detects an anomaly, it can perform an action. The action can be a reporting action, such as notifying an administrator of a problem. In other examples, the action can include alerting other management controllers on a related management network of the anomaly or a diagnosis based on the anomaly. In a further example, the management controller that detects the anomaly or an associated management controller can perform an action on its computing device, such as isolating network traffic, isolating, etc.

[0023] Examples of deep learning models include using a recurrent neural network (RNN) to process system events to determine which events collected in health information are part of normal workload usage. The deep learning network that will be used in the field can be trained using previous logs. Feedback from production workloads can be used to reinforce and update the model.

[0024] In one example, the computing device may include a server. A management controller such as a baseboard management controller (BMC) may be used to analyze the incoming health information according to a deep learning model. The BMC provides a so-called "lights-out" function for the computing device. The unattended function may allow a user such as a system administrator to perform management operations on the computing device, even if the operating system is not installed on the computing device or does not work on the computing device. In addition, in one example, the BMC may run on an auxiliary power supply, so the computing device does not need to be powered on to an on state, in which the control of the computing device is handed over to the operating system after booting. As an example, the BMC may provide so-called management and so-called "out-of-band" services, such as remote console access, remote restart and power management functions, access to system logs, etc. As used herein, the BMC has management capabilities for subsystems of the computing device and is separated from the processor that executes the main operating system of the computing device. The BMC may include interfaces such as a network interface and / or a serial interface, which an administrator may use to communicate remotely with the BMC.

[0025] As described above, the BMC may access system logs and health information.In one example, system components such as hardware devices and / or software executing on the hardware may be configured to provide event information to the BMC.

[0026] Figure 1 is a block diagram of a computing device with a management controller according to one example, the management controller being capable of processing health information associated with the computing device based on a deep learning model to determine whether an anomaly has occurred. Figure 2 is a block diagram of a system capable of updating and using a deep learning model to determine whether an anomaly has occurred according to an example.

[0027] exist Figure 1 In the example of FIG. 1 , computing device 102 includes component 110, deep learning model 112, management controller 116, and host processing element 130. Figure 2 In the example of , the computing system 200 includes multiple computing devices 102a, 102b-102n, one or more of which may include a component 110, a deep learning model 112, a management controller 116, health information 214, health information parameter feedback 216, a host processing element 130, a memory 232, an input / output 234, etc. In addition, the computing system 200 may further include an analysis platform 250. In some examples, the analysis platform 250 and one or more computing devices 102 may be connected via a network. In some examples, the connection may be via a management network that connects one or more management controllers 116 to each other and / or to a management node. In other examples, other networks, such as a production network, may be used to connect one or more computing devices 102. In some examples, the production network may be separate from the management network.

[0028] The management controller 116 in the production or test environment can communicate with the components 110 of the computing device 102 to generate health information 214. The management controller 116 can use one or more buses to communicate with the components to receive health information. Examples of health information 214 may include temperatures associated with chips such as one or more central processing units, memory, etc., log information, session counters, user action information, network packet counters, power consumption, error information, records of firmware or software installed on the computing device, processing workload information, peripheral device configuration information, peripheral device sensor information, etc. In some examples, the health information 214 can be stored in a memory associated with the management controller 116. In one example, software installed on an operating system executing on the host processing element 130 can communicate with the management controller 116 via an interface, for example, using a driver and a bus. In addition, in some examples, information about software executing on the host processing element 130, components 110 present on one or more buses (e.g., PCIe bus, network interface controller, non-volatile memory host controller, etc.) can be provided to the management controller 116. In some examples, information may be transmitted via a bus used for management, for example, serial communications such as I2C, a system management bus, a controller area network (CAN) bus, etc. In other examples, input may be received from a host or management platform in the form of configuration over a management network.

[0029] In some examples, health information 214 may be stored as a log or other data structure in persistent storage or volatile storage. Different storage and reception conditions may exist. For example, management controller 116 may receive information about software installed on computing device 102 less frequently than information from a temperature sensor.

[0030] As described above, the deep learning model 112 can be based on a specific workload associated with the system 200. Training the model can include using a benchmark workload. During the benchmark workload on one or more computing devices, the associated management controller 116 can access data from components of the corresponding system in the test environment and generate health data. The health data can be provided to an analysis platform that can generate a model. In some examples, training using a benchmark workload can be considered as pre-training of a deep learning model for a specific workload. The deep learning model can be further updated based on additional feedback from the computing device.

[0031] Various deep learning models can be used. Examples of deep learning models include long short-term memory (LSTM), convolutional neural networks, recurrent neural networks, neural history compressors, recursive neural networks, gated recurrent units (GRU), etc. An advantage of recurrent neural networks is the inclusion of feedback. Parameters for deep learning models can be updated based on feedback from computing device 102 or other devices discussed herein.

[0032] In one example model, health information can be processed as characters. In the example model, characters can represent registers provided by a component or information associated with other system logs. In one example, each character can be considered an input vector. The score of the event can be updated as each character is processed. During processing, these scores can be considered hidden. The updated score can be used as an input vector along with the next character. Processing can continue until a character represents the end of the event. Different types of health information events can be treated differently. For example, temperature information can be processed as a character or multiple characters representing the temperature, while the version number of the firmware can be processed differently as a separate event information.

[0033] In a long short-term memory (LSTM) model, characters can be broken down by special characters and grouped together (e.g., a group representing information associated with an event). For example, the first character may identify the event, the second, third, and fourth characters may include log register information, and a special character (fifth character) may indicate the end of information about the event. In this example, these five characters are to be processed together. Although an LSTM model is described, other approaches, such as gated recurrent units, may also be used.

[0034] Input events can originate from any software entity, field replaceable unit, component 110, etc. In one example, a deep neural network (DNN) makes an immediate prediction when consuming the input vector. A fully connected architecture can be used, the last level of which is the output of predicting whether an abnormality has occurred.

[0035] In some examples, the scores may be used to rank the probability that each event or group of events represents an anomaly to the normal operation of computing device 102 .

[0036] When the deep learning model 112 is used in production mode, the management controller 116 may process its respective health information 214 according to the deep learning model 112 to determine whether an anomaly has occurred based on the deep learning model 112 .

[0037] In one example, the management controller 116 determines that an anomaly exists. The management controller 116 can classify the anomaly. In some examples, during model generation, the model can include a classification based on the type of parameters associated with the anomaly. In addition, in some examples, some training can be supervised, for example, a specific workload with abnormal behavior can be used as part of the workload for training and can be associated with the abnormal behavior. In one example, the training model can include information indicating that a known anomaly is occurring within a time frame of the workload. In some examples, the management controller 116 can take action in response to a determination that an anomaly has occurred based on the relevant classification.

[0038] In one example, the classification is associated with an action of sending an alert. In this example, the alert is sent to a management or analysis platform such as analysis platform 250. The alert can indicate the presence of an anomaly and specific criteria associated with the anomaly.

[0039] Additionally, in some examples, the action may include a request for administrator feedback. For example, an administrator may be asked to confirm whether the anomaly is a problem. In one example, the administrator may indicate that the anomaly is not a problem, but is consistent with a workload change. An example of this is when a maintenance event occurs, such as an update to a firmware package, an update to software, the addition of new hardware, etc. Another example of this is when additional activity is occurring, such as a Black Friday or sales event on a retail server workload or an at-home event that increases a streaming server workload or a retail workload.

[0040] In one example, the analysis platform receives an administrator response in response to the action. The administrator response may include an indication that the workload has changed. In response to the change in workload, the deep learning model may be updated by the analysis platform 250. In one example, the update of the deep learning model includes health information parameter feedback from multiple computing devices 102a, 102b, 102n after the action occurs.

[0041] The health information parameter feedback 216 may be generated by the management controller 116. In some examples, the health information parameter feedback 216 may be collected, stored, and then sent in batches. In one example, the health information parameter feedback 216 may include a collection of health information 214 collected over a period of time. In another example, the health information parameter feedback 216 may be pre-processed. This may include, for example, counting the number of times a particular event occurs, performing transformations on the data to help it be analyzed by the analysis platform 250, reducing the amount of data sent to the analysis platform, rescaling the data, normalizing the data, and the like. Each computing device 102 may generate a portion of the health information parameter feedback received by the analysis platform 250. Each portion may be associated with a corresponding computing device 102.

[0042] The analysis platform 250 receives health information parameter feedback from the computing device 102. The analysis platform 250 can update the deep learning model based on the previously used deep learning model and health information parameter feedback using a similar method as during model training. Based on the administrator response to the anomaly, the feedback can be considered valid. The updated deep learning model can be provided back to the computing device 102a and / or other computing devices 102b-102n.

[0043] The computing device 102a or another similar computing device such as the computing device 102b may receive the updated deep learning model. The computing device 102 may use the updated deep learning model to determine whether an anomaly exists. In this example, one of the computing devices 102 retrieves the additional health information 214 from its corresponding component 110. The additional health information 214 is processed according to the updated deep learning model. In one example, the management controller 116 may determine that a second anomaly has occurred. In response to the determination, another action may be taken.

[0044] Other examples of actions that may be taken in response to detection of an anomaly include quarantine, updating of software or firmware components, communication with other management controllers of other computing devices, preemptive action, and the like.

[0045] In one example of isolation, the management controller 116 may isolate the computing device 102 by isolating the computing device 102 (e.g., by shutting down the I / O 234). In another example, the management controller 116 may communicate with a host application or operating system to transfer the workload to another computing device before isolating or shutting down the computing device 102.

[0046] In one example, another computing device 102n may take preemptive action. In this example, the management controller 116 may provide (e.g., via a notification) information about the anomaly to other management controllers of other computing devices (e.g., computing device 102n). The management controller of computing device 102n may receive a notification about the anomaly. The management controller may perform another action on computing device 102n to preemptively avoid the anomaly.

[0047] In one example, another action (or the action of the first computing device) may include not allowing a particular user associated with the anomaly to send information. In another example, the action may include shutting down a network port. In a further action, the management controller 116 may request an agent executing on the host processing element 130 to perform a remedial action. For example, the agent may be provided with characteristics of a malicious or abnormal process, and the agent may terminate the process and similar processes. Other similar actions may be taken to prevent processes with similar characteristics from running. Further actions may include stopping the entity's right to access / use a memory or a network port.

[0048] In one example of updating a software or firmware component, the management controller 116 can detect an anomaly. The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version than other computing devices in the group. In one example, the component can be set for updating. The update can be performed as part of the next scheduled maintenance time, or it can be performed dynamically. For example, this depends on the requirements of the updated component. In some examples, each of the computing devices 102a-102n can be the same model as the computing device 102a. In other examples, different models can be used, but the architecture is the same. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings.

[0049] Additionally, in some examples, some or all of health information 214 may be provided to analysis platform 250 to update the deep learning model. This may be performed periodically, for example, collecting health information 214 during a period of time (e.g., during a low workflow portion of each day). Analysis platform 250 may process health information 214 as a matter of course and send the updated deep learning model 112 to the computing device for use.

[0050] In one example use case, an employee brought in a seemingly innocent Universal Serial Bus (USB) flash drive. Once inserted into the computing device, malware was automatically installed and began to spread to other systems on the production network. The malware on the employee's computing device was able to infiltrate the operating system software and modify behavioral metrics, with the computing device reporting that nothing unusual had occurred.

[0051] The malware then finds its way to a server equipped with a management controller 116 running the feature, where regular monitoring has established a healthy behavioral model. For example, a network interface card can obtain health information and perform metrics on send / receive utilization, bytes, packets, errors, and queue status to derive tangible behavioral metrics.

[0052] While the operating system (OS) executing on the host processing element 130 may be spoofed through software manipulation, the hardware devices cannot be modified. The management controller 116 is able to characterize large-scale shifts in network, processor, storage, memory, and power supply activity as abnormal behavior. For example, malware causes the system processor to reach 100% utilization and the power supply reports a sharp increase in current consumption. These indicators are compared to established behavioral models to determine that an attack is ongoing and trigger configured response mechanisms.

[0053] Policies may be used to classify and implement responses. An example of a configuration policy may include a priority message sent from the management controller 116 to an administrator detailing the problem. In another example, the management controller 116 isolates the infected computing device 102 from other systems on the network. In another example, the management controller 116 of the infected system broadcasts a message to neighboring management controller 116 systems that the threat has been confirmed and to prepare for the upcoming threat.

[0054] If a malware attack is intended to bombard the host network bandwidth, the management controller 116 can be configured to send and receive messages through its dedicated network port. This interface is separate from the subsystems of the production network and will not be infected if the operating system or other software executing on the host processing element 130 is compromised. This allows the management controller 116 to provide an uncompromised interface for network administrators to repair the system.

[0055] In some examples, the management controller may include a BMC. The management controller 116 may be used to implement services for the computing device 102. The management controller 116 may be implemented using a processor separate from the host processing element 130 for executing a high-level operating system. The management controller 116 may provide a so-called "unattended" function for the computing device. The unattended function may allow a user such as a system administrator to perform management operations on the computing device 102, even if the operating system is not installed on the computing device or is not functional on the computing device. In addition, in one example, the management controller 116 may run on an auxiliary power supply, so the computing device 102 does not need to be powered on to an on state, in which the control of the computing device 102 is handed over to the operating system after booting. As an example, the management controller 116 may provide so-called "out-of-band" services, such as remote console access, remote restart and power management functions, monitoring system health, accessing system logs, etc. As used herein, the management controller 116 has management capabilities for subsystems of the computing device 102 and is separate from the processor or host processing element 130 that executes the main operating system of the computing device (e.g., a server or a group of servers).

[0056] As described above, in some cases, the management controller 116 can enable unattended management of the computing device 102, which provides remote management access (e.g., system console access) regardless of whether the computing device 102 is powered on, whether the main network subsystem hardware is running, or whether the OS is running or even installed. The management controller 116 may include an interface, such as a network interface and / or a serial interface, that an administrator can use to remotely communicate with the management controller 116. As used herein, an "out-of-band" service is a service provided by the management controller 116 via a dedicated management channel (e.g., a network interface or a serial interface) and is available regardless of whether the computing device 102 is powered on.

[0057] In some examples, the management controller 116 may be included as part of the housing. In other examples, the management controller 116 may be included in one or more servers (e.g., as part of a management subsystem of the server) or connected via an interface (e.g., a peripheral interface). In some examples, sensors associated with the management controller 116 may measure internal physical variables, such as humidity, temperature, power supply voltage, communication parameters, fan speed, operating system functionality, etc. The management controller 116 is also capable of restarting or power cycling the device. As described above, the management controller 116 allows remote management of the device, and thus, notifications can be issued to a central station using the management controller 116, and passwords or other user inputs can be implemented through the management controller 116.

[0058] In some examples, one or more components 110 may be associated with firmware. The firmware engine may be implemented using instructions executable by a processor and / or logic. In some examples, the firmware may be associated with one or more controllers that are part of the corresponding component 110.

[0059] In some examples, the firmware engine can be implemented as platform firmware. The platform firmware may include interfaces such as a basic input / output system (BIOS) or a unified extensible firmware interface (UEFI) to allow it to be connected. The platform firmware may be located in the address space where the host processing element 130 (e.g., central processing unit) of the computing device 102 is started. In some examples, the platform firmware may be responsible for the power-on self-test of the computing device 102. In other examples, the platform firmware may be responsible for the boot process and what operating system (if any) is loaded on the computing device 102. In addition, the platform firmware may be able to initialize various components of the computing device 102, such as peripherals, memory devices 232, memory controller settings, storage controller settings, bus speed, video card information, etc. In some examples, the platform firmware can also perform various low-level functions when the computing device 102 is executed. In addition, in some examples, the platform firmware can communicate with a higher-level operating system executed on the CPU, for example, via an advanced configuration and power interface (ACPI).

[0060] The host processing element 130, such as one or more central processing units (CPUs) or a microprocessor and / or electronic circuit suitable for retrieving and executing instructions, can be configured to perform the functions of any host process described herein. In some scenarios, instructions and / or other information, such as health information, can be included in the memory 232 or other memory. The input / output interface 234 can be provided by the computing device 102 in addition. For example, input devices (such as keyboards, sensors, touch interfaces, mice, microphones, etc.) can be used to receive input from the environment around the computing device 102. In addition, output devices such as displays can be used to present information to the user. Examples of output devices include speakers, display devices, amplifiers, etc. In addition, in some examples, some components can be used to implement the functions of other components described herein. Input / output devices such as communication devices such as network communication devices or wireless devices can also be considered as devices that can use the input / output interface 234.

[0061] The communication network may be used for communication between analysis platform 250 and computing device 102. For example, a management network may be used to manage communications between a controller and analysis platform 250. In other examples, the communication network may be used to connect one or more I / Os of a computing device to other devices (e.g., via the Internet or other networks).

[0062] The communication network can use wired communication, wireless communication or a combination thereof. In addition, the communication network can include multiple sub-communication networks, such as data networks, wireless networks, telephone networks, etc. Such networks can include, for example, public data networks, such as the Internet, local area networks (LANs), wide area networks (WANs), metropolitan area networks (MANs), cable networks, fiber optic networks, combinations thereof, etc. In some examples, wireless networks can include cellular networks, satellite communications, wireless LANs, etc. In addition, the communication network can be in the form of direct network links between devices. Various communication structures and infrastructures can be used to implement the communication network.

[0063] Devices may communicate with each other and other components of a communication network via a communication protocol or protocols. A protocol may be a set of rules that define how communication network nodes interact with other nodes. In addition, communication between network nodes may be accomplished by exchanging discrete packets of data or sending messages. A packet may include header information associated with a protocol (e.g., information about the location of the network node to be contacted) as well as payload information.

[0064] Figure 3 is a flow chart of a method for determining whether an anomaly has occurred at a computing device using a management controller and a deep learning model according to one example. Figure 4 is a block diagram of a management controller capable of determining whether an anomaly has occurred on a computing device according to one example. Although method 300 is shown as being implemented using management controller 400, other controllers such as management controller 116 may also be used.

[0065] Processing element 410 may be one or more central processing units (CPUs), one or more semiconductor-based microprocessors, one or more graphics processing units (GPUs), other hardware devices suitable for retrieving and executing instructions stored in machine-readable storage medium 420, or a combination thereof. Processing element 410 may be a physical device. In addition, in one example, processing element 410 may include multiple cores on a chip, including multiple cores across multiple chips, or a combination thereof. Processing element 410 may fetch, decode, and execute instructions 422, 424, 426 to implement the processes described herein. As an alternative or supplement to retrieving and executing instructions, processing element 410 may include at least one integrated circuit (IC), other control logic, other electronic circuits, or a combination thereof, which includes multiple electronic components for executing the functions of instructions 422, 424, 426.

[0066] The machine-readable storage medium 420 can be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. Thus, the machine-readable storage medium can be, for example, a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), a storage drive, a compact disk read-only memory (CD-ROM), etc. As such, the machine-readable storage medium can be non-transitory. As described in detail herein, the machine-readable storage medium 420 can be encoded with a series of executable instructions for processing health information to determine whether an abnormality has occurred.

[0067] As further described above, the management controller 400 can be part of a computing device. The computing device can be one of multiple computing devices in a system. The management controller 400 can be separate from the host processing element of the computing device. In addition, the management controller 400 can access a deep learning model trained according to a specific workload to determine whether there is abnormal behavior based on the health information. The deep learning model can be pre-trained for a specific workload and can be updated as an ongoing process.

[0068] At 302, processing element 410 may execute health instructions 422 to receive health information from components of a computing device. Management controller 400 may use one or more buses to communicate with components of a computing device to receive health information. Examples of health information may include temperatures associated with chips such as one or more central processing units, memory, etc., log information, session counters, network packet counters, power consumption, error information, records of firmware or software installed on the computing device, processing workload information, peripheral device configuration information, peripheral device sensor information, etc. In some examples, the health information may be stored in a memory accessible to management controller 400.

[0069] In one example, software installed on an operating system executing on a host processing element may communicate with the management controller 400 via an interface, for example, using a driver and a bus. In addition, in some examples, information about software executing on the host processing element, components present on one or more buses (e.g., a PCIe bus, a network interface controller, a non-volatile memory host controller, etc.) may be provided to the management controller 400. In some examples, the information may be transmitted via a bus used for management, for example, serial communications such as I2C, a system management bus, a controller area network (CAN) bus, etc. In other examples, input may be received from a host or management platform in the form of a configuration through a management network.

[0070] At 304, processing element 410 may execute analysis instructions 424 to process health information 304. The processing may be based on the type of deep learning model used, for example, using an LSTM model, a GRU model, a deep neural network model, a convolutional neural network model, a recurrent neural network model, etc. At 306, analysis instructions 424 may be executed by processing element 410 to determine whether an abnormality has occurred. This may also be based on the deep learning model used. If an abnormality occurs, processing element 410 may execute action instructions 426 to perform an action in response to the determined abnormality.

[0071] Figure 5 is a flow chart of a method for taking action in response to determining that an anomaly exists on a computing device according to one example. Although method 500 is shown as being implemented using management controller 400, other controllers such as management controller 116 may also be used.

[0072] At 502, the managing controller 400 determines that an anomaly exists. As described above, this determination may be based on the processing of the health information as described above.

[0073] At 504, the management controller 400 can classify the anomaly. As described above, in some examples, during model generation, the model can include a classification based on a type of parameter associated with the anomaly. Additionally, in some examples, some training can be supervised, for example, a particular workload with abnormal behavior can be used as part of the workload for training and can be associated with the abnormal behavior. In one example, the training model can include information indicating that a known anomaly or anomaly type is occurring within a time frame of the workload.

[0074] In some examples, at 506, management controller 400 can take an action in response to a determination that an anomaly based on the relevant classification has occurred. Processing element 410 can execute action instructions 426 to perform the action. In one example, the classification is associated with an action of sending an alert. In this example, the alert is sent to a management or analysis platform, such as analysis platform 250 or 700. The alert can indicate the presence of an anomaly and specific criteria associated with the anomaly.

[0075] Additionally, in some examples, the action may include a request for administrator feedback. For example, an administrator may be asked to confirm whether the anomaly is a problem. In one example, the administrator may indicate that the anomaly is not a problem, but is consistent with a workload change. An example of this is when a maintenance event occurs, such as an update to a firmware package, an update to software, the addition of new hardware, etc. Another example of this is when additional activity is occurring, such as a Black Friday or sales event on a retail server workload or an at-home event that increases a streaming server workload or a retail workload.

[0076] In other examples, the action may include alerting other management controllers on the associated management network of the anomaly or a diagnosis based on the anomaly. In further examples, the management controller that detected the anomaly or an associated management controller may perform actions on its computing device, such as isolating network traffic, isolating, updating software or firmware components, communicating with other management controllers of other computing devices, taking preemptive actions, etc.

[0077] Additionally, in some examples, analysis instructions 424 may be executed to process the health information to generate a portion of a health information parameter feedback that may be sent to an analysis platform.

[0078] In addition, the management controller 400 can receive an updated deep learning model from the analysis platform. As described above, this can be updated based on health information parameter feedback received from multiple computing devices. Other computing devices can act on the updated model based on the health information from the management controller (e.g., by using the updated model about the new health information to detect another anomaly).

[0079] Figure 6 is a flow chart of a method for taking administrator action in response to determining that an anomaly exists on a computing device, according to one example. Figure 7 7 is a block diagram of an analysis platform capable of updating and / or managing a deep learning model to identify anomalies according to one example. Although method 600 is shown as being implemented using analysis platform 700, other devices such as analysis platform 250 may also be used.

[0080] Processing element 710 may be one or more central processing units (CPUs), one or more semiconductor-based microprocessors, one or more graphics processing units (GPUs), other hardware devices suitable for retrieving and executing instructions stored in machine-readable storage medium 720, or a combination thereof. Processing element 710 may be a physical device. In addition, in one example, processing element 710 may include multiple cores on a chip, including multiple cores across multiple chips, multiple cores across multiple devices, or a combination thereof. Processing element 710 may fetch, decode, and execute instructions 722, 724 to implement method 600. As an alternative or in addition to retrieving and executing instructions, processing element 710 may include at least one integrated circuit, other control logic, other electronic circuits, or a combination thereof, which includes multiple electronic components for performing the functions of instructions 722, 724.

[0081] The machine-readable storage medium 720 may be any electronic, magnetic, optical or other physical storage device that contains or stores executable instructions. Thus, the machine-readable storage medium may be, for example, a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), a storage drive, a compact disk read-only memory (CD-ROM), etc. Thus, the machine-readable storage medium may be non-transitory. As described in detail herein, the machine-readable storage medium 720 may be encoded with a series of executable instructions for performing an action.

[0082] In some examples, analysis platform 700 can be implemented as software executed on a physical processing element. In one example, analysis platform 700 can be implemented as software executed using a virtual machine executing on a computing device.

[0083] In one example, the analysis platform 700 receives health information parameter feedback from a computing device. The analysis platform 700 can update the deep learning model using a similar method as during model training based on the previously used deep learning model and the health information parameter feedback.

[0084] In one example, the analysis platform receives notification of an anomaly from a management controller (602). Action instructions 724 may be executed by processing element 710 to perform an action in response to receiving the notification. In one example, the action may include requesting an administrator response. At 604, processing element 710 may execute action instructions 724 to receive a response from the administrator (604). As described above, one example of such a response may include that the administrator expects an anomaly to occur and the model should be updated.

[0085] An administrator action may be performed at 606. In one example, the administrator action includes updating the model. The analysis platform 700 may receive health information parameter feedback from multiple computing devices and update the deep learning model to be used by the execution model instruction 722 in a manner consistent with the above method. For example, the update may be in response to an updated workload. The updated deep learning model may be provided to the management controller for use.

[0086] Other administrator actions may also be performed. For example, the notification may indicate to the administrator that an update is required. The administrator may choose to perform the update. In some examples, this may be performed without administrator interaction.

[0087] Although certain embodiments have been shown and described above, various changes may be made in form and detail. For example, some features described with respect to one implementation and / or process may be relevant to other implementations. In other words, the process, features, components and / or properties described with respect to one implementation may be useful in other implementations. In addition, it should be understood that the systems and methods described herein may include various combinations and / or sub-combinations of components and / or features of the different implementations described. Therefore, features described with reference to one or more implementations may be combined with other implementations described herein.

Claims

1. A first computing device, comprising: Host processing element; as well as a management controller separate from the host processing element, wherein the management controller is powered by a power rail separate from the host processing element, wherein a deep learning model is implemented at the first computing device, the deep learning model including parameters trained to identify abnormal behavior of the first computing device, and The management controller is configured to execute instructions to: receiving health information from a plurality of components of the first computing device, Processing the health information according to the deep learning model to determine whether an abnormality has occurred, taking action in response to determining that the anomaly has occurred, receiving from an analytics platform an updated version of the deep learning model updated by the analytics platform based on an administrator response in response to the action, wherein the update of the deep learning model is based on health information parameter feedback from a plurality of computing devices after the action occurs, and Further health information is processed according to the updated version of the deep learning model.

2. The first computing device of claim 1, wherein the deep learning model is based on a pre-trained deep learning model for a specific workload associated with the plurality of computing devices. 3 . The first computing device of claim 1 , wherein the administrator response comprises an indication of a change in workload on the plurality of computing devices.

4. The first computing device of claim 1 , wherein the management controller is further configured to: processing the health information to generate a portion of the health information parameter feedback; and The portion of the health information parameter feedback is sent to the analysis platform. 5 . The first computing device of claim 1 , wherein the health information parameter feedback comprises a count of a number of event occurrences.

6. The first computing device of claim 1 , wherein the management controller is further configured to: determining a classification of the anomaly, Wherein the action is based on the classification of the anomaly.

7. The first computing device of claim 6, wherein the health information is selected from the group consisting of: component temperature, network packet counts, power consumption, error information, and a record of firmware or software installed in the first computing device.

8. The first computing device of claim 1, wherein the action comprises isolating the first computing device from other computing devices in the plurality of computing devices.

9. The first computing device of claim 1, wherein the action comprises updating a firmware component in the first computing device to a version used by other computing devices in the plurality of computing devices.

10. The first computing device of claim 9, wherein the other computing devices in the plurality of computing devices have a same model as the first computing device.

11. The first computing device of claim 6, wherein the action comprises sending a notification regarding the exception including the classification.

12. A method for processing health information, the method comprising: receiving, by a first management controller of a first computing device among a plurality of computing devices, first health information from a plurality of components of the first computing device, wherein the first computing device includes a first host processing element separate from the first management controller, and wherein the first management controller is powered by a power rail separate from the first host processing element; processing, by the first management controller, the first health information according to a deep learning model to determine whether a first anomaly has occurred, wherein the deep learning model includes parameters trained to identify abnormal behavior of the first computing device; sending, from the first computing device to an analysis platform, a portion of health information parameter feedback received at the analysis platform from the plurality of computing devices; receiving, at the first computing device, from the analysis platform, an updated version of the deep learning model updated based on the health information parameter feedback; receiving the updated version of the deep learning model at a second management controller of a second computing device among the plurality of computing devices, wherein the second computing device includes a second host processing element separate from the second management controller, and wherein the second management controller is powered by a power rail separate from the second host processing element; receiving, at the second management controller, second health information from a plurality of components of the second computing device; as well as The second health information is processed according to the updated version of the deep learning model to determine whether a second abnormality has occurred.

13. The method of claim 12, wherein the deep learning model is based on a pre-trained deep learning model for a specific workload associated with the plurality of computing devices.

14. The method according to claim 12, further comprising: receiving, at the analysis platform, the health information parameter feedback from the plurality of computing devices, updating, by the analysis platform, the deep learning model based on the health information parameter feedback to generate the updated version of the deep learning model; as well as The updated version of the deep learning model is provided from the analytics platform to the first computing device and the second computing device.

15. The method according to claim 14, further comprising: The first health information is processed by the first management controller to generate the portion of the health information parameter feedback.

16. A non-transitory machine-readable storage medium storing instructions that, when executed by a management controller of a computing device, cause the management controller to: receiving health information from a plurality of components of the computing device, wherein the computing device includes a host processing element separate from the management controller, and wherein the management controller is powered by a power rail separate from the host processing element; processing the health information according to a deep learning model to determine whether a first anomaly has occurred, wherein the deep learning model includes parameters trained to identify abnormal behavior of the computing device; Generate health information parameter feedback; Sending the health information parameter feedback to the analysis platform; receiving from the analysis platform an updated version of the deep learning model updated based on the health information parameter feedback and another health information parameter feedback from another computing device; determining, based on the updated version of the deep learning model and the additional health information collected from the plurality of components, that a second anomaly has occurred; determining a classification of the second anomaly; as well as Responsive to the determination the second anomaly has occurred and based on the classification an action is taken.

17. The non-transitory machine-readable storage medium of claim 16, wherein the action comprises one or more of: isolating the computing device from other computing devices, or updating a firmware component in the computing device.

18. The non-transitory machine-readable storage medium of claim 16, wherein the deep learning model is based on a pre-trained deep learning model for a specific workload associated with a plurality of computing devices.

Images