Clustering process using business data

Abstract

Disclosed are methods, apparatus, and systems for clustering processes used by a cloud platform. Process clustering may include receiving business data transmitted and received between each pair of processes in a process set. A matrix may be generated based on the business data, the matrix including a row and a column for each process in the process set. Hierarchical clustering may be performed on the matrix based on the business data, the hierarchical clustering outputting a plurality of clusters, each cluster including one or more processes in the process set. The plurality of clusters may then be merged into a set of merged process clusters.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is a continuation of U.S. application No. 16 / 994,085, filed on August 14, 2020, entitled “Clustering Process Using Business Data,” the disclosure of which is hereby incorporated by reference. Background Art

[0003] Cloud computing involves delivering on-demand computing services over a network, such as a wide area network (WAN), such as the Internet and / or one or more local area networks (LANs). It provides information technology infrastructure as one or more groups of networked elements. Such network elements typically provide computing power and data storage to remote users via a network and are typically housed in a data center. Machine virtualization is commonly used in cloud computing. A typical virtualized computing system includes multiple computing nodes interconnected by a high-speed network. The computing nodes run virtual machines (VMs) that consume physical resources such as central processing units (CPUs), memory, persistent storage, and networking resources. Physical resources can reside on one or more network elements (also known as hosts).

[0004] The cloud platform provides computing resources to publishers of cloud-based services such as websites and web applications to deliver cloud-based services. In this regard, the cloud platform maintains the information technology infrastructure required to deliver cloud-based services, such that computing nodes run virtual machines or other processes. The cloud platform rents or sells access to its corresponding information technology infrastructure to publishers, thereby allowing publishers to use the cloud platform information technology infrastructure (including computing nodes running VMs or other processes) to provide their cloud-based services. The amount of resources rented or purchased by the publisher can be dynamically adjusted. For example, during a high usage period of the publisher's cloud-based services, additional virtual machines or other processes can be rented from the cloud platform's information technology infrastructure. Similarly, during a low usage period of the publisher's applications, fewer resources from the cloud platform's information technology infrastructure can be purchased or leased. Through the cloud platform, publishers access any computing resources they need without having to maintain and invest in their own information technology infrastructure. Summary of the Invention

[0005] Aspects of the present disclosure provide techniques, apparatus, and systems related to clustering processes. As an example, the techniques include clustering VMs and other such processes based on their business patterns.

[0006] One aspect of the present disclosure relates to a method for clustering processes, comprising: receiving, by one or more processors, business data transmitted and received between each pair of processes in a process set; generating, by the one or more processors, a matrix based on the business data, the matrix comprising rows and columns for each process in the process set; performing, by the one or more processors, hierarchical clustering on the matrix based on the business data, the hierarchical clustering outputting a plurality of clusters, each cluster comprising one or more processes in the process set; and merging, by the one or more processors, the plurality of clusters into a set of merged process clusters.

[0007] Another aspect of the present disclosure relates to a system comprising one or more computing devices, one or more computer-readable storage media, and program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more computing devices. The program instructions may cause the one or more computing devices to: receive business data transmitted and received between each pair of processes in a process set; generate a matrix based on the business data, the matrix including a row and a column for each process in the process set; perform hierarchical clustering on the matrix based on the business data, the hierarchical clustering outputting a plurality of clusters, each cluster including one or more processes in the process set; and merge the plurality of clusters into a set of merged process clusters.

[0008] Another aspect of the present disclosure relates to a non-transitory computer-readable medium containing program instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform the following steps: receiving business data transmitted and received between each pair of processes in a process set; generating a matrix based on the business data, the matrix including a row and a column for each process in the process set; performing hierarchical clustering on the matrix based on the business data, the hierarchical clustering outputting a plurality of clusters, each cluster including one or more processes in the process set; and merging the plurality of clusters into a set of merged process clusters.

[0009] In some examples, the merged set of process clusters may be implemented on a cloud platform.

[0010] In some examples, each entry in the matrix includes traffic data transmitted by the process corresponding to the row of the entry and received by the process corresponding to the column of the entry.

[0011] In some examples, the matrix is ​​a multidimensional matrix comprising matrices for each business data type concatenated together, the multidimensional matrix having dimensions N×(XN), where N is the number of processes in the process set and X is the number of matrices concatenated together.

[0012] In some examples, hierarchically clustering the matrix includes hierarchically linking each process or the process clusters together. The hierarchical linking can include Ward linking, which outputs a dendrogram that represents each process in the process set as a leaf node and each process cluster in the process clusters as a non-leaf node. In some cases, merging the plurality of clusters includes cutting the dendrogram at a merge point.

[0013] In some examples, the merged set of process clusters may be clustered. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a functional diagram of an example system according to aspects of the present disclosure.

[0015] Figure 2 An example system according to aspects of the present disclosure is shown.

[0016] Figure 3 is a flow chart illustrating clustering virtual machines according to aspects of the present disclosure.

[0017] Figure 4 An example matrix according to aspects of the present disclosure is shown.

[0018] Figure 5 An example tree diagram is shown in accordance with aspects of the present disclosure. DETAILED DESCRIPTION

[0019] Overview

[0020] The present technology relates to clustering processes, such as VMs, based on the business models of the individual processes to optimize the performance and availability of the processes in the cluster. For example, VMs implemented for cloud services such as online applications are typically configured by network architects or other such managers of the publisher of the cloud service. In many cases, the publisher clusters VMs together to provide sufficient computing power and / or redundancy for one or more specific features of the cloud service. However, the performance of clusters and VMs in clusters is not easily predictable, and clusters and VMs in clusters often do not operate in an efficient manner. For example, the workload experienced by VMs in one cluster may be greater than that experienced by VMs in another cluster that provide similar functionality for the cloud service. This uneven distribution of workload between clusters and VMs in clusters may degrade the performance and availability of the cloud service. Similar problems arise for other processes, such as containers and / or jobs in a containerized environment.

[0021] To address these issues, processes can be optimally grouped into functional clusters based on their operational data, where the processes in a cluster perform similar functions. In this regard, the traffic between each process can be entered into a matrix. Each entry in the matrix can be scaled to normalize the traffic between each process. The matrix can be truncated to reduce its dimensionality, thereby simplifying and reducing the processing requirements for further calculations described herein. Unsupervised machine learning can be used to perform hierarchical clustering on the truncated matrix, so that processes with similar entries are clustered together. Hierarchical clustering can include hierarchical links to group similar clusters together to create a tree diagram. The tree diagram can represent each process as a leaf, and merged process clusters can be represented by merge points, also known as non-leaf nodes. The tree diagram can be cut at the merge points to form flat clusters. In some cases, additional clustering can be performed to further merge similar clusters together. The resulting process clusters can be implemented in the information technology infrastructure of the cloud platform for use by cloud services.

[0022] Example System

[0023] Figure 1 An example system 100 is shown that includes multiple computing devices, including server computing devices 110, 110a, 110b and client computing devices 120, 130, and 140, and a storage system 150. The computing devices and storage system 150 are connected via a network 160.

[0024] like Figure 1 As shown, each of computing devices 110 and 140 may include one or more processors, memory, data, and instructions. For example, server computing device 110 includes one or more processors 172, memory 174, instructions 176, and data 178. Although only the components of a single server computing device are shown, any number of server computing devices having the same or different components as server computing device 110 may be included in system 100. For example, server computing devices 110a and 110b may have the same or different components as server computing device 110. Furthermore, the system may include any number of server computing devices.

[0025] The memory 174 stores information accessible by one or more processors 172, including instructions 176 and data 178 that can be read, written, manipulated, executed, or otherwise used by the processor(s) 172. The memory 174 can be of any type capable of storing information accessible by the processor(s), including computing device-readable media, or other media that stores data that can be read by an electronic device, such as a hard drive, memory card, ROM, RAM, DVD or other optical disk, and other writable and read-only memory. The systems and methods may include different combinations of the foregoing, whereby different portions of the instructions and data are stored on different types of media.

[0026] Instructions 176 can be any set of instructions to be executed directly by processor 172 (such as machine code) or any set of instructions to be executed indirectly (such as a script). For example, the instructions can be stored as computing device code on a computing device readable medium. In this regard, the terms "instructions" and "program" are used interchangeably herein. The instructions can be stored in object code format for direct processing by the processor, or in any other computing device language, including scripts or sets of independent source code modules that are interpreted or pre-compiled as needed. The processes, functions, methods, and routines of the instructions are explained in more detail below.

[0027] Data 178 may be retrieved, stored, or modified by processor 172 according to instructions 176. As an example, data 178 associated with memory 174 may include data used to support services for one or more client devices (e.g., 120, 130, or more). Such data may include data supporting cloud services, virtualization, virtual machines, containers, jobs, containerized environments, hosted web-based applications, file sharing services, communication services, gaming, sharing video or audio files, or any other network-based service.

[0028] The one or more processors 172 may be any conventional processor, such as a commercially available CPU. Alternatively, the one or more processors may be a dedicated device, such as an ASIC or other hardware-based processor. Figure 1 The processor, memory, and other elements of the computing device 110 are functionally shown as being within the same box, but one of ordinary skill in the art will appreciate that the processor, computing device, or memory may actually include multiple processors, computing devices, or memories that may or may not be located or stored within the same physical enclosure. In one example, the server computing device 110 may include one or more server computing devices having multiple computing devices, such as a load balancing server farm, which exchanges information with different nodes of a network to receive data from, process data, and transmit data to other computing devices.

[0029] The server computing device 110 may function as a server that provides virtualization services, a containerized environment, or other such processes, including supporting one or more virtual machines or containers. The server computing device 110 also represents a cloud computing environment that houses multiple computing devices that function as host devices capable of providing or managing virtual machines or containerized environments.

[0030] The network 160 and intermediary nodes may include various configurations and protocols, including, for example, Bluetooth TM 、Bluetooth TM The present invention also includes short-range communication protocols such as LE, the Internet, the World Wide Web, an intranet, a virtual private network, a wide area network, a local area network, a private network using one or more company-proprietary communication protocols, Ethernet, WiFi, and HTTP, as well as various combinations of the foregoing. Such communication may be facilitated by any device capable of transmitting data to and from other computing devices, such as a wired and / or wireless network interface.

[0031] like Figure 1 As shown, each client computing device 120, 130, 140 may be a personal computing device intended for use by a user and having all components typically used in conjunction with a personal computing device, including one or more processors (e.g., a central processing unit (CPU)), memory (e.g., RAM and an internal hard drive) to store data and instructions, a display such as a display 124, 134, 144 (e.g., a monitor with a screen, a touch screen, a projector, a television, or other device operable to display information), speakers, and user input devices 126, 136, 146 (e.g., a mouse, keyboard, touch screen, or microphone). The client computing device may also include a camera for recording a video stream, speakers, a network interface device, and all components for connecting these elements to each other. Although Figure 1 Only three client computing devices are shown in FIG, but system 100 may include virtually any number of such devices.

[0032] The client computing device 140 may also be a workstation associated with a network device (e.g., one or more server computing devices 110) and used for administration and / or maintenance, including serving as a backup system. In this regard, the client computing device 140 may be operated by a network administrator who supports, maintains, and manages the services provided by the server computing devices 110. With respect to maintenance, the client computing device 140 may enable the network administrator to access information about the server, such as the current version of the software running on the server and to install updates, patches, etc. It may also be used to access information about the storage system 150, such as disk size, overwrite rate, etc. Again, although in Figure 1Only a single backend client device 140 is depicted in FIG, but the system may actually have any number of such devices.

[0033] Although client computing devices 120-140 may each comprise a full-size personal computing device, they may alternatively comprise mobile computing devices capable of wirelessly exchanging data with a server computing device (such as server computing device 110) over a network such as the Internet. By way of example only, client computing device 120 may be a mobile phone or a device such as a wireless-enabled PDA, tablet PC, wearable computing device or system, or netbook capable of obtaining information via the Internet or other network. In another example, client computing device 130 may be a wearable computing system, such as a smartwatch. As examples, a user may input information using a keypad, a keyboard, a microphone, using visual signals and a camera, or a touch screen.

[0034] As with memory 174, storage system 150 can be any type of computerized storage capable of storing information accessible by server computing device 110, such as a hard drive, disk, memory card, ROM, RAM, DVD, CD-ROM, writable and read-only memory. Furthermore, storage system 150 can include a distributed storage system in which data is stored on multiple different storage devices, which can be physically located in the same or different geographic locations. Storage system 150 can be connected to the computing devices via network 160 as shown, and / or can be directly connected to or incorporated into any of computing devices 110-140, etc. Storage system 150 can store various types of information, as described in more detail below. This information can be retrieved or otherwise accessed by one or more server computing devices, such as server device 110, and / or one or more client computing devices, such as client computing device 120, to perform some or all of the features described herein.

[0035] Figure 2 is a functional block diagram of a system 200 according to various aspects of the present disclosure. System 200 includes hosts 210a and 210b that can be configured to operate one or more virtual machines or containerized environments. For example, host 210a runs virtual machines 230a including VM1 and VM2, and host 210b runs virtual machines 230b including VM3 and VM4. A VM essentially includes a computer that does not run on its own dedicated hardware but is hosted on some hardware that may run multiple VMs. Although host 210a is shown as executing VM 230a including VM1 and VM2 and host 210b is shown as hosting VM 230b including VM3 to VM4, each host can run any number of virtual machines. In addition, the system can include any number of hosts.

[0036] Each host includes one or more processing devices, volatile memory, and non-volatile memory. For example, host 210a includes processing device 204a, volatile memory 208a, and non-volatile memory 212a. Similarly, host 210b includes processing device 204b, volatile memory 208b, and non-volatile memory 212b. Each of the one or more hosts 210a, 210b is operable to execute programmed instructions that may be stored in memory. Host 210a may include a server such as server 110, and host 210b may include a server such as server 110a.

[0037] Each host 210a, 210b can communicate with the disk. Figure 2 As shown, host 210a communicates with disk 250a, while host 210b communicates with disk 250b. Although hosts 210a and 210b are shown as separate, the disks can be a single unit. In addition, each host can be connected to multiple disks. Each disk 250a, 250b is a storage device that can be partitioned to provide physical or virtual storage used by VMs 230a, 230b to provide computing services. In this regard, host 210a can include partitioned memory corresponding to VM 230a - memory 1, memory 2, and host 210b can include partitioned memory corresponding to VM 230b - memory 3, memory N. Each partition can correspond to a single VM or a group of VMs.

[0038] Example Method

[0039] Figure 3 300 is a flowchart illustrating a method for optimizing a VM cluster. As shown in flowchart 300, the method includes inputting VM data into one or more matrices at block 302, truncating the matrices at block 304, performing hierarchical clustering at block 306, merging clusters at block 308, and performing additional clustering at block 310. The process may also include implementing the resulting cluster of virtual machines in the information technology infrastructure of the cloud platform for use by cloud services. Although the examples described herein relate to virtual machine clustering, the processes and systems described herein may also be applied to other processes. For example, the steps performed to optimize a virtual machine cluster may be used to optimize processes such as job allocation in a containerized environment.

[0040] The VMs to be clustered may be VMs used to execute cloud services of a publisher operating on a cloud platform. The cloud platform may execute VMs such as VM1 and VM2 on host 210a and VM3 and VM4 on host 210b. The number of virtual machines executed by a host may be predefined, variable based on the computing resource requirements of the cloud service, and / or defined by the cloud platform or the publisher of the cloud service.

[0041] Operational data generated, transmitted, and / or received by the VMs implementing the cloud service may include confidential and / or proprietary information of the publisher or users of the publisher's cloud service. Such data is referred to herein as "private data" and may also be referred to as personally identifiable information. To maintain the confidentiality of such private data, the operational data relied upon by the optimized VM cluster as described herein may be information that does not include any such private data. For example, the operational data may include traffic data between each of the VMs implementing the cloud service. The traffic data may include one or more values ​​indicating the amount of traffic (such as a number of packets, bits, bytes) transmitted between the VMs or other such metrics transmitted between the VMs. In the case where other processes are being allocated, the traffic data may include one or more values ​​indicating the amount of traffic transmitted between each process. For example, the traffic data may include values ​​indicating the amount of traffic transmitted between jobs, containers, and / or container environments.

[0042] As shown in block 302, operational data associated with the VM may be input into one or more matrices. For example, business data may be provided to a client computing device such as client computing device 140 from one or more hosts on which the VM is executed. Alternatively, business data may be recorded by the host and stored in a central location, such as storage system 150 or internal memory in the host, from which client computing device 140 may pull data or request that data be forwarded to the central location. Although the above embodiments describe providing business data for performing the methods described herein to a client computing device, these methods may be performed by host(s) and / or other server computing devices such as server computing device 110.

[0043] Figure 4 An example matrix 401 is shown that is formed by inputting data for a set of VMs (VM1 and VM2, VM3 and VM4) used to implement a cloud service. The size of the matrix is ​​determined by the number of VMs undergoing cluster optimization. For example, if "N" VMs are undergoing cluster optimization, the size of the matrix can be N×N. The size of matrix 401 is 4×4 because four VMs - VM1 and VM2, VM3 and VM4 - are optimized. Although four VMs corresponding to the number of VMs implementing the cloud service are shown in matrix 401, the matrix can be smaller than the total number of VMs implementing the cloud service. For example, according to the technology described herein, only a portion of the VMs implementing the cloud service can be selected for cluster optimization.

[0044] The rows of the matrix may represent the traffic from the VM, and each column may represent the traffic received by the VM. For example, the entry VM 1-2 Represents the traffic from VM1 to VM2 and received by VM2 from VM1. Similarly, the entry VM 3-4Indicates the service data from VM3 to VM4 and received by VM4 from VM3, and the entry VM N-1 represents traffic data from VM4 to VM1 and received by VM1 from VM4. Although entries may be included for each pair of VMs, only a few entries are shown in matrix 401 for clarity. Figure 4 Traffic between VMs is shown, but traffic between other processes such as job allocation can be entered into one or more matrices as described herein.

[0045] In some instances, multiple types of business data may be used for cluster optimization. In this regard, each data type may be placed into its own matrix. For example, matrix 401 may include business data containing bytes, while another 4×4 matrix 402 may include the number of packets transmitted between VM pairs. The matrices may be concatenated together to form a multi-dimensional N×(2)N matrix 403. Although Figure 4 A matrix with (2)N dimensions is shown, but additional dimensions may be added for each additional type of business data and / or other operational data. For example, for four types of business data, an N x (4)N dimensional matrix may be formed.

[0046] The entries in the matrix, including each entry in any concatenated matrix, can be scaled to make the entries comparable to each other. For example, VM1 can handle a larger amount of processing than VM2, but each VM (VM1 and VM2) can handle the same type of functionality for the cloud service. To provide an accurate comparison between the two VMs, the operational data in each entry can be normalized. For example, a quantile transform can be used to remap the feature vector to a standard uniform distribution, effectively transforming the range of values ​​to a consistent and known range, such as [0, 1] or some other such range.

[0047] like Figure 3 As shown in the box 304 of , matrix 401 can be truncated to reduce the dimensionality of matrix.For example, single value decomposition truncation (TruncatdSVD) or some other truncation methods (such as principal component analysis (PCA)) can be used to reduce the dimensionality in matrix 401.Dimensionality reduction process can use each row of feature matrix as sampling point and each column as feature.This helps to truncate (or remove) the lowest effective direction in the column (feature) space of this matrix.For the matrix with a large amount of virtual machines (such as thousands), dimension can be reduced to only hundreds or less.Except retaining the highest effective direction in the column (feature) space, this truncation of matrix reduces the required computational effort of performing additional method step as described herein.

[0048] like Figure 3As shown in block 306 of

[0066] , hierarchical clustering can be performed on the truncated matrix. Hierarchical clustering recursively merges similar singletons or clusters together until only one cluster remains. A singleton can be considered a single VM, while a cluster can be two or more VMs. In one example, Ward links can be used to determine which singletons and clusters to merge together at each iteration. In this regard, pairs of clusters and / or singletons with the lowest variance can be merged together.

[0049] At the end of hierarchical clustering, a dendrogram can be produced. Figure 5 An example dendrogram 500 including leaf nodes and non-leaf nodes is shown. The leaf nodes (VM1-VM8) represent VMs, and the non-leaf nodes (502-512) represent merging points of clusters formed during the linking described above with respect to block 306.

[0050] like Figure 3 As shown in block 308 of , the algorithm can "cut" the dendrogram to form clusters by merging clusters. In order to decide where to "cut" the dendrogram, an inconsistency metric can be used. For example, for a given non-leaf node with height h in the dendrogram, if its subtree contains nodes with height H = {h0, h1, ...} and the mean of the height is H, and the standard deviation is σ(H), then the inconsistency (inc) of the node is: inc = (hH) / σ(H). When deciding whether to merge two subtrees (or nested clusters), the inconsistency metric quantifies the degree of difference between the new merged cluster and the nested clusters within it. A low value means that the merged cluster will be similar to the nested cluster below it. Conversely, a high inconsistency means that the merged cluster contains completely different nested clusters. This ultimately produces a distribution of inconsistency metric values. At this point, the "inflection point" of the cumulative distribution function of the inconsistency distribution can be used as a cutting threshold. Specifically, the "inflection point" helps identify the point where the distribution is (approximately) stationary, which helps determine the appropriate cutoff for the inconsistency threshold. Cutting the dendrogram in this way produces clusters with consistent business patterns within each cluster.

[0051] In some cases, as shown in block 310, another round of clustering can be performed to merge similar clusters. Additional merging can be performed by calculating the centroid (also known as the feature mean) of each cluster. The similarity between each centroid can be determined, and a threshold can be used to determine whether two centroids are considered sufficiently similar to be merged. For example, if the similarity is below a threshold, the clusters can be merged. The resulting VM clusters can be implemented in the information technology infrastructure of the cloud platform for use by cloud services.

[0052] Although the present technology has been described with reference to specific embodiments, it should be understood that these embodiments are merely illustrative of the principles and applications of the present technology. It should be understood that many modifications can be made to the illustrative embodiments and that other arrangements can be devised without departing from the spirit and scope of the present technology as defined by the appended claims.

[0053] Unless otherwise stated, the foregoing alternative systems, methods, and examples are not mutually exclusive, but may be implemented in various combinations to achieve unique advantages. Since these and other variations and combinations of the above-described features may be utilized without departing from the subject matter defined by the claims, the above description of the embodiments should be understood by way of illustration, rather than by way of limitation, of the subject matter defined by the claims. In addition, the provision of examples described herein and clauses worded “such as,” “including,” etc. should not be construed as limiting the subject matter of the claims to specific examples; rather, these examples are intended to illustrate only one of many possible embodiments. In addition, the same reference numerals in different figures may identify the same or similar elements.

Claims

1. A method for clustering processes, comprising: receiving, by one or more processors, business data transmitted and received between each pair of processes in the process set; generating, by the one or more processors, a matrix based on the business data, the matrix comprising a row and a column for each process in the process set, wherein the matrix is ​​a multidimensional matrix comprising concatenated matrices for each type of business data, the multidimensional matrix having dimensions N×(XN), wherein N is the number of processes in the process set and X is the number of concatenated matrices; performing, by the one or more processors, hierarchical clustering on the matrix based on the business data, the hierarchical clustering outputting a plurality of clusters, each cluster including one or more processes in the process set; and The plurality of clusters are merged, by the one or more processors, into a set of merged process clusters. 2 . The method of claim 1 , further comprising implementing the merged set of process clusters on a cloud platform.

3. The method according to claim 1, wherein Each entry in the matrix includes traffic data transmitted by the process corresponding to the row of the entry and received by the process corresponding to the column of the entry.

4. The method according to claim 3, wherein: The traffic data includes one or more of: a plurality of packets, bits, or bytes communicated between each pair of processes in the set of processes, and wherein the traffic data does not include personally identifiable information.

5. The method according to claim 1, wherein Hierarchical clustering of the matrix includes hierarchically linking each process or cluster of processes together.

6. The method according to claim 5, wherein: The hierarchical links include Ward links that output a tree diagram representing each process in the process set as a leaf node and each process cluster in the process clusters as a non-leaf node.

7. The method according to claim 6, wherein: Merging the plurality of clusters includes cutting the dendrogram at a merge point.

8. The method of claim 1, further comprising clustering the merged set of process clusters.

9. A computing system for clustering processes, comprising: one or more computing devices; one or more computer-readable storage media; as well as Program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more computing devices, the program instructions causing the one or more computing devices to: receiving business data transmitted and received between each pair of processes in the process set; generating a matrix based on the business data, the matrix comprising a row and a column for each process in the process set, wherein the matrix is ​​a multidimensional matrix comprising matrices for each type of business data concatenated together, the multidimensional matrix having dimensions N×(XN), wherein N is the number of processes in the process set and X is the number of concatenated matrices; Performing hierarchical clustering on the matrix based on the business data, wherein the hierarchical clustering outputs a plurality of clusters, each cluster including one or more processes in the process set; and The plurality of clusters are merged into a set of merged process clusters.

10. The system according to claim 9, wherein: The instructions further cause the one or more computing devices to implement the merged set of process clusters on a cloud platform.

11. The system according to claim 9, wherein: Each entry in the matrix includes traffic data transmitted by the process corresponding to the row of the entry and received by the process corresponding to the column of the entry.

12. The system according to claim 11, wherein The traffic data includes one or more of: a plurality of packets, bits, or bytes communicated between each pair of processes in the set of processes, and wherein the traffic data does not include personally identifiable information.

13. The system according to claim 9, wherein: Hierarchical clustering of the matrix includes hierarchically linking each process or cluster of processes together.

14. The system according to claim 13, wherein: The hierarchical links include Ward links that output a tree diagram representing each process in the process set as a leaf node and each process cluster in the process clusters as a non-leaf node.

15. The system according to claim 14, wherein: Merging the plurality of clusters includes cutting the dendrogram at a merge point.

16. The system according to claim 9, wherein: The instructions further cause the one or more computing devices to cluster the merged set of process clusters.

17. A non-transitory computer-readable medium containing program instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform the following steps: receiving business data transmitted and received between each pair of processes in the process set; A matrix is ​​generated based on the business data, the matrix including a row and a column for each process in the process set, wherein: The matrix is ​​a multidimensional matrix comprising concatenated matrices for each business data type, the multidimensional matrix having dimensions N×(XN), where N is the number of processes in the process set and X is the number of concatenated matrices; Performing hierarchical clustering on the matrix based on the business data, wherein the hierarchical clustering outputs a plurality of clusters, each cluster including one or more processes in the process set; as well as The plurality of clusters are merged into a set of merged process clusters.

18. The non-transitory computer-readable medium of claim 17, wherein: The instructions further cause the one or more computing devices to implement the merged set of process clusters on a cloud platform.

Images