Classification based on imbalanced datasets

Abstract

Classification based on imbalanced datasets. Embodiments of the present disclosure relate to methods, systems, and computer program products for classification based on imbalanced datasets. In one method, a plurality of prediction models are generated based on a plurality of positive samples included in an imbalanced dataset, a quantity of the plurality of positive samples being lower than a quantity of a plurality of negative samples included in the imbalanced dataset, and each of the plurality of positive and negative samples including a plurality of parameters. A plurality of influential parameter groups are identified from the plurality of parameters of the plurality of positive samples, respectively. A final prediction model is determined based on the plurality of prediction models and the plurality of influential parameter groups, the final prediction model being used to classify a sample as one of a positive type and a negative type.

Description

Technical Field

[0001] This disclosure relates to classification, and more specifically, to methods, systems, and computer program products for generating predictive models based on imbalanced datasets. Background Technology

[0002] Classification techniques are now widely used in various working environments. For example, samples including multiple parameters of a computing system can be collected to predict whether a failure has occurred in the computing system. Predictive models can be pre-generated based on an imbalanced dataset containing multiple samples of the computing system collected at previous time points.

[0003] In traditional models, current classification techniques lack the ability to determine the number of positive cases that fail, as the results are too small to establish a positive rate, especially when the rate is less than, for example, 0.01%. Furthermore, current solutions suffer from unsatisfactoryly high false positive rates and incorrectly predict negative cases due to erroneous patterns learned by the predictive model. Summary of the Invention

[0004] According to embodiments of this disclosure, a computer-implemented method is provided, which can be implemented by one or more processors. In this method, one or more processors generate multiple predictive models based on multiple positive samples included in an imbalanced dataset, wherein the number of positive samples is less than the number of negative samples included in the imbalanced dataset, and each of the multiple positive and negative samples includes multiple parameters. The one or more processors identify multiple groups of influencing parameters for the multiple positive samples from the multiple parameters. The one or more processors determine a final predictive model based on the multiple predictive models and the multiple groups of influencing parameters, the final predictive model being used to classify the sample into one of a positive or negative type. Using these embodiments, positive models can be generated accurately and efficiently based on imbalanced datasets.

[0005] According to another embodiment of this disclosure, a computer-implemented system is provided. The computer-implemented system includes a computer processor coupled to a computer-readable storage unit, wherein the storage unit includes instructions that, when executed by the computer processor, implement the methods described above.

[0006] According to another embodiment of this disclosure, a computer program product is provided. The computer program product includes a computer-readable storage medium having program instructions. The program instructions are executable by an electronic device to cause the electronic device to perform the actions of the methods described above. Attached Figure Description

[0007] The above and other objects, features and advantages of this disclosure will become more apparent from the more detailed description of some embodiments thereof in the accompanying drawings, wherein like reference numerals generally refer to like parts in the embodiments of this disclosure.

[0008] Figure 1 A cloud computing node according to an embodiment of this disclosure is shown.

[0009] Figure 2 A cloud computing environment according to an embodiment of this disclosure is shown.

[0010] Figure 3 An abstract model layer according to an embodiment of this disclosure is shown.

[0011] Figure 4 An example diagram of an imbalanced dataset for generating a predictive model according to an embodiment of the present disclosure is shown.

[0012] Figure 5 An example diagram is shown for generating a predictive model based on an imbalanced dataset, according to an embodiment of the present disclosure.

[0013] Figure 6 An example diagram is shown for generating a prediction model based on positive samples in an imbalanced dataset, according to an embodiment of the present disclosure.

[0014] Figure 7 An example diagram of a set of models for generating target samples according to embodiments of the present disclosure is shown.

[0015] Figure 8 An example process for updating a set of models based on the difference between a target set of influence parameters and the set of influence parameters, according to an embodiment of the present disclosure, is shown.

[0016] Figure 9 An example flowchart of a method for generating a final predictive model based on an imbalanced dataset, according to an embodiment of the present disclosure, is shown.

[0017] Figure 10 An example flowchart of a method for classifying target samples based on a final prediction model, according to an embodiment of the present disclosure, is shown. Detailed Implementation

[0018] Some embodiments will be described in more detail with reference to the accompanying drawings, in which embodiments of the present disclosure have been shown. However, the present disclosure can be implemented in various ways and should therefore not be construed as limited to the embodiments disclosed herein.

[0019] It should be understood that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings set forth herein is not limited to a cloud computing environment. Rather, embodiments of this disclosure can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0020] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services), which can be rapidly provisioned and released with minimal management effort or interaction with service providers. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0021] The features are as follows:

[0022] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0023] Extensive network access: Capabilities are available through networks and accessed via standard mechanisms that facilitate the use of heterogeneous thin client or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0024] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence because consumers typically do not have control or knowledge of the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0025] Rapid flexibility: The ability to provide capacity quickly and flexibly, automatically scaling down and up rapidly in some situations to scale up rapidly. For consumers, the available supply capacity often appears unlimited and can be purchased in any quantity at any time.

[0026] Measuring services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0027] The service model is as follows:

[0028] Software as a Service (SaaS): This provides consumers with the ability to use the provider's applications running on cloud infrastructure. Applications can be accessed from different client devices via thin client interfaces such as web browsers (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0029] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created or acquired by the consumer using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of any application hosting environment.

[0030] Infrastructure as a Service (IaaS): The capabilities offered to consumers are processing, storage, networking, and other basic computing resources that enable consumers to deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0031] The deployment model is as follows:

[0032] Private cloud: A cloud infrastructure that operates solely for an organization. It can be managed by the organization or a third party and can exist on-site or off-site.

[0033] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0034] Public cloud: Makes cloud infrastructure available to the public or large industry groups and is owned by an organization that sells cloud services.

[0035] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported (e.g., cloud bursting for load balancing between clouds).

[0036] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure comprising a network of interconnected nodes.

[0037] Now for reference Figure 1The diagram illustrates an example of a cloud computing node. Cloud computing node 10 is merely one example of a suitable cloud computing node and is not intended to impose any limitation on the scope or functionality of the embodiments described herein. In any case, cloud computing node 10 can be implemented and / or perform any of the functions set forth above.

[0038] Within cloud computing node 10, there exists a computer system / server 12 or portable electronic device, such as a communication device, which can operate alongside many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, and / or configurations suitable for use with computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, fat clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the aforementioned systems or devices.

[0039] Computer system / server 12 can be described in the general context of computer system executable instructions, such as program modules executed by the computer system. Typically, program modules can include routines, programs, objects, components, logic, data structures, etc., that perform specific tasks or implement specific abstract data types. Computer system / server 12 can be implemented in a distributed cloud computing environment, where tasks are performed by remote processing devices linked via a communication network. In a distributed cloud computing environment, program modules can reside in local and remote computer system storage media, including memory storage devices.

[0040] like Figure 1 As shown, the computer system / server 12 in cloud computing node 10 is illustrated in the form of a general-purpose computing device. The components of the computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, system memory 28, and a bus 18 that couples various system components, including system memory 28, to the processor 16.

[0041] Bus 18 represents one or more of several types of bus architectures, including memory buses or memory controllers, peripheral buses, accelerated graphics ports, and processor or local buses using any of the various bus architectures. By way of example and not limitation, these architectures include Industry Standard Architecture (ISA) buses, Micro Channel Architecture (MCA) buses, Enhanced ISA (EISA) buses, Video Electronics Standards Association (VESA) local buses, and Peripheral Component Interconnect (PCI) buses.

[0042] Computer system / server 12 typically includes various computer system readable media. Such media can be any available media accessible to computer system / server 12, and it includes volatile and non-volatile media, removable and non-removable media.

[0043] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may also include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, database system 34 may be provided for reading from and writing to non-removable, non-volatile magnetic media (not shown, and generally referred to as "hard disk drives"). Although not shown, disk drives for reading from and writing to removable, non-volatile disks (e.g., "floppy disks") and optical disk drives for reading from or writing to removable, non-volatile optical disks such as CD-ROMs, DVD-ROMs, or other optical media may be provided. In this case, each may be connected to bus 18 via one or more data media interfaces. As will be further described below, memory 28 may contain at least one program product having a set (e.g., at least one) of program modules configured to perform embodiments of the invention.

[0044] A program / utility 40 having a set (at least one) of program modules 42, along with an operating system, one or more applications, other program modules, and program data, may be stored in memory 28 as an example and not as a limitation. Each of the operating system, one or more applications, other program modules, and program data, or some combination thereof, may include an implementation of a networking environment. Program modules 42 typically perform the functions and / or methods as described in the embodiments of the invention herein.

[0045] The computer system / server 12 can also communicate with one or more external devices 14, such as a keyboard, indicating device, display 24, etc.; one or more devices that enable a user to interact with the computer system / server 12; and / or any device that enables the computer system / server 12 to communicate with one or more other computing devices (e.g., network interface card, modem, etc.). This communication can occur via input / output (I / O) interface 22; however, the computer system / server 12 can communicate with one or more networks via network adapter 20, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet). As shown, network adapter 20 communicates with other components of the computer system / server 12 via bus 18. It should be understood that, although not shown, other hardware and / or software components can be used in conjunction with the computer system / server 12, examples including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archiving database systems.

[0046] Now for reference Figure 2 An illustrative cloud computing environment 50 is shown. As illustrated, the cloud computing environment 50 includes one or more cloud computing nodes 10 to which local computing devices used by cloud consumers can communicate, such as personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service, without requiring cloud consumers to maintain resources on their local computing devices. It should be understood that... Figure 2 The types of computing devices 54A-N shown are for illustrative purposes only, and computing node 10 and cloud computing environment 50 can communicate with any type of computing device over any type of network and / or network-addressable connection (e.g., using a web browser).

[0047] Now for reference Figure 3 This demonstrates a cloud computing environment of 50 ( Figure 2 This provides a set of functional abstractions. It should be understood beforehand that... Figure 3 The components, layers, and functions shown are for illustrative purposes only, and embodiments of this disclosure are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0048] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a host 61; a server 62 based on a RISC (Reduced Instruction Set Computer) architecture; a server 63; a blade server 64; a storage device 65; and a network and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0049] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0050] In one example, management layer 80 may provide the following functionalities: Resource Provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources based on anticipated future needs according to the SLA.

[0051] Workload tier 90 provides examples of functionalities that can be leveraged in a cloud computing environment. Examples of workloads and functionalities that can be provided from this tier include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analytics and processing 94; transaction processing 95; and classification processing 96.

[0052] It should be noted that the classification process 96 according to embodiments of the present invention can be performed by... Figure 1 The computer system / server 12 is implemented, and the classification process 96 can be implemented in various types of working environments. For example, the classification process 96 can be used to generate predictive models based on historical datasets to determine whether a failure has occurred in the computing system. Here, a failure refers to an abnormal state of the computing system that requires further support from technical engineers. However, since computing systems rarely fail and operate normally most of the time, the dataset includes only a small number of positive samples (where the computing system has failed) compared to a large number of negative samples (where the computing system is operating normally).

[0053] A brief overview of imbalanced datasets will be provided in the reference section. Figure 4 . Figure 4Example Figure 400 illustrates an imbalanced dataset for generating a predictive model according to embodiments of the present disclosure. Figure 4 In this case, the imbalanced dataset 410 includes multiple positive samples 412 and multiple negative samples 414; however, the number of positive samples 412 is much smaller than the number of negative samples 414. For example, the dataset may contain 10,000 samples, of which 9,500 are negative and only 500 are positive. In this situation, if a prediction model is generated directly from the imbalanced dataset, the accuracy of the prediction model will not be satisfactory.

[0054] Several solutions for imbalanced classification have been proposed. One solution employs oversampling and undersampling techniques to generate a balanced dataset from an imbalanced dataset. Another solution uses the synthetic minority oversampling technique (SMOTE) to simulate positive samples in order to generate a balanced dataset. Furthermore, the balanced dataset can be used to train a predictive model. However, these solutions involve complex processes and high workloads, and the resulting predictive models have low accuracy.

[0055] In view of the above-mentioned drawbacks, embodiments of this disclosure can provide a solution for generating predictive models. Reference will be made to... Figure 5 An overview of embodiments of this disclosure is provided. Figure 5 Example diagrams are shown for generating predictive models based on imbalanced datasets, according to embodiments of the present disclosure. Figure 5 In this context, the imbalanced dataset 410 can be used to generate a final predictive model that classifies samples into one of two types: positive or negative. Here, the imbalanced dataset 410 may consist of only a small number of positive samples 412, ..., 510 and a large number of negative samples 414. Each sample may include multiple parameters, and in the context of failures in the predictive computation system, the parameters may include multiple aspects of the computation system. An example data structure for the samples is shown in Table 1.

[0056] Table 1 shows the data structure of the parameters in the sample.

[0057]

[0058]

[0059] Here, positive samples can include parameters when a fault occurs in the computing system (where the "fault" parameter is set to "true"), while negative samples can include parameters when the computing system is in good condition (where the "fault" parameter is set to "false"). Figure 5As shown, individual prediction models can be generated based on individual positive samples. Specifically, prediction model 520 is generated for positive samples 412, ..., and prediction model 530 is generated for positive sample 510. Furthermore, influence prediction analysis can be performed on the positive samples and their corresponding prediction models to identify the influence parameter sets for the positive samples. (Reference) Figure 5 For positive sample 412, influencing parameter set 522 can be identified, and for positive sample 510, influencing parameter set 532 can be identified, and so on. Furthermore, a final prediction model 540 can be generated based on multiple prediction models 520, ..., and 530 and multiple influential parameter sets 522, ..., and 532. In these embodiments, a prediction model is generated based on a single positive sample, and therefore, information from the positive sample can be fully extracted for constructing the final prediction model. Therefore, the accuracy level of the final prediction model can be significantly improved.

[0060] In the following text, reference will be made to Figure 6 To obtain more details on generating multiple models based on multiple positive samples from an imbalanced dataset. In some embodiments of this disclosure, a balanced training dataset can be generated based on individual positive samples in the imbalanced dataset 410. Figure 6 Example Figure 600 illustrates a prediction model based on positive samples in an imbalanced dataset, according to an embodiment of this disclosure. Figure 6 In this process, a balanced training dataset 610 is generated from the positive samples 412 based on the imbalanced dataset 410. Here, the training dataset 610 includes at least one positive training sample 620 and multiple negative training samples 630. Furthermore, the prediction model 520 can be generated based on existing machine learning techniques. For example, an initial prediction model can be obtained and trained based on the training samples in the training dataset 610.

[0061] Training samples in training dataset 610 can be obtained in various ways. In some embodiments, negative training samples can be directly selected from multiple negative samples 414 in the imbalanced dataset 410. As an alternative and / or supplement, positive samples 412 can be modified to obtain negative training samples. For example, one or more parameters in positive samples 412 can be adjusted to simulate negative training samples. Assuming that CPU utilization is a key parameter for detecting faults in a computing system, the higher the CPU utilization, the higher the probability of a fault occurring in the computing system. Therefore, the CPU utilization in positive samples 412 can be adjusted to a lower value within the normal range to simulate negative training samples.

[0062] In some embodiments, a threshold (such as 1000 or another value) can be defined for the total number of samples in the balanced training dataset 610. In this case, the number of negative training samples can be determined to be 1000 / 2 = 500. Some negative training samples can be selected from the negative samples in the imbalanced database 410, and some negative training samples can be generated by modifying the positive samples 412. Using these embodiments, negative training samples can be obtained easily and efficiently.

[0063] In some embodiments of this disclosure, positive samples 412 can be obtained directly from the imbalanced dataset 410 and used as positive training samples 620. Since the training dataset 610 should be a balanced dataset, the number of positive training samples should be similar to the number of negative training samples. Considering the scarcity of positive training samples, weights 622 can be assigned to positive training samples based on the ratio of the number of multiple negative training samples to the number of the at least one positive training sample. Continuing the example above, since the number of negative training samples 630 is 500 (half of the total "1000"), there is only one positive training sample 620, and its weight can be set to 500. Using these embodiments, instead of simulating the complex process of obtaining a large number of positive training samples, positive training samples can be obtained directly in an easy and efficient manner.

[0064] In some embodiments, training dataset 610 may include more than one positive training sample, and therefore more positive training samples can be generated based on positive sample 412. For example, the CPU utilization in positive sample 412 may be slightly increased to simulate another positive training sample. Furthermore, the obtained positive training sample 620 and negative training sample 630 can be added to training dataset 610 for use in the training process. Therefore, embodiments of this disclosure do not require complex processes and can reduce the workload for generating training datasets. In some embodiments, balanced training dataset 610 can be used to train an initial prediction model. After the training process, prediction model 520 can be automatically generated.

[0065] The preceding paragraphs provide only an example procedure for generating the predictive model 520 for the positive sample 412. Other positive samples can undergo similar processing to obtain multiple predictive models 520, ..., and 530. Once the predictive model 520 is generated, influence predictor analysis can be performed on the predictive model to identify the influencing parameter set for the positive sample 412. Influence predictor analysis is used to analyze the relationship between the sample and the predictive model generated based on the sample. Specifically, a set of influencing parameters that classify the sample as positive can be identified from the multiple parameters. For example, the parameter set (CPU utilization, memory utilization, ...) identified in Table 1 above can be used as the influencing parameter set 522 for the positive sample 412.

[0066] In some embodiments, an influencing parameter set can be identified for each of the positive samples. This influencing parameter set includes a group of parameters from a plurality of parameters that classify the positive sample as positive. Specifically, the Locally Interpretable Model-Agnostic Interpretation (LIME) method can be used to identify the influencing parameter set, and details of the LIME method will be omitted below. The LIME method is a mature technique to date, providing various LIME tools for determining the influencing parameter set. In some embodiments, positive samples and a prediction model can be input into a LIME tool, which can then output an influencing parameter set associated with the positive samples and the prediction model. Here, the influencing parameter set includes a group of parameters from the plurality of parameters that classify the positive sample as positive. Therefore, all prediction models can be processed based on the LIME tool, allowing the influencing parameter set 522 of positive sample 412 to be identified based on prediction model 520, and the influencing parameter set 532 of positive sample 510 to be identified based on prediction model 530.

[0067] Furthermore, a final prediction model 540 can be generated based on multiple prediction models 520, ..., 530 and multiple groups of influencing parameters 522, ..., 532. Here, the final prediction model can be used to classify samples into one of positive or negative types. Utilizing these embodiments, multiple prediction models generated based on multiple positive samples can provide more predictive knowledge. Since multiple prediction models are built on different training datasets, they can reflect various aspects of prediction. In other words, the final prediction model can include rich knowledge that fully reflects all factors used to determine the fault. Here, multiple prediction models can work together to classify further samples, and thus the accuracy level of the final prediction model can be greatly improved.

[0068] In some embodiments, the final prediction model 540 can be updated over time. For example, during the operation of the computing system, more positive samples can be collected by monitoring multiple parameters. Once another positive sample is added to the imbalanced dataset 410, another prediction model can be generated based on the other positive sample, and another set of influencing parameters can be identified for the other prediction model. The final prediction model can then be updated based on the other prediction model and the other set of influencing parameters. In these embodiments, the final prediction model 540 can be updated based on more positive samples, allowing the accuracy level of the final prediction model 540 to gradually increase.

[0069] In some embodiments, the final prediction model 540 can be used to classify incoming samples. Referring below... Figure 7 For more details, see here. Figure 7 Example Figure 700 illustrates a set of models for generating target samples according to embodiments of the present disclosure. Figure 7 In this process, the target sample 710 can be input into the final prediction model 540, and the data structure of the target sample 710 is the same as the data structure of the training samples used to generate the final prediction model 540. In the final prediction model 540, the target sample 710 can be input into each of a plurality of prediction models 520, ..., 530. Here, the plurality of prediction models 520, ..., 530 can operate independently and output a plurality of prediction types 720, ..., 730 respectively. For example, prediction model 520 can output negative types 720, ..., and prediction model 530 can output positive type 730.

[0070] Furthermore, a model set 740 can be created based on the results from multiple prediction models 520, ..., and 530. Here, if the prediction type is determined to be positive, the prediction model corresponding to the positive type can be added to the model set 740. In other words, prediction models (one or more) whose outputs confirm a prediction type can be added to the model set 740. Figure 7 In this process, prediction model 530 outputs a positive prediction type, and therefore prediction model 530 is added to model set 740 (denoted as prediction model 530'). Here, the number of models in model set 740 is the same as the number of positive types output by the final prediction model 540. In these embodiments, model set 740 can be used as the basis for classifying target sample 710.

[0071] In some embodiments of this disclosure, if the model set 740 is empty, it instructs all prediction models 520, ..., 530 to classify the target sample 710 as a negative type. In this case, the target sample 710 can be classified as a negative type. Compared to existing solutions that use only one prediction model, in this embodiment, all prediction models 520, ..., 530 output negative types, thus resulting in a higher confidence level for the final classification type.

[0072] In some embodiments, if the model set 740 is not empty (i.e., includes one or more predictive models with positive output types), the predictive models in the model set may undergo further processing. Reference Figure 8 The figure illustrates an example process 800 for updating a model set based on the difference between a target influence parameter set and an influence parameter set, according to an embodiment of the present disclosure. Figure 8 In this process, a target influence parameter set can be identified from multiple parameters of the target sample 710. Here, the LIME method can be performed on the prediction model 530 to identify the target influence parameter set 810 of the target sample 710. Furthermore, an influence parameter set 532 associated with the prediction model 530 can be obtained from the final prediction model 540.

[0073] Here, the influence parameter set 532 includes parameters that cause the positive sample 510 to be classified as positive. Here, the impression parameter set is an indicator used to measure whether the prediction model 530 is suitable for classifying incoming samples. If the influence parameter set used to introduce the sample is similar to the influence parameter set 532, this means that the prediction model 530 is suitable; otherwise, the prediction model 530 is unsuitable. Therefore, a difference 820 between the target influence parameter set 810 and the influence parameter set 532 can be determined to update the model set 740. In some embodiments, if the difference 820 is higher than a predetermined threshold, it indicates that the positive type 730 is output based on different parameters other than those included in the influence parameter set 532, therefore the output of the prediction model 530 is unreliable and should therefore be discarded. Otherwise, if the difference 820 is lower than the predetermined threshold, it indicates that the positive type 730 is output based on parameters similar to those included in the influence parameter set 532, therefore the output of the prediction model 530 is reliable and should therefore be adopted.

[0074] In some embodiments, a threshold can be determined based on the overlap between the target influence parameter group 810 and the influence parameter group 532. When the target influence parameter group 810 and the influence parameter group 532 completely overlap, the output of the prediction model 530 is used. The overlap rate (e.g., 90% or another value) can be defined as the threshold; if the overlap rate between the two groups is higher than 90%, the output is reliable; otherwise, the output is unreliable and may be discarded. Furthermore, continuing with the above example of determining faults in the computing system, if influence parameter group 532 includes 10 parameters while the target influence parameter group 810 includes 8 parameters (of which only 5 parameters are included in influence parameter group 532), then the difference 820 is below the threshold, and therefore the prediction model 530 can be removed from the model set 740. In another example, if the difference 820 is higher than the threshold, the prediction model 530 can be maintained in the model set 740.

[0075] Although the above paragraphs have described the processing of only one prediction model 530, other prediction models in the model set 740 can be processed in a similar manner, allowing the model set 740 to be updated. Based on... Figure 8After processing all predictive models, the updated model set 740 can be used to determine the final type of the target sample 710. If the updated model set is empty, it means that all reliable predictive models believe that the target sample 710 belongs to a negative type, and therefore the target sample 710 can be classified as a negative type. Alternatively, if the updated model set is not empty, it indicates that one or more reliable predictive models believe that the target sample 710 belongs to a positive type. Therefore, the target sample can be classified as a positive type. In these embodiments, all predictive models that output unreliable results are removed from the model set 740, and therefore the model set 740 includes only one or more reliable predictive models. Therefore, the reliability of the final output can be increased.

[0076] Although the embodiments have been described above in the context of a computing system, alternatively and / or additionally, embodiments of this disclosure can be implemented in medical environments, image processing environments, etc. In a medical environment, an imbalanced dataset may include positive samples associated with cancer and negative samples associated with healthy individuals, and therefore a predictive model can be generated based on the imbalanced dataset. In an image processing environment, an imbalanced dataset may include positive samples associated with images of defective products and negative samples associated with images of acceptable products, and therefore a predictive model can be generated based on the imbalanced dataset. Using these embodiments, accurate and efficient predictive models can be generated from imbalanced datasets in various working environments.

[0077] This disclosure can be a system, method, and / or computer program product at any possible level of technical detail integration. A computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of this disclosure.

[0078] Reference Figure 9 To obtain further details regarding embodiments of this disclosure. Figure 9 An example flowchart of a method 900 for generating a final predictive model based on an imbalanced dataset according to an embodiment of the present disclosure is shown. Here, method 900 may be implemented by one or more processors. In block 910, multiple predictive models are generated based on multiple positive samples included in the imbalanced dataset, the number of positive samples being less than the number of negative samples included in the imbalanced dataset, and each of the multiple positive and negative samples includes multiple parameters. In block 920, multiple groups of influencing parameters for the multiple positive samples are identified from the multiple parameters. In block 930, a final predictive model is determined based on the multiple predictive models and the multiple groups of influencing parameters, the final predictive model being used to classify the samples into one of a positive type and a negative type.

[0079] In some embodiments, a prediction model is generated from multiple prediction models based on positive samples from a plurality of positive samples. Specifically, a training dataset is generated based on positive samples, the training dataset including at least one positive training sample and multiple negative training samples. A prediction model is generated by training an initial prediction model using the training dataset.

[0080] In some embodiments, multiple negative training samples are obtained by: selecting negative samples from multiple negative samples and modifying positive samples into negative samples; and adding multiple negative training samples to the training dataset.

[0081] In some embodiments, at least one positive training sample is obtained based on positive samples; then, weights are assigned to at least one positive training sample based on the ratio of the amount of multiple negative training samples to the amount of at least one positive training sample.

[0082] In some embodiments, each of a plurality of positive samples is processed to identify a group of a plurality of influence parameter groups. Specifically, influence parameter groups are identified for positive samples, and the influence parameter groups include a group of parameters among a plurality of parameters that cause a positive sample to be classified as a positive type.

[0083] In some embodiments, in response to determining to add additional positive samples to an imbalanced dataset, the final prediction model is updated. Specifically, an additional prediction model is generated based on the additional positive samples; another set of influencing parameters for the other prediction model is identified from a plurality of parameters; and the final prediction model is updated based on the other prediction model and the other set of influencing parameters.

[0084] In some embodiments, if a target sample is received, multiple prediction types for the target sample are determined based on multiple prediction models included in the final prediction model. In response to all prediction types indicating a negative type being determined among the multiple prediction types, the target sample is classified into a negative type.

[0085] In some embodiments, in response to determining that at least one of a plurality of prediction types indicates a positive type, a model set is generated, and the model set includes at least one prediction model corresponding to at least one prediction type. An influence parameter set associated with the prediction models in the model set is determined. Next, a target influence parameter set is identified from a plurality of parameters of the target sample. Furthermore, the model set is updated based on the difference between the influence parameter set and the target influence parameter set, and then the target sample is classified based on the updated model set.

[0086] In some embodiments, in response to determining that the difference is higher than a predefined threshold, the prediction model is removed from the model set; and in response to determining that the difference is lower than a predefined threshold, the prediction model is maintained in the model set.

[0087] In some embodiments, the target sample is classified as negative in response to determining that the updated model set is empty; and the target sample is classified as positive in response to determining that the updated model set is not empty.

[0088] Reference Figure 10 To obtain more details for classifying the samples. Figure 10 An example flowchart of a method 1000 for classifying target samples based on a final prediction model according to an embodiment of the present disclosure is shown. At box 1002, the model set is set to empty, and at box 1004, it is determined whether a prediction model outputting a positive type of the target sample exists. If the result is "yes," method 1000 proceeds to box 1010; if the result is "no," method 1000 proceeds to box 1020. At box 1010, a prediction model outputting a positive type of the target sample is added to the model set. At box 1020, if the model set is empty, method 1000 proceeds to box 1022 and outputs a negative type. Otherwise, if the model set is not empty, method 1000 proceeds to box 1030. At box 1030, a target influence parameter set is determined for the models in the model set. Next, at box 1040, the difference between the target influence parameter set and the influence parameter set associated with the model is determined. In box 1050, if the difference is higher than the threshold, method 1000 proceeds to box 1054 and removes the model from the model set. If the difference is lower than the threshold, method 1052 proceeds to box 1052 and outputs a positive type.

[0089] Computer-readable storage media can be tangible devices capable of retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable optical disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or recessed structures with instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0090] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the suitable computing / processing device.

[0091] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to personalize the electronic circuitry in order to perform aspects of this invention.

[0092] The present invention will now be described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0093] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium storing the instructions includes an article of manufacture containing instructions that implement aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0094] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, such that the instructions executed on the computer, other programmable apparatus, or other device perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0095] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions indicated in the blocks may occur in a non-consecutive order as shown in the figures. For example, two blocks shown consecutively may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0096] Various embodiments of this disclosure have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or improvements to existing technologies in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A computer-implemented method for computing system failure prediction, comprising: generating, by one or more processors, a plurality of prediction models based on a plurality of positive samples included in an imbalanced dataset, wherein a quantity of the plurality of positive samples is lower than a quantity of a plurality of negative samples included in the imbalanced dataset, and wherein each sample of the plurality of positive samples and the plurality of negative samples includes a plurality of parameters, the positive samples including parameters when a computing system fails, the negative samples including parameters when the computing system is in good condition; identifying, by one or more processors, a plurality of influential parameter groups of the plurality of positive samples from the plurality of parameters; and determining, by one or more processors, a final prediction model based on the plurality of prediction models and the plurality of influential parameter groups, wherein the final prediction model classifies a sample as a positive type or a negative type.

2. The method of claim 1, wherein generating the plurality of prediction models comprises: obtaining, by one or more processors, a training dataset based on positive samples, wherein the training dataset includes at least one positive training sample and a plurality of negative training samples; and generating, by one or more processors, the plurality of prediction models by training an initial prediction model with the training dataset.

3. The method of claim 2, wherein obtaining the training dataset comprises: obtaining, by one or more processors, the plurality of negative training samples, wherein the plurality of negative training samples is selected from a group consisting of a negative sample from the plurality of negative samples and a modification of the positive sample to a negative sample; and adding, by one or more processors, the plurality of negative training samples to the training dataset.

4. The method of claim 2, wherein obtaining the training dataset comprises: obtaining, by one or more processors, the at least one positive training sample based on the positive samples; and assigning, by one or more processors, a weight to the at least one positive training sample based on a ratio of a quantity of the plurality of negative training samples to a quantity of the at least one positive training sample.

5. The method of claim 1, wherein identifying the plurality of influential parameter groups comprises: identifying, by one or more processors, an influential parameter group of the positive sample of the plurality of positive samples, wherein the influential parameter group includes a group of parameters of the plurality of parameters that cause the positive sample to be classified as the positive type.

6. The method of claim 1, further comprising: in response to determining that another positive sample is added to the imbalanced dataset, generating, by one or more processors, another prediction model based on the another positive sample; identifying, by one or more processors, another influential parameter group for the another prediction model from the plurality of parameters; and updating, by one or more processors, the final prediction model based on the another prediction model and the another influential parameter group.

7. The method of claim 1, further comprising: in response to determining that a target sample is received, determining, by one or more processors, a plurality of predicted types of the target sample based on the plurality of prediction models included in the final prediction model; and in response to determining that all of the plurality of prediction types indicate the negative type, classifying, by the one or more processors, the target sample to the negative type.

8. A computer-implemented method for computing system failure prediction, comprising: generating, by one or more processors, a plurality of prediction models based on a plurality of positive samples included in an imbalanced dataset, wherein a quantity of the plurality of positive samples is lower than a quantity of a plurality of negative samples included in the imbalanced dataset, and wherein each sample of the plurality of positive samples and the plurality of negative samples includes a plurality of parameters, the positive samples including parameters at a time of a failure in a computing system, the negative samples including parameters at a time of a good condition of the computing system; identifying, by the one or more processors, a plurality of influential parameter groups of the plurality of positive samples from the plurality of parameters; determining, by the one or more processors, a final prediction model based on the plurality of prediction models and the plurality of influential parameter groups, wherein the final prediction model classifies a sample as a positive type or a negative type; in response to determining that at least one prediction type of the plurality of prediction types indicates the positive type, generating, by the one or more processors, a model set including at least one prediction model corresponding to the at least one prediction type; determining, by the one or more processors, an influential parameter group associated with a prediction model in the model set; identifying, by the one or more processors, a target influential parameter group of a target sample from the plurality of parameters; updating, by the one or more processors, the model set based on a difference between the influential parameter group and the target influential parameter group; and classifying, by the one or more processors, the target sample based on the updated model set.

9. The method of claim 8, wherein updating the model set comprises: in response to determining that the difference is above a predefined threshold, removing, by the one or more processors, the prediction model from the model set.

10. The method of claim 8, wherein updating the model set comprises: in response to determining that the difference is below a predefined threshold, maintaining, by the one or more processors, the prediction model in the model set.

11. The method of claim 8, wherein classifying the target sample based on the updated model set comprises: in response to determining that the updated model set is empty, classifying, by the one or more processors, the target sample to a negative type.

12. The method of claim 8, wherein classifying the target sample based on the updated model set comprises: in response to determining that the updated model set is not empty, classifying, by the one or more processors, the target sample to a positive type.

13. A computer-implemented system comprising a computer processor coupled to a computer readable memory unit, the computer readable memory unit comprising instructions that, when executed by the computer processor, implement the method of any one of claims 1-10.

14. A computer program product comprising program instructions executable by an electronic device to implement the method of any one of claims 1-10.

Images