Random event classification for artificial intelligence for information technology operations

Abstract

This disclosure relates to random event classification using artificial intelligence for information technology operations. A computer-implemented method, computer program product, and computer system for random event classification are provided. The computer receives an event log including timestamps and event types. The computer determines a sparse influence matrix representing causal relationships between event types through cardinality regularization. The computer determines trigger probabilities representing the probability of causal associations between individual event instances by utilizing variational bounds of the likelihood function. The computer provides the trigger probabilities to a user for event classification. The computer learns model parameters through iterative type-level causal analysis and instance-level causal analysis.

Description

Technical Field

[0001] This invention generally relates to the classification of random events in artificial intelligence for information technology operations (AIOps), and more specifically to a framework for not only learning causal relationships between event types but also determining the probability of causal associations between event instances. Background Technology

[0002] Event classification for "alert" events typically involves prioritizing a large number of events to generate a short list of important events. A key subtask for this objective is identifying and prioritizing time-series event instances that are causally related to the events of interest.

[0003] Modeling timestamped events using point processes is an emerging research topic in machine learning (ML) that has recently gained considerable attention. Unlike mainstream ML problems that deal with independent and identically distributed vector data, these problems require treating individual events as random objects without aggregation. In particular, Hawkes processes are a popular point process model used in this context (Hawkes, Spectra of some self-exciting and mutually exciting pointprocesses, Biometrika, Vol. 58, 1971). In the ML literature, there have been two major milestones in the study of Hawkes processes to date. One is the minimization-maximization (MM) algorithm (Hunter et al., A tutorial on MM algorithms, The American Statistician, 58(1), 2004), and the other is Granger causal discovery through Hawkes processes (Granger, Investigating causal relations by econometric models and cross-spectral methods, Econometrica, 37(3), 1969).

[0004] The first milestone is marked by Veen and Schoenberg (Estimation of space-time branching process models in seismology using an EM-type algorithm, Journal of the American Statistical Association, 103(482), 2008). Based on an intuition about the branching process of earthquake aftershocks, they introduced the first MM-based maximum likelihood algorithm, often loosely referred to as EM (Expectation Maximization) due to its similarity (Neal et al., A view of the EM algorithm that justifies incremental, sparse, and other variants, Learning in graphical models, 1998). Maximum likelihood estimation (MLE) based on standard gradients for multivariate Hawkes processes suffers from numerical stability problems, limiting their applicability in practice. The second milestone is achieved through some pioneering work in Hawkes-based Granger causal modeling. Kim et al. (A Granger causality measure for point process models of ensembleneural spiking activity, PLoS Comput Biol, 7(3), 2011) proposed Hawkes-based causal learning. Zhou et al. (Learning social infectivity in sparse low-rank networks using multi-dimensional Hawkes processes, Proceedings of the 16th International Conference on Artificial Intelligence and Statistics, 2013) introduced L1 regularization in the MLE of multivariate Hawkes processes. Eichler et al. (Graphical modeling for multivariate Hawkes processes with nonparametric link functions, arXiv:1605.06759v1, 2016) theoretically established an equivalence relationship between Hawkes-based causality and Granger causality.

[0005] Given these achievements and the well-known importance of sparsity in Granger causal learning (Arnold et al., Temporal causal modeling with graphical Granger methods. In Proc. ACM SIGKDD, 2007; Lozano et al., Grouped graphical granger modeling for gene expression regulatory network discovery, Bioinformatics, 2009), the MM algorithm combined with a sparse-enforced regularization term appears to be a promising path for solid solutions. However, interestingly, the likelihood function of the MM algorithm exhibits a singularity that effectively forbids any sparse solution. Regardless of its importance, this problem has received little attention in the ML community to date. Summary of the Invention

[0006] In one aspect, a computer-implemented method for classifying random events is provided. The computer-implemented method includes receiving an event log, wherein the event log includes a timestamp and an event type. The computer-implemented method further includes determining a sparse influence matrix representing causal relationships between event types via cardinality regularization. The computer-implemented method further includes determining trigger probabilities representing the probability of causal associations between individual event instances by utilizing variational bounds of a likelihood function. The computer-implemented method further includes providing the trigger probabilities to a user for event classification.

[0007] The computer-implemented method for classifying random events also includes determining the baseline strength of the corresponding event type within the event types, wherein the baseline strength provides information about how each event type within the event types tends to occur independently without any triggering event. The computer-implemented method also includes determining the decay rate of the corresponding event type within the event types, wherein the decay rate provides information about the time scale of the corresponding event type within the event types.

[0008] The computer-implemented method for classifying random events further includes learning model parameters through iterative type-level causal analysis and instance-level causal analysis. The type-level causal analysis includes determining the sparse influence matrix, the baseline strength of the corresponding event type within the event types, and the decay rate of the corresponding event type within the event types. The instance-level causal analysis includes determining the trigger probability.

[0009] The computer-implemented method for classifying random events also includes generating initial trigger probabilities. This computer-implemented method further includes calculating baseline strength, decay rate, and sparse influence matrix based on the initial trigger probabilities.

[0010] The computer-implemented method for classifying random events further includes updating the trigger probability in the current round of computation based on the baseline strength, decay rate, and sparse influence matrix calculated in the previous round. The method also includes updating the baseline strength, decay rate, and sparse influence matrix based on the already updated trigger probability. Furthermore, the method outputs the updated trigger probability in the current round of computation in response to determining that the baseline strength, decay rate, and sparse influence matrix have converged. Finally, the method iteratively updates the trigger probability, baseline strength, decay rate, and sparse influence matrix in response to determining that the baseline strength, decay rate, and sparse influence matrix have not converged.

[0011] On the other hand, a computer program product for classifying random events is provided. The computer program product includes a computer-readable storage medium having program instructions contained therein, and the program instructions are executable by one or more processors. The program instructions are executable to: receive an event log including timestamps and event types; determine a sparse influence matrix representing causal relationships between the event types via cardinality regularization; determine trigger probabilities representing the probability of causal association between individual event instances by utilizing variational bounds of a likelihood function; and provide the trigger probabilities to a user for event classification.

[0012] In a computer program product for classifying random events, program instructions may also be executed to determine the baseline strength of a corresponding event type within an event type, wherein the baseline strength provides information about how each event type within the event type has a tendency to occur independently in the absence of any triggering event. The program instructions may also be executed to determine the decay rate of a corresponding event type within the event type, wherein the decay rate provides information about the time scale of the corresponding event type within the event type.

[0013] In a computer program product for classifying random events, program instructions can also be executed to learn model parameters through iterative type-level causal analysis and instance-level causal analysis, wherein type-level causal analysis includes determining a sparse influence matrix, the baseline strength of the corresponding event type in the event type, and the decay rate of the corresponding event type in the event type, and instance-level causal analysis includes determining the trigger probability.

[0014] In a computer program product for classifying random events, program instructions may also be executable to generate initial trigger probabilities. These instructions may further be executable to calculate the baseline strength, the decay rate, and the sparse influence matrix based on the initial trigger probabilities.

[0015] In a computer program product for classifying random events, the program instructions may also execute to: update the trigger probability in the current round of computation based on the baseline strength, the decay rate, and the sparse influence matrix calculated in the previous round of computation; update the baseline strength, the decay rate, and the sparse influence matrix based on the already updated trigger probability; output the trigger probability already updated in the current round of computation in response to determining that the baseline strength, the decay rate, and the sparse influence matrix have converged; and iteratively update the trigger probability, the baseline strength, the decay rate, and the sparse influence matrix in response to determining that the baseline strength, the decay rate, and the sparse influence matrix have not converged.

[0016] In another aspect, a computer system for classifying random events is provided. The computer system includes one or more processors, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more computer-readable tangible storage devices for execution by at least one of the one or more processors. The program instructions are executable to receive an event log containing timestamps and event types. The program instructions are also executable to determine a sparse influence matrix representing causal relationships between the event types via cardinality regularization. The program instructions are also executable to determine trigger probabilities representing the probability of causal associations between individual event instances by utilizing variational bounds of a likelihood function. The program instructions are further executable to provide a user with the trigger probabilities of event classification.

[0017] In a computer system for classifying random events, the program instructions may also be executed to: determine the baseline strength of a corresponding event type among the event types, wherein the baseline strength provides information about how each event type among the event types has a tendency to occur independently in the absence of any triggering event; and determine the decay rate of a corresponding event type among the event types, wherein the decay rate provides information about the time scale of the corresponding event type among the event types.

[0018] In a computer system used for random event classification, program instructions can also be executed to learn model parameters through iterative type-level causal analysis and instance-level causal analysis. The type-level causal analysis includes determining the sparse influence matrix, the baseline strength of the corresponding event type within the event types, and the decay rate of the corresponding event type within the event types. The instance-level causal analysis includes determining the trigger probability.

[0019] In a computer system used for random event sorting, the program instructions can also be executed to: generate an initial trigger probability; and calculate a baseline strength, decay rate, and sparse influence matrix based on the initial trigger probability.

[0020] In a computer system for classifying random events, the program instructions may also execute to update the trigger probability in the current round of computation based on the baseline strength, the decay rate, and the sparse influence matrix calculated in the previous round. The program instructions may further execute to update the baseline strength, the decay rate, and the sparse influence matrix based on the already updated trigger probability. The program instructions may further execute to output the trigger probability already updated in the current round of computation in response to determining that the baseline strength, the decay rate, and the sparse influence matrix have converged. The program instructions may further execute to iteratively update the trigger probability, the baseline strength, the decay rate, and the sparse influence matrix in response to determining that the baseline strength, the decay rate, and the sparse influence matrix have not converged.

[0021] In another aspect, a computer-implemented method for learning model parameters in random event classification is provided. This computer-implemented method includes updating the baseline strength of a corresponding event type within an event type based on trigger probabilities, wherein the baseline strength provides information about how each event type within the event type tends to occur independently in the absence of any triggering event, and wherein the trigger probabilities represent the causal association probabilities between individual event instances. The computer-implemented method also includes updating the decay rate of a corresponding event type within an event type based on the trigger probabilities, wherein the decay rate provides information about the time scale of the corresponding event type within the event type. The computer-implemented method further includes updating a sparse influence matrix based on the trigger probabilities, wherein the sparse influence matrix represents the causal relationships between event types. The computer-implemented method also includes updating the trigger probabilities based on the baseline strength, decay rate, and sparse influence matrix. The computer-implemented method further includes providing a user with trigger probabilities for event classification in response to determining that the baseline strength, decay rate, and sparse influence matrix have converged.

[0022] The computer-implemented method for learning model parameters in random event classification also includes receiving a predetermined constant for the regularization strength. The computer-implemented method further includes generating an initial trigger probability. The computer-implemented method also includes calculating the baseline strength, decay rate, and sparse influence matrix based on the initial trigger probability.

[0023] The computer-implemented method for learning model parameters in random event classification also includes iteratively updating the baseline strength, decay rate, sparse influence matrix convergence and trigger probability in response to the non-convergence of the baseline strength, decay rate, and sparse influence matrix.

[0024] In another aspect, a computer program product is provided for learning model parameters in random event classification. The computer program product includes a computer-readable storage medium having program instructions contained therein, and the program instructions are executable by one or more processors. The program instructions are executable to: update the baseline strength of a corresponding event type in an event type based on trigger probabilities, wherein the baseline strength provides information about how each event type in the event type has a tendency to occur independently in the absence of any triggering event, wherein the trigger probabilities represent the causal association probabilities between individual event instances; update the decay rate of the corresponding event type in the event type based on the trigger probabilities, wherein the decay rate provides information about the time scale of the corresponding event type in the event type; update a sparse influence matrix based on the trigger probabilities, wherein the sparse influence matrix represents the causal relationships between the event types; update the trigger probabilities based on the baseline strength, the decay rate, and the sparse influence matrix; and provide the trigger probabilities for event classification to a user in response to determining that the baseline strength, the decay rate, and the sparse influence matrix have converged.

[0025] In a computer program product for learning model parameters in random event classification, the program instructions may also be executed to: receive a predetermined constant for regularization strength; generate an initial trigger probability; and calculate a baseline strength, decay rate, and sparse influence matrix based on the initial trigger probability.

[0026] In a computer program product for learning model parameters in random event classification, program instructions can also be executed to iteratively update the baseline strength, decay rate, sparse influence matrix convergence and trigger probability in response to the determination that the baseline strength, decay rate, and sparse influence matrix do not converge. Attached Figure Description

[0027] Figures 1(A) and 1(B) illustrate two key results of the framework proposed in this invention according to an embodiment of the invention: the triggering probability and the influence matrix.

[0028] Figure 2 Intensity and decay functions for different event types are shown according to an embodiment of the present invention.

[0029] Figure 3 The overall computational process of the framework proposed in this invention is shown according to an embodiment of the invention.

[0030] Figure 4 A flowchart illustrating the learning model parameters and the operational steps for determining the trigger probability based on the model parameters according to an embodiment of the present invention is presented.

[0031] Figures 5(A), 5(B), and 5(C) show a comparison of the sparsity pattern of the influence matrix A estimated by the framework proposed in this invention with existing methods in the prior art.

[0032] Figure 6(A) shows the non-zero elements of the trigger probability according to an embodiment of the present invention.

[0033] Figure 6(B) shows the triggering probability of the 150th instance according to an embodiment of the present invention.

[0034] Figure 7 This is a diagram illustrating components of a computing device or server according to an embodiment of the present invention.

[0035] Figure 8 A cloud computing environment according to an embodiment of the present invention is described.

[0036] Figure 9 An abstract model layer in a cloud computing environment according to an embodiment of the present invention is shown. Detailed Implementation

[0037] Embodiments of this invention propose a unified approach to the problem, in which not only are causal relationships learned between various event types, but also the probabilities of causal associations between individual event instances are determined. For the former, embodiments of this invention develop cardinality regularization techniques during the fitting of multivariate Hawkes data. This achieves both accurate and sparse causal estimation, thereby facilitating effective event merging. For the latter, the framework proposed in this invention utilizes variational bounds of the likelihood function to discover causal association probabilities, thereby enabling simultaneous instance-level and type-level causal analysis.

[0038] Embodiments of this invention provide a mathematically well-defined solution for learning sparse causal relationships in event data, particularly in a scenario we call event classification. Specifically, consider the use case of cloud data center management. Various computer devices continuously generate large amounts of event logs. Due to the interconnectivity of devices, a warning event from one device, such as "response time too long," can trigger many related events in downstream services. The more critical the original error, the more redundant the resulting set of events tends to be. The act of event classification, or creating a short list of high-priority events, requires the task of associating and merging causally related event instances as a prerequisite. Note that this requires instance-specific causality for accurate judgment. For example, even if the i-th event type may be causally related to the j-th event type on average, a specific instance of the i-th event type may have already occurred spontaneously. Therefore, a practical solution for event classification must perform both type-level and instance-level causal analysis simultaneously, while fully handling the stochastic nature of events. Although the problem of "alarm fatigue" is prevalent in many industries (Elshoush et al., Alert correlation in collaborative intelligent intrusion detection systems - A survey. Applied Soft Computing, 2011; Moyne et al., Big data analytics for smart manufacturing: Case studies in semiconductor manufacturing, Processes, 2017; Dominiak et al., Prioritizing alarms from sensor-based detection models in livestock production – A review on model performance and alarm reducing methods, Computers and Electronics in Agriculture, 2017), to date, work on causal modeling using random events in this scenario has been limited.

[0039] Embodiments of this invention propose a novel framework for event classification based on a new cardinality-regularized MM algorithm. Compared with existing l1 regularization and l... 2,1Unlike regularization methods (Zhou et al., 2013; Xu et al., Learning Grangercausality for Hawkes processes, In Proc. International conference on machine learning, 2016), it avoids the pathological problem caused by logarithmic singularity at zero and achieves mathematically well-defined sparsity. The framework proposed in this invention utilizes the variational bounds of the MM algorithm to discover instance-level causal relationships, thereby simultaneously achieving instance-level causal learning and type-level causal learning, as shown in Figures 1(A) and 1(B). Figures 1(A) and 1(B) respectively show two main results of the proposed framework: (1) trigger probability quantifies instance-level causal relationships for event classification, and (2) influence matrix represents Granger causal relationships between event types / categories.

[0040] The next paragraph provides the problem setting and outlines the basics of the random point process.

[0041] Problem settings:

[0042] We provide an event sequence of N+1 event instances:

[0043]

[0044] Among them, t n and d n These are the timestamp and event type of the nth event, respectively. The timestamps are in non-decreasing order: t0 ≤ t1 ≤ … ≤ t N Sort. There exist D event types {1,2,…,D}, where D << N. The first timestamp t0 is taken as the origin of time. Therefore, the remaining N instances are considered as implementations of a random variable given d0. As a general rule, we use t or u as the free variable representing time, and those with subscripts represent instances.

[0045] The main goal of event classification is to calculate the instance trigger probability {q}. n,i}, where q n,i It is the probability that the nth event instance (n = 1, ..., N) is triggered by the i-th event (i = 0, ..., n). By definition, n ≥ i, and

[0046]

[0047] q n,n This is referred to as the self-triggered (or simply self) probability. Note that the instance trigger probability {q} is provided. n,iThis is equivalent to providing a weighted ranking of candidates, where the total weights are 1. The goal is to have as few candidates as possible by leveraging sparse causal learning.

[0048] In practice, event classification is primarily an unsupervised learning task. A typical use case is event filtering, which serves as an enhancement to existing monitoring systems. For example, an end user could be a system administrator (sysadmin) managing a computer system. The system administrator recognizes a fault in the system from external information sources (such as customer complaint calls), and then checks the probability of triggering events of interest.

[0049] Possibility of related events:

[0050] Since all events are assumed to be correlated, the most general probability model is the joint distribution of N events. Using the chain rule of probability density functions (pdfs), the joint distribution can be expressed as...

[0051]

[0052] in Indicates until t n-1 The history of events, that is,

[0053]

[0054] We use f(·) to symbolically represent pdf. This decomposition readily yields the definition of the basic likelihood function L0:

[0055]

[0056] This distribution Defined in t n-1 The normalization condition is satisfied in the domain ≤ t < ∞.

[0057] For event classification tasks, the first term in the summation of equation (5) plays a central role. Assume the second term... If it is a constant, then the second term is omitted in the summation.

[0058] Intensity function:

[0059] Given The intensity function is defined as the first event from t n-1 The probability density that occurs after that. This is a conditional density. When considering the density at t, the condition is read as "[t... n-1 "No event occurred in (t)". ​​Therefore,

[0060]

[0061] in Given history The intensity function of the d-th event type. Note that the right-hand side of equation (6) can be written as

[0062]

[0063] Integrating both sides of equation (6) and arranging the terms, we get

[0064]

[0065] It allows L0 to be represented based on intensity:

[0066]

[0067] Note the dependency of the event interval on n in the second term. When D > 1, summation on n cannot be performed in the second term because dn depends on n. This fact is sometimes mistakenly ignored in the literature.

[0068] The following paragraphs provide a concrete model for the intensity function and introduce the instance triggering probability {q}. b,i}

[0069] Intensity function and Granger causality:

[0070] Equations (6) and (9) apply to any point process. Here, we introduce a specific parameterization for the Hawkes process:

[0071]

[0072] Where μ d ≥0 is referred to as the baseline intensity of type d. It is an influence matrix (d,d) i ) element, and φ d (tt i ) is the decay function of type d. Baseline intensity (μ) d This provides information about how the d-th event type tends to occur independently in the absence of any triggering event. The influence matrix A shows the causal relationships between event types. The influence matrix is ​​also known as the kernel or trigger matrix. φ d Common choices are exponential and power distributions. For the exponential distribution,

[0073]

[0074] And regarding power distribution,

[0075]

[0076] Where, β d≥0 is called the decay rate of the d-th type, and it gives information about the time scale of the d-th event type, and η>1 is a hyperparameter. The reciprocal of 1 / β d This can be referred to as the effective window size for the d-th event type. For later use, we also define the dimensionless version as:

[0077]

[0078] Figure 2 Equation (10) is shown, where... Having an exponential distribution φ d We assume and Due to time decay, the effect of the second instance is greater than that of the fourth instance, although Larger. On the other hand, as shown by the dashed line, the first and third event instances have no effect on the probability of occurrence of the assumed d-th event type at any future time point. In fact, this is how Eichler et al. (2016) defined Granger noncausality in the Hawkes model (see also Achab et al., Uncovering causality from multivariate Hawkes integrated cumulants, Journal of Machine Learning Research, 18, 2018). Specifically, if the existence of past d′-type event instances has no effect on the probability of occurrence of the d-th event type, then the d′-th type is a Granger factorless type d. The additive form of equation (10) has a clear advantage in connecting with Granger causality. The influence matrix A represents Granger causality. For this purpose, the influence matrix A will be used to connect with the d-th event type. k The dependency introduced by the decay function may be redundant.

[0079] Introducing trigger probability:

[0080] like Figure 2 As shown, achieving sparsity in the influence matrix A is crucial for event classification. This directly leads to a reduction in the number of event candidates to be merged. To guarantee sparsity, we propose the following cardinality-regularized maximum likelihood:

[0081]

[0082]

[0083] Where ||A||0 is the cardinality of A, i.e., the number of non-zero elements, ||·||2 is the 2-norm, and ||·|| sIt is the Frobenius norm. and β represents the decay rate of the corresponding event type among the D event types {1,2,…,D}, and provides information about the time scale of the corresponding event type among the D event types. μ represents the baseline strength of the corresponding event type among the D event types {1,2,…,D}, and provides information about how each of the D event types has a tendency to occur independently in the absence of any triggering event. τ, v β v μ and v A It is a constant representing the regularization strength.

[0084] Even with τ = 0, numerically solving for the maximum likelihood estimate (MLE) is known to be challenging, primarily due to the nonlinear logarithmic term in equation (9). The minimization-maximization (MM) algorithm utilizes the additive structure of the Hawkes process in equation (10) to apply Jensen's inequality in a manner similar to the expectation-maximization (EM) algorithm used for mixture models (Neal et al., 1998). Specifically, we first rewrite equation (10) as

[0085]

[0086] in

[0087]

[0088] Through any distribution q on i n,i , making for Jensen's inequality guarantees that...

[0089]

[0090] By discussing q under normalization conditions n,i Maximize the right-hand side of the equation to obtain the tightest bound:

[0091]

[0092] Although in Jensen's inequality q n,i Introduced as a mathematical hypothetical, it opened a new door to instance-level causal analysis. We will... n,i This is interpreted as the probability that the nth instance has already been triggered by the i-th instance. When (1) the i-th instance is closer to the nth instance, and (2) its event type d... i The i-th instance has a higher trigger probability when the event type is more causally related to the n-th instance.

[0093] Note that equation (19) implements soft and adaptive windowing in event merging. A standard approach to instance-level causal discovery in the literature is "hard windowing" (e.g., Lin et al., Microscope: Pinpoint performance issues with causal graphs in micro-service environments, International Conference on Service-Oriented Computing, 2018), which means that if event instances occur within the same time window of a given size, they are causally related. In practice, different event types often have different timescales of impact, and manually adjusting the window size can be a difficult task.

[0094] Learning model parameters:

[0095] We use inequality (18) for parameter estimation. The lower bound of the likelihood function is now:

[0096]

[0097] Where we define Δ n,i and h n,i as follows:

[0098]

[0099]

[0100] Although the instance trigger probability {q n,i The MM algorithm depends on the unknown model parameters, but assumes they have been numerically obtained in some way. It alternately repeats {q}. n,i Estimates of} and (μ,β,A). If we define

[0101]

[0102] The entire process can then be concisely summarized as follows:

[0103] μ,β,A=argmaxL, given {q n,i}, (twenty four)

[0104] {q n,i}=(equation(19)), given μ, β, A. (25)

[0105] The following paragraphs provide details of the parameter estimation process for baseline intensity μ, attenuation rate β, and influence matrix A.

[0106] Estimation of baseline intensity μ:

[0107] Now, suppose we have {q} n,i For numerical estimation of μ, we consider the maximum likelihood solution. The optimal condition is... in

[0108]

[0109] For Kronecker difference. If we define

[0110]

[0111]

[0112] Equation (26) is simplified to a simple quadratic equation.

[0113]

[0114] We derive the solution from this.

[0115]

[0116] Estimation of the decay rate β:

[0117] Next, for β, the derivative is given by the following equation.

[0118]

[0119] Here, (n,i) varies on n=1,…,N and i=1,…,n-1. Similar to the case of μ, we also define

[0120]

[0121]

[0122] Optimality conditions It becomes a quadratic equation again.

[0123]

[0124] The solution is obtained

[0125]

[0126] Estimating the influence matrix A using cardinality regularization:

[0127] Now, let's discuss how to find A. In equation (24), the objective function L for A can be rewritten as:

[0128]

[0129] We define matrices Q and H using the following equation.

[0130]

[0131]

[0132] For ease of decomposition, the following definition is provided:

[0133]

[0134]

[0135]

[0136] We consider a vectorized version of the problem.

[0137]

[0138] Where q is maintained m ≥0, h m ≥0, v a >0. This is the main issue we consider when using cardinality regularization to estimate the influence matrix A.

[0139] Before getting to the details, let's see if we use or use the popular L1 or L2 here. 2,1 What will happen with the regularization term? The MM process is iterative. To make all instances eligible for event merging, we need to start from the initialization of q. m It starts at ≥0. In this case, due to the term lnx m Therefore, x m =0 will not be a solution, and therefore sparsity will not be achieved. In other words, the MM algorithm is incompatible with standard sparse regularization terms.

[0140] This is reminiscent of the problem of mixture models discussed by Phan et al. (l0-regularized sparsity for probabilistic mixture models. In Proc. SIAM Intl.Conf. Data Mining, SIAM, 2019). Here, we utilize their concept of "ε-sparsity". We introduce a small constant ε > 0 for sparsity assessment, which can be intuitively understood as a threshold below which elements are "turned off". Now our problem is...

[0141]

[0142]

[0143] Where I(·) is an indicator function that returns 1 when the argument is true, and 0 otherwise. We apply this to each k and m = D. 2 The problem involves finding each value of -‖x‖0. Let... Is it satisfying x m The set of indices of ≤∈. Now, the problem is rewritten as

[0144]

[0145] Using the Lagrange multiplier ξ m The Karush-Kuhn-Tucker (KKT) condition is given by the following equation.

[0146]

[0147]

[0148]

[0149] for We solve equation (48) to obtain

[0150]

[0151] in

[0152]

[0153] for There are two possibilities:

[0154]

[0155] The final question is how to select this set. This can be achieved by targeting The following formula can be easily calculated.

[0156]

[0157] Because ΔΨ m Seen as closing x m The gain, so we always ΔΨ m >0 will all be placed into m

[0158] The algorithm used to estimate the influence matrix using cardinality regularization is incorporated as part of the iterative MM process in equation (24). The total complexity is Similar to existing MM algorithms. For the input parameter ε, it can be determined intuitively by the fact that it is the closing threshold. For τ, we note that equation (36) can be viewed as having a Bernoulli prior. The MAP (Maximum A posteriori) estimate, where γ is the probability of finding 0 in the matrix elements, is obtained from the matrix elements. The value chosen by the user in 0.5 < γ < 1 determines τ. During the iterative MM process in equation (24), the parameter ν... A v β and v μ Stable convergence is crucial. It is recommended to start with small positive values, such as 10. -5 And if numerical problems arise, increase it. Finally, the parameters should be cross-validated using independent episodes of the event data. If the validation dataset is unavailable, the use of the Akaike Information Criterion (AIC) can be a viable approach, assuming that ‖A‖0 approximates the total number of the fitted free parameters. Table 1 summarizes L0Hawkes, the proposed algorithm, which is used as part of the iterative MM process in equation (24).

[0159] Table 1. An algorithm for estimating the influence matrix using cardinality regularization.

[0160]

[0161]

[0162] Figure 3 The overall computation process of the framework proposed in this invention is illustrated according to an embodiment of the present invention. The computation process of the proposed framework is implemented by a computing device or server. References are made in later paragraphs. Figure 7 The computing device or server is described in more detail. In some embodiments, the operational steps may be implemented in a cloud computing environment. References are made in later paragraphs. Figure 8 and Figure 9 Describe a cloud computing environment.

[0163] refer to Figure 3 The computing device or server receives the event log as input. The event log consists of N+1 event instances: Where t n It is a timestamp, and d n It is the event type of the nth event.

[0164] Further reference Figure 3 The computing device or server performs macro (type-level) causal analysis. The computing device or server uses macro (type-level) causal analysis to determine the causal relationships between various event types. The influence matrix A gives the causal relationships between event types. Achieving sparsity in the influence matrix A is crucial in event classification; therefore, the computing device or server determines the sparse influence matrix (A) via cardinality regularization.

[0165] Further reference Figure 3 In macro (type-level) causal analysis, the computing device or server determines the decay rate (β). β represents the decay rate of the corresponding event type among D event types {1,2,…,D} and provides information about the time scale of the corresponding event type among the D event types.

[0166] Further reference Figure 3 In macro (type-level) causal analysis, the computing device or server determines the baseline strength (μ). μ represents the baseline strength of the corresponding event type out of D event types. The baseline strength (μ) provides information about how each of the D event types tends to occur independently in the absence of any triggering event.

[0167] Further reference Figure 3 The computing device or server performs micro (instance-level) causal analysis. It determines the probability of causal associations between individual event instances. Trigger probability quantification is used to classify instance-based causal relationships for event classification. The computing device or server determines the trigger probability {q} by utilizing the variational bound of the likelihood function. n,i The two main results of the proposed framework are the instance triggering probability {q}. n,i} and influence matrix A. Simultaneous instance-level and type-level causal analysis is implemented as a practical solution for event classification. The computing device or server provides the trigger probability {q}. n,i As output, the trigger probability {q} is provided to the end user. n,i This can be used for event classification. A typical use case is to enhance event filtering in an existing monitoring system. In the example of managing a computer system, an end user becomes aware of certain errors in the system and then checks the probability of triggering events of interest.

[0168] Further reference Figure 3 The computing device or server learns model parameters, including baseline strength μ, decay rate β, and influence matrix A, through iterative macro (type-level) and micro (instance-level) causal analysis. The computing device or server iterates the analysis until the baseline strength μ, decay rate β, and influence matrix A converge. The operational steps for learning the model parameters will be referenced in later paragraphs. Figure 4 discuss.

[0169] Figure 4 A flowchart illustrating the learning model parameters and the operational steps for determining the trigger probability based on the model parameters according to an embodiment of the present invention is presented. Figure 4 The operational steps shown are implemented by a computing device or server. See later paragraphs for reference. Figure 7 The computing device or server is described in more detail. In some embodiments, the operational steps may be implemented in a cloud computing environment. References are made in later paragraphs. Figure 8 and Figure 9 Describe a cloud computing environment.

[0170] In step 401, the computing device or server receives a predetermined constant (τ, v) for the regularization strength. β ,ν μ ,ν A ,∈). The predetermined constants τ,ν have been discussed in previous paragraphs. β ,ν μ ,v A ,∈, and examples of their values ​​are presented in later paragraphs with reference to actual use cases.

[0171] In step 402, the calculation device or server generates an initial trigger probability {q}. n,i For example, a lower triangular matrix can be randomly generated using a chi-square distribution (for positive matrices), and then the lower triangular matrix can be normalized so that the sum of each row becomes 1.

[0172] In step 403, the calculation device or server uses the initial trigger probability {q} n,i The baseline strength (μ) is calculated by maximizing the likelihood function. This is based on the initial trigger probability {q}. n,i The baseline strength (μ) of the corresponding event type in the event type can be calculated using equation (30). The likelihood function is maximized when calculating the baseline strength (μ).

[0173] In step 404, the calculation device or server uses the initial trigger probability {q} n,i Maximize the likelihood function to calculate the decay rate (β). Based on the initial trigger probability {q} n,i The decay rate (β) of the corresponding event type in the event type can be calculated using equation (35). The likelihood function is maximized when calculating the decay rate (β).

[0174] In step 405, the calculation device or server uses the initial trigger probability {q} n,i The sparse influence matrix (A) is calculated using cardinality regularization. This is based on the initial trigger probability {q}. n,i The sparse influence matrix (A) is calculated using the algorithm given in Table 1.

[0175] It should be understood that steps 403 and 405 do not need to be performed in the order described above. Steps 403-405 can be performed in a different order than described above, or they can be performed simultaneously. The order in which the baseline intensity (μ), attenuation rate (β), and influence matrix (A) are calculated can be rearranged. The calculation of the baseline intensity (μ), attenuation rate (β), and influence matrix (A) can be completed in one step.

[0176] In step 406, the computing device or server updates the trigger probability {q} using the variational bound of the likelihood function based on the baseline intensity (μ), decay rate (β), and influence matrix (A). n,i Once the baseline intensity (μ), decay rate (β), and influence matrix (A) are estimated, the trigger probability {q} can be updated using equation (19). n,i}

[0177] In step 407, the computing device or server updates the baseline strength (μ), decay rate (β), and influence matrix (A) using the trigger probabilities updated in step 406. Similar to steps 403-405, the baseline strength (μ) of each event type in the event types is updated using equation (30), the decay rate (β) of each event type in the event types is updated using equation (35), and the sparse influence matrix (A) is updated using the algorithm given in Table 1.

[0178] In step 408, the computing device or server determines whether the baseline strength (μ), decay rate (β), and influence matrix (A) have converged. Convergence of the baseline strength (μ), decay rate (β), and influence matrix (A) is determined by comparing the baseline strength (μ), decay rate (β), and influence matrix (A) obtained in the previous round of calculation with the baseline strength (μ), decay rate (β), and influence matrix (A) obtained in the current round of calculation.

[0179] In response to the determination that the baseline strength (μ), decay rate (β), and influence matrix (A) do not converge (the "No" branch of decision block 408), the device or server iterates step 406. In response to the determination that the baseline strength (μ), decay rate (β), and influence matrix (A) converge (the "Yes" branch of decision block 408), in step 409, the device or server outputs the trigger probability {q}. n,i This provides users with trigger probabilities for event classification.

[0180] We validated the proposed framework with two real-world use cases, one from a power grid and the other from a cloud data center. Our focus is on demonstrating how the proposed framework (L0Hawkes) improves upon existing methods in the MM algorithm and showcasing its utility in real-world use cases. We compared L0Hawkes with two known MM-based sparse inference methods: those based on l1-regularization (Zhou et al., 2013) and those based on l... 2,1 - Regularization (Xu et al., 2016).

[0181] In the first practical use case, collaborating with public and private entities, we obtained fault event data for the US power grid. Fault events represent abrupt changes in voltage and / or current signals measured using phasor measurement units (PMUs) deployed geographically across the power grid. We are interested in discovering hidden causal relationships in a data-driven manner solely from time-event data.

[0182] The dataset records N=3811 fault events labeled "line outage" from D=22 PMUs over a period of more than 10 months in 2016. We performed a grid search on the model parameters based on AIC to obtain the parameters for (p μ ,v β ,μ A ) yields 5×(10 -3 10 -4 10 -4 And for (τ,ε), we get (1,1). The value of ε is equivalent to max. k,l A k,l Approximately 3%. We will target l1 and l 2,1 The regularization term uses the same τ. We use energy decay η = 2 to capture long-tail behavior.

[0183] Figure 5(A) shows the sparsity pattern of the influence matrix A estimated using L0Hawkes, Figure 5(B) shows the sparsity pattern of the influence matrix A estimated using l1 regularization, and Figure 5(C) shows the sparsity pattern of the influence matrix A estimated using l1 regularization. 2,1 The sparsity pattern of the influence matrix A estimated by the regularization term. These graphs compare the computed A, where non-zero matrix elements are shown in black. Using the l1 regularization term and l... 2,1 Regularization terms and zero terms only appear if they happen to be numerically zero. In contrast, L0Hawkes enjoys guaranteed sparsity. From the computation of A, the hidden causal structure between PMUs was successfully discovered.

[0184] In the second real-world use case, we apply L0Hawkes to a real-world event classification task. We obtain N = 718 alert events from a real cloud data center management system. These events are generated by filtering logs issued by network devices, and each event has its type: there are D = 14 unique event types in our dataset. In this real-world use case, we focus on demonstrating an example of instance-level causal analysis.

[0185] Figure 6(A) Visualizes the instance trigger probability {q} n,i The non-zero entries in}, where those q are omitted. n,i Entries < 0.01. As expected, {q n,iThe q is quite sparse, so event merging can be performed directly by selecting a non-zero trigger probability. Figure 6(B) shows a q 150,i For example, the rightmost slot (ETH_INIT) corresponds to the self-probability q. 150,150 For each i, its event type d i Shown below the bar. The type of event discussed, ETH_INIT, relates to the process of initializing the Ethernet interface. Note that in Figure 6(B), the self-probability of this instance is calculated as 0, while several previous instances of the same type have positive trigger probabilities, resulting in repeated successful suppression.

[0186] Due to the sparsity of A, many instances, despite being temporally close, have zero trigger probability (the six events with positive probabilities are within 27 seconds of the 150th event). For example, the dataset contains 416 instances of the event type UPDOWN, which has considerable noise added but is appropriately ignored by the proposed platform L0Hawkes. Unlike simple hard-windowing methods, our framework is able to filter out true causal relationships.

[0187] Figure 7 This is a diagram illustrating the components of a computing device or server 700 according to an embodiment of the present invention. It should be understood that... Figure 7 This is merely an illustration of an implementation and does not imply any limitation on the environments in which different embodiments may be implemented.

[0188] refer to Figure 7 The computing device or server 700 includes one or more processors 720, memory 710, and one or more physical storage devices 730. Figure 7 In this context, communication between the aforementioned components of the computing device or server 700 is indicated by reference numeral 790. The memory 710 includes ROM (Read-Only Memory) 711, RAM (Random Access Memory) 713, and one or more caches 715. One or more operating systems 731 and one or more computer programs 733 reside on one or more computer-readable tangible storage devices 730.

[0189] The computing device or server 700 also includes one or more I / O interfaces 750. The one or more I / O interfaces 750 allow data input and output using one or more external devices 760 that can be connected to the computing device or server 700. The computing device or server 700 also includes one or more network interfaces 740 for communication between the computing device or server 700 and a computer network.

[0190] This invention can be a system, method, and / or computer program product at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to perform aspects of the invention.

[0191] Computer-readable storage media can be tangible devices capable of retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable optical disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or recessed structures with instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0192] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device, or via a network, such as the Internet, a local area network (LAN), a wide area network (WAN), and / or a wireless network, to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the respective computing / processing device.

[0193] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as C or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, to perform aspects of this invention, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions to personalize the electronic circuits by utilizing the status information of the computer-readable program instructions.

[0194] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0195] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other devices to operate in a particular manner, such that the computer-readable storage medium in which the instructions are stored includes an article of writing comprising instructions for implementing aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0196] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus or other device, perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0197] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions indicated in the blocks may occur in a different order than indicated in the figures. For example, two blocks shown consecutively may actually be implemented as a single step, executed simultaneously, substantially simultaneously, with partial or complete time overlap, or these blocks may sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0198] It should be understood that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings set forth herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0199] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with service providers. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0200] The characteristics are as follows:

[0201] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring manual interaction with the service provider.

[0202] Wide Area Network (WAN) Access: Capabilities are available on the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0203] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. Location independence has significance because consumers typically do not control or know the exact location of the resources provided, but can specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0204] Rapid Flexibility: In some cases, the ability to scale outwards and inwards quickly and flexibly can be provided. For consumers, the available capacity often appears unlimited and can be purchased in any quantity at any time.

[0205] Measurement services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both the providers and consumers of the services being utilized.

[0206] The service model is as follows:

[0207] Software as a Service (SaaS): The capability offered to consumers is the ability to use the provider's applications running on cloud infrastructure. Applications can be accessed from various client devices through thin client interfaces such as web browsers (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0208] Platform as a Service (PaaS): This provides consumers with the ability to deploy consumer-created or acquired applications onto cloud infrastructure using programming languages ​​and tools supported by the provider. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of any application hosting environments.

[0209] Infrastructure as a Service (IaaS): This provides consumers with the capability to deliver processing, storage, networking, and other basic computing resources that enable them to deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but they do have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0210] The deployment model is as follows:

[0211] Private cloud: Cloud infrastructure operated solely by an organization. It can be managed by the organization or a third party and can exist inside or outside a building.

[0212] Community cloud: Cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0213] Public cloud: Cloud infrastructure available to the general public or large industrial groups and owned by organizations that sell cloud services.

[0214] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported together (e.g., cloud bursting for load balancing between clouds).

[0215] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure of a network of interconnected nodes.

[0216] Now for reference Figure 8 The diagram illustrates an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 that can communicate with local computing devices used by cloud consumers, such as mobile devices 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N. Nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service, without requiring cloud consumers to maintain resources on their local computing devices. It should be understood that the types of computing devices 54A-N are for illustrative purposes only, and that computing nodes 10 and the cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network-addressable connectivity (e.g., using a web browser).

[0217] Now for reference Figure 9 This demonstrates a cloud computing environment of 50 ( Figure 8 This provides a set of functional abstractions. It should be understood beforehand that... Figure 9 The components, layers, and functions shown are for illustrative purposes only, and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0218] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a host 61; a server 62 based on a RISC (Reduced Instruction Set Computer) architecture; a server 63; a blade server 64; a storage device 65; and a network and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0219] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0220] In one example, management layer 80 can provide the following functionalities: Resource Provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking when utilizing resources in the cloud computing environment, as well as billing or invoicing for consuming these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, and protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources, where future needs are anticipated according to the SLA.

[0221] Workload layer 90 provides examples of functions that can be utilized in a cloud computing environment. Examples of workloads and functions that can be provided from this layer include: drawing and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis and processing 94; transaction processing 95; and function 96. Function 96 in this invention is a function for artificial intelligence random event classification (AIOP) for information technology operations in a cloud computing environment.

Claims

1. A computer-implemented method for classifying random events, the computer-implemented method comprising: Receive event logs including timestamps and event types; The event logs are input into a machine learning model of a parameterized multivariate Hawkes process, which includes a baseline strength, a sparse influence matrix, and a decay function. The sparse influence matrix representing the causal relationship between the event types is determined via cardinality regularization, where the cardinality regularization is L0, and L0 is the regularization sparsity used for the probabilistic mixture model. The instance trigger probability representing the probability of causal association between individual event instances is determined by maximizing the variational lower bound of the likelihood function. The model parameters of the machine learning model are learned by iteratively performing type-level and instance-level causal analysis; and In response to the convergence of the baseline strength, decay rate, and sparse influence matrix, the instance trigger probability is provided to the user as the output of the machine learning model for event classification.

2. The computer-implemented method according to claim 1 further includes: Determine the baseline strength of the corresponding event type among the event types, wherein the baseline strength provides information about how each event type among the event types has a tendency to occur independently without any triggering event; and Determine the decay rate of the corresponding event type in the event types, wherein the decay rate provides information about the time scale of the corresponding event type in the event types, wherein the reciprocal of the decay rate is the effective window size of the corresponding event type in the event types, wherein the effective window size of the corresponding event type in the event types is used for adaptive window size adjustment, and wherein the decay rate is learned during the iteration of the minimization-maximization (MM) algorithm.

3. The computer-implemented method according to claim 1, wherein learning model parameters by iteratively performing type-level causal analysis and instance-level causal analysis further includes: Perform type-level causal analysis, wherein the type-level causal analysis includes determining the sparse influence matrix, the baseline strength of the corresponding event type in the event type, and the decay rate of the corresponding event type in the event type, wherein the baseline strength provides information about how each event type in the event type has a tendency to occur independently without any triggering event, and wherein the decay rate provides information about the time scale of the corresponding event type in the event type. as well as Perform instance-level causal analysis, wherein the instance-level causal analysis includes determining the instance trigger probability.

4. The computer-implemented method according to claim 3 further includes: The probability of generating the initial instance; The baseline strength, the decay rate, and the sparse influence matrix are calculated based on the initial instance trigger probability. In the current round of calculation, the instance trigger probability is updated based on the baseline strength, the decay rate, and the sparse influence matrix calculated in the previous round of calculation; Based on the already updated instance trigger probability, update the baseline strength, the decay rate, and the sparse influence matrix; In response to determining that the baseline strength, the decay rate, and the sparse influence matrix have converged, the instance triggering probability that has been updated in the current round of calculation is output; as well as In response to the determination that the baseline strength, the decay rate, and the sparse influence matrix do not converge, the instance trigger probability, the baseline strength, the decay rate, and the sparse influence matrix are iteratively updated.

5. A computer program product for classifying random events, the computer program product comprising program instructions executable by one or more processors, the program instructions being capable of performing the following: Receive event logs including timestamps and event types; The event logs are input into a machine learning model of a parameterized multivariate Hawkes process, which includes a baseline strength, a sparse influence matrix, and a decay function. The sparse influence matrix representing the causal relationship between the event types is determined via cardinality regularization, where the cardinality regularization is L0, and L0 is the regularization sparsity used for the probabilistic mixture model. The instance trigger probability representing the probability of causal association between individual event instances is determined by maximizing the variational lower bound of the likelihood function. The model parameters of the machine learning model are learned by iteratively performing type-level and instance-level causal analysis; and In response to the convergence of the baseline strength, decay rate, and sparse influence matrix, the instance trigger probability is provided to the user as the output of the machine learning model for event classification.

6. The computer program product of claim 5, further comprising program instructions capable of executing to perform the following operations: determining a baseline intensity for a respective one of the event types, wherein The baseline strength provides information about how each of the event types has a tendency to occur independently without any triggering event; as well as Determine the decay rate of the corresponding event type in the event types, wherein the decay rate provides information about the time scale of the corresponding event type in the event types, wherein the reciprocal of the decay rate is the effective window size of the corresponding event type in the event types, wherein the effective window size of the corresponding event type in the event types is used for adaptive window size adjustment, and wherein the decay rate is learned during the iteration of the minimization-maximization (MM) algorithm.

7. The computer program product of claim 5, wherein learning model parameters by iteratively performing type-level causal analysis and instance-level causal analysis further includes: Perform type-level causal analysis, wherein the type-level causal analysis includes determining the sparse influence matrix, the baseline strength of the corresponding event type in the event type, and the decay rate of the corresponding event type in the event type, wherein the baseline strength provides information about how each event type in the event type has a tendency to occur independently without any triggering event, and wherein the decay rate provides information about the time scale of the corresponding event type in the event type. as well as Perform instance-level causal analysis, wherein the instance-level causal analysis includes determining the instance trigger probability.

8. The computer program product of claim 7, further comprising program instructions capable of executing to perform the following operations: The probability of generating the initial instance; and The baseline strength, the decay rate, and the sparse influence matrix are calculated based on the initial instance trigger probability. In the current round of calculation, the instance trigger probability is updated based on the baseline strength, the decay rate, and the sparse influence matrix calculated in the previous round of calculation; Based on the already updated instance trigger probability, update the baseline strength, the decay rate, and the sparse influence matrix; In response to determining that the baseline strength, the decay rate, and the sparse influence matrix have converged, the instance triggering probability that has been updated in the current round of calculation is output; as well as In response to the determination that the baseline strength, the decay rate, and the sparse influence matrix do not converge, the instance trigger probability, the baseline strength, the decay rate, and the sparse influence matrix are iteratively updated.

9. A computer system for classifying random events, the computer system comprising: One or more processors, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more computer-readable tangible storage devices for execution by at least one of the one or more processors, the program instructions being capable of performing: Receive event logs including timestamps and event types; The event logs are input into a machine learning model of a parameterized multivariate Hawkes process, which includes a baseline strength, a sparse influence matrix, and a decay function. The sparse influence matrix representing the causal relationship between the event types is determined via cardinality regularization, where the cardinality regularization is L0, and L0 is the regularization sparsity used for the probabilistic mixture model. The instance trigger probability representing the probability of causal association between individual event instances is determined by maximizing the variational lower bound of the likelihood function. The model parameters of the machine learning model are learned by iteratively performing type-level and instance-level causal analysis; and In response to the convergence of the baseline strength, decay rate, and sparse influence matrix, the instance trigger probability is provided to the user as the output of the machine learning model for event classification.

10. The computer system of claim 9, further comprising program instructions capable of executing to perform the following operations: determining a baseline intensity for a respective one of the event types, wherein The baseline strength provides information about how each of the event types has a tendency to occur independently without any triggering event; as well as Determine the decay rate of the corresponding event type in the event types, wherein the decay rate provides information about the time scale of the corresponding event type in the event types, wherein the reciprocal of the decay rate is the effective window size of the corresponding event type in the event types, wherein the effective window size of the corresponding event type in the event types is used for adaptive window size adjustment, and wherein the decay rate is learned during the iteration of the minimization-maximization (MM) algorithm.

11. The computer system of claim 9, wherein learning model parameters by iteratively performing type-level causal analysis and instance-level causal analysis further comprises: Perform type-level causal analysis, wherein the type-level causal analysis includes determining the sparse influence matrix, the baseline strength of the corresponding event type in the event type, and the decay rate of the corresponding event type in the event type, wherein the baseline strength provides information about how each event type in the event type has a tendency to occur independently without any triggering event, and wherein the decay rate provides information about the time scale of the corresponding event type in the event type. as well as Perform instance-level causal analysis, wherein the instance-level causal analysis includes determining the instance trigger probability.

12. The computer system of claim 11, further comprising program instructions capable of executing to perform the following operations: The probability of generating the initial instance; and The baseline strength, the decay rate, and the sparse influence matrix are calculated based on the initial instance trigger probability. In the current round of calculation, the instance trigger probability is updated based on the baseline strength, the decay rate, and the sparse influence matrix calculated in the previous round of calculation; Based on the already updated instance trigger probability, update the baseline strength, the decay rate, and the sparse influence matrix; In response to determining that the baseline strength, the decay rate, and the sparse influence matrix have converged, the instance triggering probability that has been updated in the current round of calculation is output; as well as In response to the determination that the baseline strength, the decay rate, and the sparse influence matrix do not converge, the instance trigger probability, the baseline strength, the decay rate, and the sparse influence matrix are iteratively updated.

13. A computer-implemented method for learning model parameters in random event classification, the computer-implemented method comprising: The baseline strength of the corresponding event type in the event type is updated based on the instance trigger probability, wherein the baseline strength provides information about how each event type in the event type has a tendency to occur independently without any triggering event, wherein the instance trigger probability represents the probability of causal association between individual event instances, and wherein the instance trigger probability is updated by maximizing the variational lower bound of the likelihood function. The decay rate of the corresponding event type in the event type is updated based on the instance trigger probability, wherein the decay rate provides information about the time scale of the corresponding event type in the event type; The sparse influence matrix is ​​updated based on the instance trigger probability, wherein the sparse influence matrix represents the causal relationship between the event types; The instance trigger probability is updated based on the baseline strength, the decay rate, and the sparse influence matrix; and In response to determining the convergence of the baseline strength, the decay rate, and the sparse influence matrix, the instance trigger probability is provided to the user for event classification.

14. The computer-implemented method according to claim 13, wherein, The baseline strength and the decay rate are updated by maximizing the likelihood function, wherein the sparse influence matrix is ​​updated via cardinality regularization, where the cardinality regularization is L0, and L0 is the regularization sparsity used for probabilistic mixture models.

15. A computer program product for learning model parameters in random event classification, the computer program product comprising program instructions executable by one or more processors, the program instructions being capable of performing: The baseline strength of the corresponding event type in the event type is updated based on the instance trigger probability, where... The baseline strength provides information about how each of the event types has a tendency to occur independently without any triggering event, wherein the instance trigger probability represents the probability of causal association between individual event instances, and wherein the instance trigger probability is updated by maximizing the variational lower bound of the likelihood function; The decay rate of the corresponding event type in the event type is updated based on the instance trigger probability, wherein the decay rate provides information about the time scale of the corresponding event type in the event type; The sparse influence matrix is ​​updated based on the instance trigger probability, wherein the sparse influence matrix represents the causal relationship between the event types; The instance trigger probability is updated based on the baseline strength, the decay rate, and the sparse influence matrix; and In response to determining the convergence of the baseline strength, the decay rate, and the sparse influence matrix, the instance trigger probability is provided to the user for event classification.

16. The computer program product of claim 15, wherein the baseline strength and the decay rate are updated by maximizing the likelihood function, wherein updating the sparse influence matrix via cardinality regularization converges, wherein the cardinality regularization is L0, where L0 is the regularization sparsity for the probabilistic mixture model.

17. A system for classifying random events, comprising modules for performing the steps of the method of any one of claims 1-4 and 13-14.

Images