Cross-environment event correlation and machine learning techniques using domain space exploration

Abstract

A computer-implemented method for cross-environment event correlation includes determining one or more correlated events about a problem across multiple domains. Extracting knowledge data from the problem determined based on the one or more correlated events. Generating a correlation graph from the extracted knowledge to track the problem and grouping the correlated events into one or more event groups to represent their relationship to the problem. Constructing a logical reasoning description based on the generated correlation graph for domain space exploration related to how a problem in one domain affects another domain in multiple domains. Based on the logical reasoning description, providing an explanation about the cause of the problem to one or more event groups of the correlated events.

Description

Background Art Technical Field

[0002] The present disclosure relates generally to event correlation in multi-domain operations, and more particularly, to systems and methods for cross-environment event correlation for multi-domain operations. Background Art

[0004] As information technology (IT) environments become more entangled, there is an increasing interaction between different domains in a multi-domain computing environment. A result of this interaction is that a problem in one domain may affect operations in other domains. An event or change initiated in one of the corresponding domains is usually made and reviewed independently, even though other domains may be affected by the event or change.

[0005] For example, a rule or policy change made in one domain may cause problems, difficulties or incidents in the operation of network devices in another domain that are not easily discovered. When cross-domain communication is required, a problem in a storage server may adversely affect an application operating in another domain. Debugging of problems can be prolonged because events in different domains may not appear to be related to each other. It is also challenging to understand the risks presented to other domains when changes or difficulties occur. Summary of the invention

[0006] According to one embodiment, a computer-implemented method for cross-environment event correlation includes an operation of determining one or more correlated events about a problem across multiple domains. Knowledge data of the determined problem is extracted from the one or more correlated events. A correlation graph of the extracted knowledge data is published to track the problem and group related events into one or more event groups to represent their relationship to the problem. A logical reasoning description is constructed based on the generated correlation graph for domain space exploration related to how a problem in one domain affects another domain in multiple domains. Based on the logical reasoning description, an explanation about the cause of the problem is provided to one or more event groups of correlated events. The identification and explanation of the cause of the problem facilitates diagnosis and corrective actions to solve the problem.

[0007] In one embodiment, the extraction of knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data, and machine learning is used to determine related events about problems across multiple domains based on historical data or synthetic data. The use of machine learning allows the discovery of event correlations that might otherwise be missed, and leads to time savings in diagnosis and explanation of the cause of problems, especially across multiple domains.

[0008] In one embodiment, the use of machine learning includes training through unsupervised learning techniques using association rule learning algorithms or clustering algorithms. Unsupervised learning techniques are particularly beneficial for discovering associations that might otherwise go undetected.

[0009] In one embodiment, the use of machine learning includes training using labeled data associated with data associations through supervised learning techniques. The use of supervised learning techniques can be used to guide the determination of associated events to obtain more effective results.

[0010] In one embodiment, the use of machine learning includes configuration based on the size of the relevant data by using a supervised learning technique using a support vector machine (SVM), a convolutional neural network (CNN), or a long short memory (LSTM). The use of SVM, CNN, and LSTM can provide increased event relevance.

[0011] In one embodiment, based on the logical reasoning description, the most likely event group of associated events in the one or more event groups is recommended to the user who has an explanation about the cause of the problem. Through the recommended possible event group, efficiency is improved.

[0012] In one embodiment, the most likely event group of associated events with explanations of the cause of the problem is recommended based on a logical reasoning description that includes creating, reading, updating, and deleting (CRUD) data at runtime. Compared to collecting data from logs, the use of CRUD brings more dynamic recommendations for the most likely event group.

[0013] In one embodiment, the use of machine learning includes a training operation based on the received feedback to train the determination of one or more associated events.

[0014] In one embodiment, feedback is received to determine one or more associated events through an active learning method that interactively queries a user or another information source to label new data points with desired outputs.Feedback provides advantages in the training operation of machine learning.

[0015] In one embodiment, one or more semantic relationships are constructed between multiple domains.There are benefits in determining related events.

[0016] In one embodiment, determining one or more associated events about a problem includes collecting one or more events, logs, or change records from at least some of the multiple domains. Determining one or more associated events about the problem by using machine learning techniques. Producing a standardized format of the one or more collected events, logs, or change records. Enhancing cross-domain event correlation by standardizing the format.

[0017] In one embodiment, the collection of events, logs, metrics, or change records is performed offline by using synthetic simulation.

[0018] In one embodiment, the collection of events, logs, metrics, or change records is performed offline using historical data.

[0019] A non-transitory computer-readable storage medium tangibly embodying a computer-readable program code having computer-readable instructions, which when executed cause a computer device to perform a method for cross-environment event association, the method comprising determining one or more associated events about a problem across multiple domains. Extracting knowledge data about the problem from the one or more associated events. Generating an association graph of the extracted knowledge data to track the problem and group related events into one or more event groups. Constructing a logical reasoning description based on the generated association graph for domain space exploration related to how a problem in one domain affects another domain in multiple domains. Based on the logical reasoning description, providing an explanation about the cause of the problem to one or more event groups of the associated events. Identification and explanation of the cause of the problem facilitate diagnosis and corrective actions to resolve the problem.

[0020] In one embodiment, a computing device for cross-environment event association using space exploration includes a processor and a memory coupled to the processor. The memory stores instructions to enable the processor to perform actions, the actions including: determining one or more associated events of a problem across multiple domains, extracting knowledge data of the problem determined from the one or more associated events; constructing a logical reasoning description of domain space exploration related to how a problem in one domain affects another domain in multiple domains; generating an association graph based on the domain space exploration to track the problem and group the associated events in one or more groups; constructing semantic relationships between different domains, and recommending the most likely event group of events related to the cause of the problem based on the logical reasoning description. Events from different domains can be monitored, and an understanding of the risks associated with changes or mutations in one domain and the impact on other domains can be provided.

[0021] In one embodiment, the extraction of knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data, and the processor is configured to perform machine learning on cross-environment event correlations of the problem.

[0022] These and other features will become apparent from the following detailed description of illustrative embodiments of the invention, which is to be read in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings are illustrative embodiments. They do not show all embodiments. In addition or as an alternative, other embodiments may be used. Details that may be obvious or unnecessary may be omitted to save space or for more effective description. Some embodiments may be implemented with additional parts or steps and / or without all parts or steps shown. When the same number appears in different drawings, it refers to the same or similar parts or steps.

[0024] Figure 1is an overview of the architecture of a system for cross-environment event correlation consistent with an illustrative embodiment.

[0025] Figure 2 is a system flow diagram of cross-environment event correlation using domain space exploration consistent with an illustrative embodiment.

[0026] Figure 3 A problem scenario in a cloud-native environment that is addressed in the present disclosure is shown.

[0027] Figure 4 Another problem scenario in a hybrid cloud environment addressed in the present disclosure is shown.

[0028] Figure 5 Domain space operations consistent with the illustrative embodiments are shown.

[0029] Figure 6 The construction of an association diagram consistent with the illustrative embodiments is shown.

[0030] Figure 7 are screen shots used in establishing a logical reason description consistent with an illustrative embodiment.

[0031] Figure 8 is a flow diagram of a computer-implemented method for cross-environment event correlation consistent with an illustrative embodiment.

[0032] Fig. 9 is a functional block diagram of a specially configured computer hardware platform that can communicate with various networked components consistent with the illustrative embodiments.

[0033] Fig.10 An illustrative cloud computing environment that utilizes cloud computing is depicted.

[0034] Fig.11 Describes a set of functional abstraction layers provided by a cloud computing environment. DETAILED DESCRIPTION

[0035] Overview

[0036] In the following detailed description, numerous specific details are set forth by way of example to provide a thorough understanding of the relevant teachings. However, it should be understood that the present teachings can be practiced without these details. In other instances, well-known methods, procedures, components, and / or circuits have been described at a relatively high level without detail to avoid unnecessarily obscuring aspects of the present teachings.

[0037] The present disclosure provides a method and system for computer implementation related to cross-environment. In a multi-domain environment, events or changes originating from different domains are usually checked independently without being associated with upstream or downstream. As used herein, the term "problem" includes problems or accidents in a multi-domain environment. Therefore, problems with network devices in the communication path between two applications (e.g., downtime or rule / policy changes) may have a large impact on performance and may even disable communication. In addition, as an example, problems with storage servers attached as Kubernetes persistent volumes (e.g., scalability changes, bandwidth changes, authentication changes, etc.) may significantly affect the operation of applications while maintaining their service level objectives and / or the growth of scalability of Kubernetes persistent volumes of clusters. If the problem affects other domains, the time and complexity of debugging the problem based on events in one domain can vary greatly, because the events may not be interrelated, and / or the expertise in other domains may not be at the level of expertise in the domain where the event occurred. The computer-implemented method and system of the present disclosure can allow monitoring of events from different domains, and provide an understanding of the risks associated with changes or mutations in one domain and the impact on other domains.

[0038] The terms "semantic knowledge" and "meta-knowledge" are used herein. Although there is some overlap between the two terms, semantic knowledge includes knowledge about words or phrases and can include concepts, facts, and ideas. Meta-knowledge is knowledge about pre-selected knowledge or content and includes labeling, planning, modeling, and learned modifications of domain language.

[0039] Additionally, computer-implemented systems and methods according to the present disclosure provide improvements in at least the areas of operational monitoring and risk assessment of multi-domain computing environments and the interrelated impacts of different domains on each other. Additionally, computer-implemented methods and systems according to the present disclosure provide improvements in the efficiency of computer operations because the use of, for example, machine learning to monitor and assess cross-environment correlations can increase reliability and reduce or eliminate degraded operations in one or more domains due to problems in another domain.

[0040] Example Architecture

[0041] Figure 1is an overview of the architecture 100 of a system for cross-environment event correlation consistent with an illustrative embodiment. As shown in parentheses, some of the operations of offline 105 can be performed while the system is offline, which can include data retrieval by collecting events, logs, metrics, or change records from various domains using, for example, synthetic simulations or historical data. A non-limiting example of domains 107 is shown from which historical data can be obtained. A standardized format can be generated from the retrieved data. There can be machine learning of correlated events 108 across domains and explanations about the cause of the problem, such as based on analytical questions.

[0042] Continue to refer Figure 1 , semantic knowledge or meta-knowledge can be extracted from the retrieved data 110, and an association graph (e.g., a knowledge graph) is generated to track associated questions to help group events. Domain space exploration 115 is performed to construct a logical reasoning description for domain space exploration. Associated questions help track associated questions to help group events.

[0043] Under the bracket labeled "Online" 120, there are some runtime functions. For example, at runtime, there can be cross-domain correlation of events or create / read / update / delete (CRUD) operations to return grouped events with explanations about the cause of the problem. In one embodiment, there are physical servers 125 coupled to persistent storage (e.g., Kubernetes layer) coupled to the pod. Optionally, a system reliability engineer 230 can provide feedback in the training operation.

[0044] Figure 2 is a system flow diagram 200 for cross-environment event correlation using domain space exploration consistent with an illustrative embodiment. At operation 205, data from various domains is collected in the form of, for example, events, logs, metrics, change records, etc. This data may be used to generate a standardized format.

[0045] In operation 210, there is learning of associated events occurring across domains using machine learning techniques. As discussed herein, machine learning can be based on supervised or unsupervised training. For example, associated events can be identified so as to be grouped into one or more related groups by confidence level. In unsupervised learning, there can be frequency-based methods, such as association rule learning algorithms. In addition, similarity-based methods, such as clustering algorithms, can be used together with association rule learning algorithms. In supervised learning techniques, there is the use of labeled data associated with data association, or tags are created using data association. In one example, a ticket including multiple closed events can be used to identify a problem accident. In addition, if the size of the data is relatively small, traditional machine learning algorithms such as support vector machines (SVM) can be used for classification. In the case of big data, deep learning algorithms such as convolutional neural networks (CNN), long-short-term memory (LSTM), etc. can be used.

[0046] In operation 215, the extraction of meta-knowledge (or semantic knowledge) is performed and used to generate an association graph (e.g., knowledge graph 217) to track the association problem of event grouping. Meta-knowledge can be extracted in a variety of ways, such as by reading tags, extracting quantitative data sets, and using information extraction (IE) systems, or by event-based information extraction software. In operation 220, logical reasoning descriptions are constructed from domain space exploration. For example, in domain space exploration, multiple operations can be performed, such as exploring attributes that have occurred in each domain from analyzing historical data, combining entities with associations (e.g., entity links), extracting knowledge bases, and constructing knowledge graphs. The association of event types with similar clustering types can be based on time and space information.

[0047] At operation 225, during runtime, there is an association of grouped events that is executed to identify a set of events and return an explanation of the cause of the problem. The actions for identifying and returning grouped events with explanations of the cause of the problem include performing actions such as create / read / update / delete (referred to as "CRUD" in the art). Then at operation 230, feedback for capturing knowledge of associated events can be provided to the machine learning 210 of the associated events based on capturing and analyzing real-time data. Feedback can be generated to determine one or more associated events through an active learning method that interactively queries a user or another information source to mark new data points with desired outputs. Optionally, a site reliability engineer (SRE) or subject matter expert (SME) can supplement the feedback.

[0048] Figure 3 An example of a difficult scenario 300 in a cloud-native environment that is addressed in the present disclosure is shown. Figure 3The environmental states and cross-environment associations are listed for today 305, tomorrow 310, symptoms 315. A schematic diagram 325 of the environment is also shown.

[0049] In the "Today" 305 state, application "172.1.1.1" running on VM 10.1.2.1 is hosted by physical server 9.1.1.1. Application 172.1.1.1 can communicate with another application "Postgres172.1.2.1" hosted by another physical server 9.1.2.1. However, in the "Tomorrow" 310 state, the router 327 between the two physical servers changes the rule to "Deny", and now application 172.1.1.1 cannot communicate with the Postgres172.1.2.1 application. The current event management system is unaware of the rule change in router 327 and does not know why application 172.1.1.1 cannot communicate with the Postgres172.1.2.1 application. By performing cross-environment correlation, information about policy changes in routers and symptoms are correlated as groups to diagnose the problem.

[0050] Figure 4 An example of a difficult scenario 400 in a hybrid cloud environment addressed in the present disclosure is shown. In this illustration, the environment is a hybrid cloud and the symptom 405 is in the operation The software device then runs an application programming interface (API) that causes intermittent application connectivity interruptions. Edge message 410 states that due to an unexpected condition, a notification is being sent to a neighbor, followed by a message that the connection state has deteriorated, and that the connection has entered or left the established state. The messages starting with the indication of the unexpected condition to the message that the connection has left the established state are an application outage sequence of the API. The explanation at 420 indicates that such a message notification is not typically translated into an event because no action may be required and a false positive message may be generated, especially if it is related to the Border Gateway Protocol (BGP), which is a standardized exterior gateway protocol designed to exchange information about routing and reachability between autonomous systems on the Internet. According to the method of the present disclosure, at 430, it is indicated that these types of messages and symptoms are associated as a group to diagnose the problem and provided to the SRE or an automatic remediation action file of similar messages that may be searchable. At 435, it is indicated that by associating the group event about the application connection outage (called "NSX BGP flap") with the upstream event, and providing the information to the automatic remediation action file of similar messages or SRE, it will allow a faster ability to diagnose and take remediation actions with applications that cannot communicate with endpoints located behind the NSX edge.

[0051] Figure 5 500 operations consistent with the illustrative embodiments are shown. Figure 5In domain space exploration, the properties of events that may occur in each domain are explored from historical data. An example of this could be as described above about Figure 4 The discussed cross-NSX-BGP flapping connectivity is disrupted. At operation 510, there is a combination of entities with an association (eg, entity link). Figure 4 As discussed in the scenario, the combination of entities may include link information about similar nodes connected across NSX-BGP flaps.

[0052] At operation 515, the knowledge base is extracted and a knowledge graph is constructed using, for example, dependency parsing and graph construction.For example, events can be represented graphically to make it easier to determine if there are any difficult patterns or commonalities.

[0053] At operation 520, clustering is performed on events that have similar event types and are related based on temporal and spatial (e.g., topological) information (e.g., grouping). Clustering algorithms can be used to associate common issues and / or issues with entities sharing similar connections to certain applications. Domain space exploration 540 is shown with relationships between container authorization, container analysis, and hosts.

[0054] Figure 6 The construction of an association graph 600 consistent with an illustrative embodiment is shown. Domain space exploration 605, meta-extraction 610, and knowledge graph 615 are shown. The semantic association graph is constructed with learning information, and meta-information is extracted from the domain space exploration and converted into a knowledge graph. The domain space exploration 605 depicts the relationship between container authorization, container analysis, and hosts. Meta-extraction 610 can be extracted in a variety of ways, such as by reading tags, extracting quantitative data sets, by using information extraction (IE) systems, or by event-based information extraction software. Knowledge graph 615 is a programmatic way to model domain information because it shows links between various domains. There are various applications that can generate knowledge graphs, and their use can be applied to problem determination by providing links to events that may have occurred by various domains. Figure 7 is a sample screenshot 700 used in building a logical cause description consistent with an illustrative embodiment. Screenshot 700 is an example of space exploration logic for finding causes for localization and blast radius. Using data from domain space exploration, the deep design space exploration logic is updated using logic with iterative learning and optional SRE feedback (or automatic feedback). At runtime, relevant events and reasoning can be found.

[0055] Example Process

[0056] With the foregoing overview of the example architecture, it may be helpful to now consider a high-level discussion of the example process. Figure 1 and 2 , Figure 8 is a flow chart of a computer-implemented method for cross-environment event association consistent with an illustrative embodiment. Process 800 is illustrated in a logical flow chart as a collection of boxes that represent a sequence of operations that can be implemented in hardware, software, or a combination thereof. In the context of software, the boxes represent computer-executable instructions that, when executed by one or more processors, perform the described operations. In general, computer-executable instructions may include routines, programs, objects, components, data structures, etc. that perform functions or implement abstract data types. In each process, the order in which the operations are described is not intended to be construed as a limitation, and any number of the described boxes may be combined in any order and / or executed in parallel to implement the process. For purposes of discussion, reference is made to FIG. Figure 1 The architecture of the process 800 is described.

[0057] At operation 810, one or more correlated events are determined regarding a problem occurring across multiple domains. The problem may range from a hard failure to a service degradation, for example. The correlated events may have some type of commonality as a basis for grouping.

[0058] At operation 820, at least one of semantic knowledge data or meta-knowledge data of the problem determined from the associated event is extracted. For example, meta-knowledge can be extracted from domain space exploration. Meta-knowledge can be extracted in a variety of ways, such as by reading tags, extracting quantitative data sets, and using an information extraction (IE) system, or by event-based information extraction software.

[0059] In operation 830 , a correlation graph of the extracted semantic knowledge data or meta-knowledge data is generated to track the problem.

[0060] At operation 840, the associated events are grouped into one or more event groups. Events can be grouped based on similar types of errors (e.g., Figure 4 The network flap in question), or errors that occur at a specific gateway, errors that occur at similar time periods.

[0061] At operation 850, a logical reasoning description is constructed based on the generated association graph. The association graph used for domain space exploration is related to how a problem in one domain affects another domain among multiple domains.

[0062] At operation 860, an event group of associated events is provided with an explanation as to the cause of the problem. The explanation provides a better understanding of the problem.

[0063] The process in this illustrative embodiment ends after operation 860 .

[0064] Example of a specific configuration of computing equipment

[0065] Fig. 9A functional block diagram of a computer hardware platform 900 is provided. In particular, Fig. 9 A specially configured network or host computer platform 900 is shown that may be used to implement the methods described above.

[0066] Computer platform 900 may include a central processing unit (CPU) 904, a hard disk drive (HDD) 906, random access memory (RAM) and / or read only memory (ROM) 908, a keyboard 910, a mouse 912, a display 914, and a communication interface 916, which are connected to system bus 902. HDD 906 may include data storage.

[0067] In one embodiment, HDD 906 has the ability to include a stored program that can perform various processing in the manner described herein, such as for performing cross-environment event association 950. The cross-environment event association module 950 includes a domain space exploration module 938 and an event grouping module 940, and a reasoning descriptor 942 generates logical reasoning for domain space exploration. The graph generator module 944 is configured to generate an association graph from the extracted semantics or meta-knowledge to track associated issues to help group events. There may be various modules configured to perform different functions that may vary in quantity. For example, a machine learning module 946 may be configured to learn cross-domain associations and causes about the problem. Given data (historical or synthetic), associated events are identified as related groups with confidence levels.

[0068] In one embodiment, a program such as Appachezxf93 may be stored for operating the system as a Web server. In one embodiment, HDD 906 may store an execution application including one or more library software modules, such as those modules of a JavaTM runtime environment program for implementing a JVM (JavaTM virtual machine).

[0069] An example cloud platform

[0070] As described above, the functions related to cross-environment event correlation according to the present disclosure may include a cloud. It should be understood that although the present disclosure includes a detailed description of cloud computing as discussed below, the implementation of the teachings described herein is not limited to a cloud computing environment. On the contrary, embodiments of the present disclosure can be implemented in conjunction with any other type of computing environment now known or later developed.

[0071] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the provider of the service. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0072] Features are as follows:

[0073] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed without requiring manual interaction with the service provider.

[0074] Wide Area Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0075] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. There is location independence in the sense that consumers typically do not control or know the exact location of the resources provided, but are able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0076] Rapid elasticity: In some cases, the ability to scale out quickly and in quickly can be provisioned quickly and elastically. To the consumer, the capacity available for provisioning often appears to be unlimited and can be purchased in any quantity at any time.

[0077] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0078] The service model is as follows:

[0079] Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running on the cloud infrastructure. The applications are accessible from a variety of client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0080] Platform as a Service (PaaS): The capability provided to consumers is to deploy consumer-created or acquired applications created using programming languages ​​and tools supported by the provider onto the cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possible configuration of the application hosting environment.

[0081] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0082] The deployment model is as follows:

[0083] Private Cloud: The cloud infrastructure is operated only for the organization. It can be managed by the organization or a third party and can exist inside or outside the building.

[0084] Community cloud: The cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0085] Public cloud: Cloud infrastructure is available to the general public or large industrial groups and is owned by an organization that sells cloud services.

[0086] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community or public) that remain a unique entity but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0087] The cloud computing environment is service-oriented, with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure consisting of a network of interconnected nodes.

[0088] Reference now Fig.10, describes an illustrative cloud computing environment 1000 that utilizes cloud computing. As shown, the cloud computing environment 1000 includes a cloud 1050 having one or more cloud computing nodes 1010, with which local computing devices used by cloud consumers can communicate, such as personal digital assistants (PDAs) or cellular phones 1054A, desktop computers 1054B, laptop computers 1054C, and / or automotive computer systems 1054N. The nodes 1010 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 1000 to provide infrastructure, platforms, and / or software as a service for which cloud consumers do not need to maintain resources on local computing devices. It should be understood that Fig.10 The types of computing devices 1054A-N shown are intended to be illustrative only, and computing node 1010 and cloud computing environment 1050 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0089] Reference now Fig.11 , showing a cloud computing environment 1000 ( Fig.10 ) provides a set of functional abstraction layers 1100. It should be understood in advance that Fig.11 The components, layers, and functions shown in are intended to be illustrative only, and the embodiments of the present disclosure are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0090] The hardware and software layer 1160 includes hardware and software components. Examples of hardware components include: host 1161; server 1162 based on RISC (Reduced Instruction Set Computer) architecture; server 1163; blade server 1164; storage device 1165; and network and networking components 1166. In some embodiments, software components include network application server software 1167 and database software 1168.

[0091] The virtualization layer 1170 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 1171 ; virtual storage 1172 ; virtual networks 1173 , including virtual private networks; virtual applications and operating systems 1174 ; and virtual clients 1175 .

[0092] In one example, the management layer 1180 may provide the functionality described below. Resource provisioning 1181 provides dynamic procurement of computing resources and other resources that are utilized to perform tasks within a cloud computing environment. Metering and pricing 1182 provides cost tracking when utilizing resources within a cloud computing environment, as well as billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 1183 provides access to the cloud computing environment for consumers and system administrators. Service level management 1184 provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment 1185 provides pre-scheduling and procurement of cloud computing resources, where future demand is anticipated based on the SLA.

[0093] Workload layer 1190 provides examples of functionality that can take advantage of a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include: mapping and navigation 1191; software development and lifecycle management 1192; virtual classroom education delivery 1193; data analytics processing 1194; transaction processing 1195; and event correlation modules 1196, as discussed herein. SUMMARY OF THE INVENTION

[0095] The description of various embodiments of the present teachings has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements existing in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

[0096] Although the above has described what is considered to be the best state and / or other examples, it should be understood that various modifications may be made therein, and the subject matter disclosed herein may be implemented in various forms and examples, and the teachings may be applied to many applications, only some of which are described herein. The appended claims are intended to claim any and all applications, modifications and variations that fall within the true scope of the present teachings.

[0097] The components, steps, features, objects, benefits, and advantages discussed herein are merely illustrative. None of them, or the discussion related to them, is intended to limit the scope of protection. Although various advantages have been discussed herein, it will be understood that not all embodiments necessarily include all advantages. Unless otherwise indicated, all measurements, values, ratings, positions, sizes, dimensions, and other specifications in this specification, including those set forth in the appended claims, are approximate and not exact. They are intended to have a reasonable range consistent with the functions to which they are related and the customary practices of the field to which they belong.

[0098] Many other embodiments are also contemplated. These include embodiments with fewer, additional and / or different components, steps, features, objects, benefits and advantages. These also include embodiments in which components and / or steps are arranged and / or ordered in different ways.

[0099] The flowcharts and diagrams in the figures herein illustrate the architecture, functionality, and operations of possible implementations according to various embodiments of the present disclosure.

[0100] Although the foregoing has been described in conjunction with exemplary embodiments, it should be understood that the term "exemplary" is meant only as an example, rather than the best or optimal. Except as immediately stated above, nothing stated or illustrated is intended or should be construed to cause any component, step, feature, object, benefit, advantage, or equivalent to be dedicated to the public, whether or not stated in the claims.

[0101] It should be understood that, unless a specific meaning is elaborated in addition herein, the terms and expressions used herein have the common meaning consistent with these terms and expressions about their corresponding respective investigation and research fields. Relational terms such as the first and second etc. can be used only to distinguish one entity or action from another, without requiring or implying any such actual relationship or order between these entities or actions. The term "includes", "comprising" or any other variation thereof is intended to cover non-exclusive inclusions, so that the process, method, article or device comprising a series of elements not only include those elements, but also may include other elements that are not clearly listed or are inherent to such a process, method, article or device. In the absence of further constraints, the element with "one" or "an" in front does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0102] The abstract of the present disclosure is provided to allow the reader to quickly determine the nature of the present technical disclosure. It should be understood that it is not used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing detailed description, it can be seen that in order to make the present disclosure smooth, various features are grouped together in various embodiments. This method of disclosure should not be interpreted as reflecting the intention that the claimed embodiments have more features than the features explicitly recited in each claim. On the contrary, as reflected in the attached claims, the subject matter of the present invention lies in less than all the features of a single disclosed embodiment. Therefore, the following claims are hereby incorporated into the specific implementation mode, wherein each claim is independently a subject matter claimed separately.

Claims

1. A computer-implemented method for cross-environment event correlation in a multi-domain computing environment, the method comprising: determining one or more correlated events regarding a problem occurring to a network device across multiple domains; extracting knowledge data of the problem with the network device determined from the one or more correlated events; generating a correlation graph of a knowledge graph including the extracted knowledge data to track the problem of the network device; grouping the correlated events into one or more event groups to indicate a relationship to the problem with the network device; constructing a logical reasoning description based on the generated association graph for domain space exploration related to how a problem in one domain affects another domain in the plurality of domains; as well as Based on the logical reasoning description, an explanation of a cause of the problem of the network device of the one or more associated events is provided to the one or more event groups of associated events to improve computing operations in the plurality of domains.

2. The computer-implemented method of claim 1 , further comprising using machine learning to determine the correlated events about the problem with the network device occurring across multiple domains based on historical data or synthetic data, wherein The extracting of the knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data.

3. The computer-implemented method of claim 2, wherein: Using the machine learning includes training through unsupervised learning techniques using association rule learning algorithms or clustering algorithms.

4. The computer-implemented method of claim 2, wherein: Using the machine learning includes training through supervised learning techniques using labeled data associated with the data association.

5. The computer-implemented method of claim 2, further comprising configuring the machine learning by using a supervised learning technique such as a support vector machine (SVM), a convolutional neural network (CNN), or a long-short term memory (LSTM) based on the size of the associated data.

6. The computer-implemented method of claim 2, further comprising: A most likely event group of associated events in the one or more event groups and an explanation of the cause of the problem with the network device are recommended to a user.

7. The computer-implemented method of claim 6, wherein: Recommending the most likely event group of associated events with the explanation of the cause of the problem with the network device is based on performing create, read, update and delete (CRUD) of data at runtime.

8. The computer-implemented method of claim 6, wherein: Using the machine learning includes a training operation based on receiving feedback for training the determination of the one or more associated events.

9. The computer-implemented method of claim 6, further comprising receiving feedback for determining the one or more associated events through an active learning approach that interactively queries a user or information source to label new data points with desired outputs.

10. The computer-implemented method of any of the preceding claims 1-9, further comprising constructing one or more semantic relationships between the plurality of domains.

11. A computer-implemented method according to any one of the preceding claims 1 to 9, wherein: Identify one or more associated events related to the problem including: collecting one or more of events, logs, metrics, or change records from at least some of the plurality of domains; determining one or more relevant events about the problem by using one or more machine learning techniques; and Produces one or more collected events, logs, or change records in a standardized format.

12. The computer-implemented method of claim 11, wherein: The collection of at least the events, the logs, the metrics, or the change logs is performed offline using synthetic simulation.

13. The computer-implemented method of claim 11 , wherein: At least the collection of the events, the logs, the metrics or the change records is performed offline using historical data.

14. A non-transitory computer-readable storage medium tangibly embodying a computer-readable program code having computer-readable instructions, the computer-readable instructions, when executed, causing a computer device to perform a method for cross-environment event correlation in a multi-domain computing environment, the method comprising: determining one or more correlated events regarding a problem occurring to a network device across multiple domains; extracting knowledge data of the problem with the network device determined from the one or more correlated events; generating a correlation graph of a knowledge graph including the extracted knowledge data to track the problem of the network device; grouping the correlated events into one or more event groups to indicate a relationship to the problem with the network device; constructing a logical reasoning description based on the generated association graph for domain space exploration related to how a problem in one domain affects another domain in the plurality of domains; as well as Based on the logical reasoning description, an explanation of a cause of the problem of the network device of the one or more associated events is provided to the one or more event groups of associated events to improve computing operations in the plurality of domains.

15. The computer-readable storage medium of claim 14, wherein: Extraction of knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data, and The determining of the one or more associated events is performed by machine learning; as well as The method further includes recommending to a user a most likely event group of associated events in the one or more event groups and an explanation of the cause of the problem with the network device.

16. The computer-readable storage medium of claim 15, wherein: Recommending the most likely event group of associated events with the explanation of the cause of the problem with the network device is based on performing create, read, update and delete (CRUD) of data at runtime.

17. The computer-readable storage medium of any one of claims 14-16, the method further comprising constructing one or more semantic relationships between the plurality of domains, and wherein: Identify one or more associated events related to the problem including: collecting one or more of events, one or more logs, one or more metrics, or one or more change records from at least some of the plurality of domains; Determining one or more associated events about the problem by using machine learning techniques; and A standardized format of the one or more collected events, one or more logs, or one or more change records is generated.

18. The computer-readable storage medium of claim 17, wherein: Perform collection of events, logs, metrics, or change records offline using synthetic simulations or historical data.

19. A computing device for performing cross-environment event correlation in a multi-domain computing environment using spatial exploration, comprising: processor; A memory coupled to the processor, the memory storing instructions to cause the processor to perform actions, the actions comprising: determining one or more correlated events regarding a problem occurring to a network device across multiple domains; extracting knowledge data of the problem with the network device determined from the one or more correlated events; constructing a logical reasoning description for domain space exploration related to how a problem in one domain affects another domain in the plurality of domains; generating one or more association graphs including a knowledge graph based on the domain space exploration to track the problem of the network device; grouping the associated events into one or more groups; Constructing semantic relations between different domains, and Based on the logical reasoning description, a most likely event group of correlated events and an explanation of a cause of the problem of the network device with respect to the one or more correlated events are recommended to improve computing operations in the plurality of domains.

20. The computing device of claim 19, wherein: Extraction of knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data, and The processor is configured to perform machine learning of cross-environment event correlation regarding the problem with the network device.

Images