Anomaly detection in network topology

Abstract

A method for training a recurrent neural network to create a model for anomaly detection in a network topology is disclosed. The method includes creating an embedding vector for each resource in the network based on applying an embedding algorithm to each resource of the network. Then, based on one or more attributes of each change to the resource in the network, a feature vector for the change is created. Thus, the recurrent neural network can be trained using the embedding vector and the feature vector to create a model for anomaly detection in the network topology.

Description

Technical Field

[0001] The present invention generally relates to anomaly detection in network topology, and more particularly to a method for training a recurrent neural network to create a model for anomaly detection in network topology. Background Art

[0002] Modern computing network environments, which include interconnected network resources for storage, processing and communication of data, often change dynamically over time. This is especially true in virtualized network environments, where multiple isolated virtualized resources can be independently created and run within a single physical resource. Examples of such virtualized resources, also referred to as "user space instances," may include virtual machines and containers. Virtualized resources may be created on a network for a specific purpose and then removed once the purpose is achieved. For example, one or more copies of a virtualized resource may be dynamically created during a high demand period and subsequently removed when demand returns to normal for the purpose of load balancing. Similarly, additional copies of virtualized resources may be created for the purpose of horizontal scaling. Therefore, in a virtualized network environment, containerized style orchestration, such as using a docker container or Kubernetes, is dynamic in the sense that they experience changes in network topology over time and such changes may occur frequently.

[0003] For anomaly detection in a network, it is desirable to correlate network resources with data associated with them (such as data records related to the network resources). However, anomaly detection in a virtualized network environment is challenging due to dynamically changing network resources and network topologies. Specifically, a single real resource performing a specific role may correspond to multiple virtualized resources, each with a different identifier or tag. Therefore, a detected anomaly associated with a real resource performing a specific service may originate from multiple different and dynamically changing resources (e.g., replicas), and therefore include multiple different and dynamically changing resource identifiers or tags.

[0004] Service management tools are often deployed to monitor the health of networks, IT environments, and applications. These tools typically poll for availability or monitor key performance indicators (KPIs) to assess health. Alternatively, the device itself can emit events to indicate that it needs attention, or it can push information to a log that can then be monitored for the presence of keywords, making operators aware and able to take action. Summary of the invention

[0005] Aspects of the present invention disclose a computer-implemented method, apparatus, and computer program product for training a recurrent neural network to create a model for anomaly detection in a network topology. The computer-implemented method can be implemented by one or more computer processors and can include: creating an embedding vector for each resource in the network based on applying a KubeNode2Vec method to the network; creating a feature vector for each change to the resource in the network based on one or more attributes of the change; and training a recurrent neural network using the embedding vector and the feature vector to create a model for anomaly detection in the network topology.

[0006] In one embodiment, the device may include: a preprocessor configured to: create an embedding vector for each resource in the network based on applying the KubeNode2Vec method to the network; and create a feature vector for each change to the resources in the network based on one or more attributes of the change; and a training processor configured to train a recursive neural network using the embedding vector and the feature vector to create a model for anomaly detection in the topology of the network.

[0007] In another embodiment, a computer program product may include one or more non-transitory computer-readable storage media and program instructions stored on the one or more non-transitory computer-readable storage media, the program instructions including: program instructions for creating an embedding vector for each resource in the network based on applying the KubeNode2Vec method to the network; program instructions for creating a feature vector for each change to the resources in the network based on one or more attributes of the change; and program instructions for training a recursive neural network using the embedding vector and the feature vector to create a model for anomaly detection in network topology. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Preferred embodiments of the present invention will now be described, by way of example only, with reference to the following drawings, in which:

[0009] Figure 1 Describes a graphical representation of an exemplary distributed system in which aspects of the illustrative embodiments of the present invention may be implemented;

[0010] Figure 2 is a block diagram of an example system in which aspects of the illustrative embodiments of the present invention may be implemented;

[0011] Figure 3 A proposed computer-implemented method for training a recurrent neural network to create a model for anomaly detection in a network topology is shown in accordance with an embodiment of the present invention;

[0012] Figure 4 An apparatus configured to train a recurrent neural network to create a model for anomaly detection in a network topology according to an embodiment of the present invention is shown;

[0013] Figure 5 An example of a neural network for outputting a model for anomaly detection according to an embodiment of the present invention is shown; and

[0014] Figure 6 A flowchart of a neural network for creating a model for anomaly detection according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0015] Embodiments of the present invention may provide a method for training a recurrent neural network to create a model for anomaly detection in the topology of a network. The training method may include: creating an embedding vector for each resource in the network based on applying the KubeNode2Vec method to the network; creating a feature vector for each change in the resource in the network based on one or more attributes of the change; and training a recurrent neural network using the embedding vector and the feature vector to create a model for anomaly detection in the topology of the network.

[0016] Embodiments may allow a recurrent neural network (RNN) to learn topological changes of a network by learning from embeddings of resources and changes to the resources. Thus, the RNN may learn temporary topological changes, for example, by learning using a sequence of embeddings of resources augmented with feature vectors containing information about the attributes of the changes.

[0017] The KubeNode2Vec embedding method is able to exploit historical changes to the topology to learn abstract temporal relationships and thus increase the accuracy of RNN detection of anomalies. In addition, the method can be used on resources that have never been seen before, thereby catering to the dynamic characteristics of the topology over time. This is particularly useful in Kubernetes when using autoscaling (e.g., cluster autoscaling or horizontal cluster (pod) autoscaling), because copies of clusters and / or new nodes can be created depending on the needs of the cluster. Therefore, the embedding of dynamic environments is better described using KubeNode2Vec.

[0018] This embodiment can be a sequence learning method that is augmented with auxiliary data. The advantage of this method is that it can detect abnormal changes in the topology of a dynamic environment by considering not only whether the change is perceptible based on what other changes have occurred from the learned history before the change, but also other important characteristics of the change.

[0019] In some embodiments, creating the feature vector is based on one-hot coding or one-cold coding of the corresponding changed attributes.

[0020] One-hot encoding (or one-cold encoding) can allow all data of a particular feature (changing attribute) to be classified without giving a higher value to any one of the categories. In contrast, if label encoding is used, this can give the last category with label n (out of n labels) a higher number and therefore a disproportionate importance when analyzed by a machine learning algorithm (e.g., n>1, n>n-1, etc.).

[0021] The present invention may also provide a device configured to train a recurrent neural network to create a model for anomaly detection in a network topology. The device may include a preprocessor configured to create an embedding vector for resources in the network based on applying an embedding algorithm to the resources of the network, and may create a feature vector for the change based on one or more attributes of the change of the resources in the network. The device may also include a training processor configured to train a recurrent neural network using the embedding vector and the feature vector to create a model for anomaly detection in a network topology.

[0022] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter.

[0023] References in the specification to "one embodiment," "example embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Furthermore, these phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is considered to be within the knowledge of those skilled in the art to implement such feature, structure, or characteristic in conjunction with other embodiments, whether or not explicitly described.

[0024] It should be understood that the drawings are merely schematic and are not drawn to scale. It should also be understood that the same reference numerals are used throughout the drawings to represent the same or similar components.

[0025] The KubeNode2Vec embedding method can exploit the historical changes in the topology to learn abstract temporal relationships, thereby improving the accuracy of RNN detection of anomalies. In addition, the method can be used on resources that have never been seen before, such as replicas of clusters or nodes. This is particularly useful in Kubernetes when using autoscaling (e.g., cluster autoscaling or horizontal cluster autoscaling), because replicas of clusters and / or new nodes can be created dynamically.

[0026] The method can be additionally augmented with auxiliary data.The advantage of this method is that it can detect abnormal changes in the topology of a dynamic environment by considering not only whether the change is perceptible based on what other changes occurred before the change (from the learned history), but also other important characteristics of the change.

[0027] In some embodiments, the recurrent neural network includes an input layer for receiving an embedding vector; a learning layer following the input layer; a concatenation layer for concatenating the feature vector with the output of the sequence learning layer; one or more dense layers; and an output layer for outputting a model for anomaly detection.

[0028] For example, the input layer of the RNN can be five embedding vectors corresponding to the five clusters in the sequence of changes of the embedding vectors. Therefore, the RNN can learn a sequence of five embedding vectors and the corresponding feature vectors at the same time. The sequence learning layer can be used to keep some memory of the previous sequence of embedding vectors (the sequence of changes). The output of the sequence learning layer can therefore contain information about the change being processed as well as the previous changes (five) in the sequence.

[0029] The output of the sequence learning layer can be concatenated with a feature vector corresponding to the attributes of the change. Thus, one or more dense layers can learn from the sequence of changes and the attributes of the changes being processed. This means that the RNN can learn to detect abnormal changes in the topology of the network (dynamic environment) based on the topological changes and the attributes of the changes.

[0030] Thus, the RNN is able to learn from the embedding of the vector (based on past embeddings) and thereafter learn features corresponding to the sequence of changes (e.g., time of change, date of change, etc.). Thus, the RNN can be trained to output a probability model corresponding to possible future changes (and corresponding probabilities). Then, for example, by observing the changes and the corresponding probabilities of the changes occurring, anomalies can be detected. A threshold probability can be set to detect anomalies (e.g., anomalies based on probabilities <1%).

[0031] In some embodiments, the change attribute is one or more of: an entity type corresponding to a resource that made the change; a change type; and a change time.

[0032] Based on the different change attributes selected, the RNN can learn different abstract relationships between these changes. Different change attributes can be selected based on user preferences or anomalies to be detected. In another example, the CPU usage percentage can be a change attribute to detect anomalies in CPU usage (e.g., anomalies are based on CPU usage > 80%). In yet another example, the RNN can know that a certain change type is performed every Wednesday. Therefore, if the expected change is seen on Wednesday, an anomaly can be detected.

[0033] In some embodiments, creating a feature vector can be based on one-hot encoding or one-cold encoding of the corresponding changing attributes. One-hot encoding (or one-cold encoding) allows all data of a specific feature (changing attribute) to be classified without assigning a higher value to any one of the categories.

[0034] The RNN can also learn that there are more changes during certain time periods. Therefore, if many changes are not seen during a specified busy time period, this can signal an anomaly in the network topology. For example, many nodes may join a cluster on weekdays, but not on weekends. If an abnormal number of nodes join during Saturdays, this can be marked as an anomaly.

[0035] In some embodiments, the sequence learning layer can be a long short-term memory (LSTM), an LSTM layer, or a gated recurrent unit (GRU) layer. LSTM uses feedback connections to process data sequences and is well suited for making predictions and determining the probability of events occurring. In addition, LSTM provides excellent "memory" when long sequences need to be learned.

[0036] In some embodiments, the sequence learning layer can be a gated recurrent unit GRU layer. GRU is generally faster to train than LSTM and can outperform LSTM in some cases. In addition, GRU is simpler than LSTM and can be modified more easily.

[0037] In some embodiments, training a recurrent neural network can be based on sequence learning. Sequence learning such as sequence to sequence (Seq2Seq) can be used to train a machine learning algorithm to convert input from one domain to another. Thus, a machine learning algorithm can be trained to receive changes in the network topology and convert these changes into predictions for the next change.

[0038] The present invention may also provide a device configured to train a recurrent neural network to create a model for anomaly detection in a network topology. The device may include a preprocessor configured to create an embedding vector for resources in the network based on applying an embedding algorithm to the resources of the network, and may create a feature vector for the change based on one or more attributes of the change of the resources in the network. The device may also include a training processor configured to train a recurrent neural network using the embedding vector and the feature vector to create a model for anomaly detection in a network topology.

[0039] Figure 1A graphical representation of an exemplary distributed system in which aspects of the exemplary embodiments may be implemented is depicted. Distributed system 100 may include a network of computers in which aspects of the illustrative embodiments may be implemented. Distributed system 100 contains at least one network 102, which is a medium for providing communication links between various devices and computers connected together within distributed system 100. Network 102 may include connections such as wired, wireless communication links, or fiber optic cables.

[0040] In the described example, the first server 104 and the second server 106 are connected to the network 102 together with a storage system 108, which may include, for example, a RAID storage array formed by a plurality of storage units. However, other storage systems may be envisioned. In addition, clients 110, 112, and 114 are also connected to the network 102. Clients 110, 112, and 114 may be, for example, personal computers, network computers, etc. In the described example, the first server 104 provides data, such as boot files, operating system images, and applications, to clients 110, 112, and 114. In the described example, clients 110, 112, and 114 are clients of the first server 104. The distributed system 100 may include additional servers, clients, and other devices not shown.

[0041] In the depicted example, distributed system 100 is the Internet, where network 102 represents a worldwide collection of networks and gateways that use the Transmission Control Protocol / Internet Protocol (TCP / IP) protocol suite to communicate with each other. The core of the Internet is a backbone of high-speed data communication lines between major entities or hosts, consisting of thousands of commercial, government, educational, and other computer systems that route data and messages. Of course, distributed system 100 can also be implemented to include multiple different types of networks, such as intranets, local area networks (LANs), wide area networks (WANs), etc. As described above, Figure 1 It is intended as an example and not as an architectural limitation to the different embodiments of the present invention, and thus, Figure 1 The specific elements shown are not to be construed as limiting the environments in which illustrative embodiments of the invention may be implemented.

[0042] The network 102 may be configured to perform one or more methods according to embodiments of the present invention, for example, controlling storage of written data within the storage system 108 .

[0043] Figure 2 2 is a block diagram of an example system 200 in which aspects of the illustrative embodiments may be implemented. The system 200 is such as Figure 1The example of a computer of client 110 in which computer usable code or instructions implementing the processes of the illustrative embodiments of the present invention may be located. For example, system 200 may be configured to implement a pre-processor and a training processor according to an embodiment.

[0044] In the depicted example, system 200 employs a hub architecture that includes a north bridge and memory controller hub (NB / MCH) 202 and a south bridge and input / output (I / O) controller hub (SB / ICH) 204. A processing system 206, main memory 208, and a graphics processor 210 are connected to NB / MCH 202. Graphics processor 210 may be connected to NB / MCH 202 via an accelerated graphics port (AGP).

[0045] In the depicted example, a local area network (LAN) adapter 212 is connected to the SB / ICH 204. An audio adapter 216, a keyboard and mouse adapter 220, a modem 222, a read-only memory (ROM) 224, a hard disk drive (HDD) 226, a CD-ROM drive 230, a universal serial bus (USB) port and other communication ports 232, and a PCI / PCIe device 234 are connected to the SB / ICH 204 via a first bus 238 and a second bus 240. PCI / PCIe devices may include, for example, Ethernet adapters, add-on cards, and PC cards for notebook computers. PCI uses a card bus controller, while PCIe does not. ROM 224 may be, for example, a flash basic input / output system (BIOS).

[0046] HDD 226 and CD-ROM drive 230 are connected to SB / ICH 204 via second bus 240. HDD 226 and CD-ROM drive 230 may use, for example, an integrated drive electronics (IDE) or serial advanced technology attachment (SATA) interface. Super I / O (SIO) device 236 may be connected to SB / ICH 204.

[0047] An operating system runs on processing system 206. The operating system coordinates and provides Figure 2 The control of various components within the system 200 in the system 200. As a client, the operating system can be a commercially available operating system. An object-oriented programming system, such as a Java™ programming system, can run with the operating system and provide calls from a Java™ program or application executing on the system 200 to the operating system.

[0048] As a server, system 200 may be, for example, a server running an advanced interactive execution Operating system or Operating System eSeverTM Computer System. System 200 may be a symmetric multiprocessor (SMP) system including multiple processors in processing system 206. Alternatively, a single processor system may be employed.

[0049] Instructions for the operating system, programming system, and applications or programs are located on storage devices such as HDD 226 and may be loaded into main memory 208 for execution by processing system 206. Similarly, one or more message handling programs according to embodiments may be suitable for storage by storage devices and / or main memory 208.

[0050] The processes for the illustrative embodiments of the present invention may be performed by processing system 206 using computer usable program code that may be located in a memory such as main memory 208 , ROM 224 , or in one or more peripheral devices HDD 226 and CD-ROM drive 230 .

[0051] Such as Figure 2 The bus system shown as the first bus 238 or the second bus 240 may include one or more buses. Of course, the bus system may be implemented using any type of communication structure or architecture that provides for data transmission between different components or devices attached to the structure or architecture. Figure 2 A communication unit such as a modem 222 or a network adapter 212 may include one or more devices for transmitting and receiving data. The memory may be, for example, the main memory 208, the ROM 224, or a memory such as a memory card. Figure 2 The cache found in NB / MCH 202 in.

[0052] Those of ordinary skill in the art will understand that Figure 1 and 2 The hardware in can vary depending on the implementation. Figure 1 and 2 In addition to or in place of the hardware described in the foregoing, other internal hardware or peripheral devices may be used, such as flash memory, equivalent non-volatile memory, or an optical disk drive, etc. Likewise, the processing of the exemplary embodiments may be applied to a multi-processor data processing system in addition to the aforementioned system without departing from the scope of the present invention.

[0053] Furthermore, system 200 may take the form of any of a variety of different data processing systems, including a client computing device, a server computing device, a tablet computer, a laptop computer, a phone or other communication device, a personal digital assistant (PDA), etc. In some illustrative examples, system 200 may be a portable computing device that is configured with flash memory to provide non-volatile memory for storing, for example, operating system files and / or user-generated data. Thus, system 200 may be essentially any known or later developed data processing system, without architectural limitation.

[0054] Figure 3 The proposed computer-implemented method is shown for training a recurrent neural network 308 to create a model 309 for anomaly detection in the topology of the network 302. The recurrent neural network 308 may include an input layer 310, a sequence learning layer 311 (e.g., an LSTM unit, a GRU unit, or any other sequence learning method, etc.), a concatenation layer 312 for concatenating the feature vector with the output of the sequence learning layer 311, one or more dense layers 313, and an output layer 314 that outputs the model 309 for anomaly detection. Training the recurrent neural network 308 may be accomplished through sequence learning.

[0055] The method is based on creating an embedding vector 304 for a resource in the network 302. The embedding vector 304 can be created by applying the KubeNode2Vec method 303 to the resources of the network 302. The resources of the network 302 can be independent services that provide computing power / storage and / or any other computing services related to the use of the network. For example, the resource can be a node in the network 302.

[0056] A feature vector 306 is also created from the network 302. The feature vector 306 is based on the attributes of the changes that occurred to the topology of the network 302. The change attribute can be, for example, the entity type (corresponding to the resource that made the change), the change type, or the change time (a day of the week, the time of the change, etc.). Creating the feature vector 306 can be accomplished by one-hot encoding 305 (or one-cold encoding).

[0057] Recurrent neural network 308 may thus be trained with embedding vector 304 and feature vector 306 to create a model for anomaly detection in the topology of network 302 .

[0058] Figure 4 An apparatus is shown configured to train a recurrent neural network 308 to create a model 309 for anomaly detection in the topology of the network 302. The apparatus includes a pre-processor 402 and a training processor 404. Figure 4 A change to the topology of network 302 is shown by adding a new resource 406 to network 302. This may be due to duplication of a current resource, for example.

[0059] Changes to the topology of network 302 (e.g., creating a replica cluster) can be input to preprocessor 402. Preprocessor 402 can create embedding vectors 304 for resources (e.g., clusters / nodes / containers) in network 302 based on applying the KubeNode2Vec method to the resources in network 302.

[0060] The preprocessor 402 may also create a feature vector 306 for changes to resources in the network 302 based on one or more attributes of the changes. The change attribute may be, for example, an entity type (corresponding to the resource that made the change), a change type, or a change time (a day of the week, a time of the change, etc.). Creating the feature vector 306 may be accomplished by one-hot encoding or one-cold encoding.

[0061] The training processor 404 may be configured to train a recurrent neural network using the embedding vectors 304 and the feature vectors 306 to create a model 309 for anomaly detection in the topology of the network 302. The recurrent neural network may include an input layer for receiving a sequence of embedding vectors 304, a sequence learning layer (e.g., an LSTM unit, a GRU unit, or any other sequence learning method, etc.) following the input layer, a concatenation layer for concatenating the feature vectors 306 with the output of the sequence learning layer, one or more dense layers, and an output layer that outputs the model 309 for anomaly detection.

[0062] Embedding vector:

[0063] The embodiments of the present invention will be described in detail later based on the Kubernetes system. However, it should be noted that the embodiments are not limited to the Kubernetes system and can be used in other network architectures.

[0064] Given the history of the network topology over time, the embedding of resources can be learned within the topology. This can be done via the KubeNode2Vec method A approach to learn abstract temporal relationships using the historical changes in the topology. The reason for choosing this approach is that it caters to the dynamic nature of the topology over time.

[0065] The KubeNode2Vec method may receive network topology information including historical snapshots of the network topology. The historical snapshot may include a recent snapshot of the network topology and one or more previous historical snapshots of the network topology. In particular, the snapshot may include network topology information for the arrangement of resources and connections for the network at a specific point in time. The network topology information may be obtained from a data store having snapshot data received from a network topology discovery mechanism, etc. Any suitable network topology discovery mechanism may be used to capture and maintain network topology information, including historical snapshots. As will be appreciated by those skilled in the art, the topology of a dynamic network changes over time as resources are dynamically added to and removed from the network. Therefore, the original network topology information obtained for a single snapshot, such as the most recent snapshot, may not contain enough information for deep learning related to the network. According to the present disclosure, historical network topology information including multiple snapshots is used for deep learning. Specifically, the network topology information in the historical snapshots may be used, for example, to identify stable parts of the network that may change minimally over time, and conversely parts of the network that may change frequently over time. Therefore, the use of historical snapshots provides richer topology information to facilitate improved learning of the characteristics and behaviors of dynamic networks.

[0066] The KubeNode2Vec method can identify two or more scale nodes (scale node) that perform the same role and are connected to the same non-scale node (non-scale node) set in each snapshot of the network topology. In particular, it can compare the nodes in each historical snapshot of the network topology with other nodes in the same snapshot of the network topology. As described above, the KubeNode2Vec method can identify the scale nodes in the network topology from the data parameters of the topology metadata associated with each resource or node. In addition, it can identify the role of each identified scale node from the topology metadata, such as function or purpose, and its connection to the non-scale node. It is understood that the scale nodes with the same role and the same connection to the non-scale node in the network topology perform exactly the same role or "function" in the network, for example, as a copy for purposes such as load balancing. Therefore, KubeNode2ec is able to identify groups of two or more scale nodes that perform the same role and are connected to the same non-scale node from the topology information. It is understood that in any single snapshot of the network topology, multiple groups of scale nodes associated with different roles or services can be identified.

[0067] The KubeNode2Vec method can modify each network topology snapshot by replacing the scale nodes within a set of scale nodes having the same role and connected to the same set of non-scale nodes with a newly created single aggregate node. A single aggregate node can have a new node identifier. Therefore, KubeNode2Vec can modify each snapshot to derive modified topology information representing the modified network topology. The process of replacing a scale node with a single aggregate node is referred to herein as "folding a scale node", and a single "aggregate node" is referred to herein as a "synthetic node". In an example implementation, KubeNode2Vec can replace nodes belonging to a set of identified scale nodes with a single aggregate node. Therefore, a set of scale nodes are associated with the same node identifier, i.e., a new identifier for an aggregate / synthetic node. In addition, KubeNode2Vec can replace a set of edges starting from a scale node in a set of scale nodes with a single "aggregate edge", which can be weighted based on the average of the weights of the combined set of edges, or weighted using another suitable technique for combining edge weights. Therefore, it modifies the network topology information of the historical snapshot by identifying "scaling nodes" that perform the same role or service within the network and collapsing them into combined or aggregated nodes so that they are treated as a single resource for determining their feature representation. In an example implementation, KubeNode2Vec can associate the original node identifier of the scale node represented by the aggregate node with the corresponding aggregate node identifier. For example, it can store corresponding mapping information for mapping the original node identifier to the aggregate node identifier.

[0068] It can be appreciated that the KubeNode2Vec method can derive improved feature representations from nodes (i.e., network resources) in dynamic networks, such as in virtualized network environments where the network topology changes frequently over time. In particular, by deriving common feature representations for scale nodes that perform the same role and are connected to the same set of non-scale nodes, it is easier to use feature representations to associate and correlate resources and associated data in the network topology.

[0069] Below is pseudocode that adapts the Node2Vec algorithm to execute the KubeNode2Vec method as an example:

[0070] Prerequisites: Iterate the available network topology information from earliest time to latest time, collect all historical snapshots H over time to capture changes to the topology. Periodically, or every time a specific change occurs, capture a snapshot H of the topology, and add a graph of that network topology snapshot to the collection, e.g., with an associated timestamp.

[0071] CollapsScaleNode(graph G = (V, E, W))

[0072] For the "scale node" group s in V that has the same role and is connected to the same "non-scale node" group ns

[0073] Replace s with a single compositing node

[0074] Replace the edges in E starting from nodes in set s to set ns with new edges. The weight of the new edges is the average of the weights of the original edges folded into them.

[0075] Return to G

[0076] LearnFeatures (all historical snapshots of the topology H, dimension d, number of steps per node r, step length l, context size k, return p, in and out q)

[0077] For the graph G in the set H of historical snapshots of the topology = (V, E, W)

[0078] Gc=CollapseScaleNodes(G)

[0079] π=PreprocessModifiedWeights(Gc,p,q)

[0080] G'=(V,E,π)

[0081] Initialize walk to empty

[0082] for iter=1to r do

[0083] for node u∈V do

[0084] walk = node2vecWalk(G',u,l)

[0085] Attach step by step

[0086] f=StochasticGradientDescent(k,d,walks)

[0087] Return f

[0088] node2vecWalk(graph G'=(V,E,π), starting node u, length l)

[0089] Initialize walk to [u]

[0090] for walk_iter=1to l do

[0091] Curr=walk[-1]

[0092] Vcurr=GetNeighbors(Curr,G')

[0093] s=AliassSample(Vcurr,π)

[0094] Append s to walk

[0095] Return to walk

[0096] / *Easily obtain the feature vector representing the neighbors of a node using the same sampling strategy as during feature learning* /

[0097] generateNeighborSignatures(feature f, graph G' = (V, E, π))

[0098] Initialize an empty map M from vectors to nodes

[0099] For node v' in G'

[0100] nb=GetNeighbors(v,G')

[0101] sig = the average of the feature vectors of the neighboring nodes in nb after learning (obtained from f, which is the result of calling the above learning)

[0102] Add (sig,v) to the map m

[0103] Returns the map m

[0104] Change the sequence dataset:

[0105] Construct a change sequence dataset, iterate over all historical changes to the network topology, and record them in a sequence, for example:

[0106]

[0107]

[0108] A sliding window of a predetermined size, such as 5, is used on each change to collect the change sequences. For example, some of the sequences collected from the table are:

[0109] Sequence 1: Pod1 Pod3 Pod8 Pod12 Pod15 Sequence 2: Pod3 Pod8 Pod12 Pod15 … Sequence 3: Pod8 Pod12 Pod15 … … Sequence 4: Pod12 Pod15 … … … Sequence n: … … … … Pod94

[0110] The change sequence can be transformed so that the vector representation of the clusters (embedding vectors for each cluster) can be used instead of their IDs. After this transformation, a list of change sequences can be obtained, where the change sequence is a sequence of embedding vectors.

[0111] Feature dataset:

[0112] For change records, a feature vector containing additional attributes such as entity type, change type, and time details can be constructed. Since entity type is categorical in nature, one-hot encoding (or one-hot encoding) can be used to create the feature vector. Change type is also categorical in nature, so one-hot encoding can be allowed. For time details, time of day and day of week can be considered as two separate fields. Similarly, one-hot encoding can be used to create feature vectors accordingly. An example of using one-hot encoding for a day of the week can be found in the following table:

[0113] date Hot Monday 0000001 Tuesday 0000010 Wednesday 0000100 Thursday 0001000 Friday 0010000 Saturday 0100000 Sunday 1000000

[0114] After constructing one-hot vectors for the three aspects (time of day, day of the week, type of change), they can be appended together into a single feature vector. It should be noted that the features (change attributes) are not limited to the three features mentioned, and may include other metadata / attributes, such as but not limited to: geographic location, CPU percentage usage, RAM percentage usage, CPU temperature, etc. For example, CPU usage may be classified as "high", "medium", or "low" usage, and then one-hot encoded as "high" = 001, "medium" = 010, or "low" = 100. "High" CPU usage may be >75%, >80%, >85%, or any other percentage that can be derived by a person skilled in the art. Similarly, CPU usage of <50%, <45%, <40% may be "low" CPU usage. Alternatively, CPU usage may be classified in steps of 1%, 5%, 10%, 20%, etc., from 0% to 100%.

[0115] Training the Neural Network:

[0116] Figure 5 An example of a neural network for outputting a model 309 for anomaly detection is shown. Resources 502 (eg, clusters, nodes, containers, etc.) within a change sequence and their corresponding feature vectors 306 representing additional characteristics can be used to train a recurrent neural network.

[0117] In this example, the neural network is a recurrent neural network with long short-term memory (LSTM) units 504. Resources 502 within a fixed-size changing sequence can be fed into the neural network. The embedding vector 304 of the resource 502 can be obtained via the KubeNode2Vec algorithm. This embedding vector 304 can be fed into the LSTM unit 504. Note that as is typical in a recurrent neural network, in addition to the usual input at the time step, the output of the previous step LSTM unit 504 is fed to the next step.

[0118] At these time steps, the output of the LSTM unit 504 is concatenated with the corresponding feature vector 306. By augmenting the LSTM output with the feature vector 306, the network can learn any patterns related to the entity types, change types, and time / seasonal patterns present in the training data. Alternatively, a GRU unit can be used instead of an LSTM.

[0119] The concatenated input vectors 506 may be fed into one or more dense layers 508. The final output layer may contain outputs (Logits) 510, which are multinomial distributions that may be used to create a model 309 to predict the next change.

[0120] Figure 6 A flow chart of a neural network for creating a model 309 for anomaly detection is shown. Resources 502 in a sequence of changes from a dataset 602 may be embedded into an embedding vector 304 and fed to an LSTM unit 504, as previously described. The feature vector 306 and the output of the LSTM unit 504 may be concatenated, where the feature vector 306 has been one-hot encoded. The concatenated input vector 506 may then be fed into a dense layer 508, which outputs a model 309 for anomaly detection (based on a multinomial distribution - output 510).

[0121] Use the model for anomaly detection:

[0122] Once the recurrent neural network is trained, the model 309 output by the neural network can be used to detect abnormal changes to the network topology.

[0123] Model 309 can generate a multinomial distribution representing the prediction for the next change. This distribution can be used to calculate the likelihood of the observed change, and if the change is below a threshold, the change can be marked as an anomaly.

[0124] In one example, there is a Kubernetes cluster that uses Kubernetes horizontal cluster autoscaling on deployments. Depending on network requirements and rules, such as (but not limited to) CPU utilization (e.g., when a node's CPU utilization reaches 75%, create a replica of the cluster on a second node), there may be many replicas of the cluster at any time.

[0125] Typically, embedding methods such as Node2Vec can distinguish between replicas. However, using an embodiment of the method of the present invention, KubeNode2Vec can determine that a cluster on a different node is a replica (of the first cluster), even if the second node has never been seen before (e.g., using the cluster autoscaler on Kubernetes).

[0126] Therefore, when creating the embedding vectors for the cluster, the KubeNode2Vec method can determine that they are the same, and thus obtain an embedding observation for the cluster (with multiple replicas). This allows more information about the cluster's behavior to be stored in the embedding vector 304.

[0127] Thus, a neural network may be trained with embedding vectors 304 and feature vectors 306 for changes (e.g., changes being generated, clusters being launched, etc.) The model 309 output by the neural network may also predict, for example, the creation of cluster replicas, regardless of the node the model 309 is using.

[0128] In another example, a recurrent neural network can be trained to learn the changing sequence of containers in a cluster. Due to the general size of the cluster, the training material for the containers is much lower and it takes less time to train the recurrent neural network.

[0129] Changes in the containers of a single cluster can be input to train the recurrent neural network and provide predictions for the next change. For example, certain containers may be used more during certain times of the day. Thus, the recurrent neural network can learn how the cluster functions under normal circumstances and help detect abnormal behavior.

[0130] Alternatively, it may be desirable to detect anomalies in the nodes (hardware computing machines and / or virtual machines) of a cluster. In this case, a recurrent neural network may be trained to learn a sequence of changes to the nodes. Thus, the model 309 output may be a distribution representing a prediction of changes to the nodes, and thus anomalies (or chains of anomalies) of the nodes may be detected, possibly signaling a hardware problem.

[0131] However, the use of embodiments of the present invention is not limited to clusters, containers or nodes in a Kubernetes system. Embodiments of the present invention can also be used for (but not limited to) node networks, virtual machine networks, container-based architectures, etc.

[0132] In one example, the present invention can be used in the context of creating a key performance indicator (KPI). Abnormal topology changes can be used as a KPI by looking at a certain time period and determining whether the number of changes exceeds a threshold (e.g., 0). Topology changes in a very static environment can indicate a problem. Multiple metrics about the system can be used to determine that abnormal topology changes are causing errors and / or increased latency, or that abnormal topology changes generally result in undesirable behavior of topology members or underlying network metrics.

[0133] In the context of the present application, where the embodiments of the present invention constitute methods, it should be understood that such methods are processes for being executed by a computer, i.e., are computer-implemented methods. Therefore, the various steps of the method reflect various parts of a computer program, such as various parts of one or more algorithms.

[0134] The present invention may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform various aspects of the present invention.

[0135] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example (but not limited to), an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a storage class memory (SCM), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0136] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the respective computing / processing device.

[0137] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and conventional procedural programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, by using the Internet of an Internet service provider). In certain embodiments, in order to perform various aspects of the present invention, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can execute the computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0138] Aspects of the present invention are described herein with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to embodiments of the present invention. It will be understood that each frame of the flow chart and / or block diagram and the combination of frames in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0139] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a module for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0140] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0141] Flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in flow chart or block diagram can represent the module, segment or part of instruction, and it comprises one or more executable instructions for realizing the logical function of appointment.In some alternative embodiments, the function mentioned in the frame can not occur in the order mentioned in the figure.For example, two frames shown continuously can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, and this depends on the function involved.It will also be noted that the combination of the frame in each frame of block diagram and / or flow chart illustration and block diagram and / or flow chart illustration can be realized by the system based on special hardware that performs the combination of specified function or action or performs special hardware and computer instruction.

[0142] The description of various embodiments of the present invention has been given for the purpose of illustration, but it is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements existing in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A computer-implemented method for training a recurrent neural network to create a model for anomaly detection in a topology of a network, the computer-implemented method comprising: Based on applying the KubeNode2Vec method to the network on the basis of the Kubernetes system, an embedding vector for resources in the network is created, wherein the KubeNode2Vec method includes: collecting snapshots corresponding to the topology of the network; mapping scale nodes, edges, and steps based on the snapshots; learning all features corresponding to the results from the mapping by storing as a sampling strategy; initializing the steps from the mapping; and using the sampling strategy to obtain one or more feature vectors representing the neighbors of each of the scale nodes and the steps; creating a feature vector from the one or more feature vectors for each of the changes to the resources in the network based on one or more attributes of each of the changes to the resources in the network; and training a recurrent neural network using the embedding vector and the feature vector to create the model for anomaly detection in the topology of the network, and Wherein, the recurrent neural network comprises: An input layer, configured to receive the embedding vector; a sequence learning layer following the input layer; A concatenation layer, used for concatenating the feature vector with the output of the sequence learning layer; one or more dense layers; and The output layer is used to output the model for anomaly detection.

2. The method according to claim 1, wherein: The one or more attributes of the change are one or more of the following: the entity type corresponding to the resource to which the change was made; Change type; and Change the time.

3. The method according to claim 1, wherein: Creating the one or more feature vectors is based on one-hot encoding or one-cold encoding corresponding to the one or more attributes of the change.

4. The method according to claim 1, wherein: The sequence learning layer is a long short-term memory (LSTM) layer.

5. The method according to claim 1, wherein: The sequence learning layer is a gated recurrent unit (GRU) layer.

6. A method according to any one of the preceding claims, wherein: Training the recurrent neural network is based on sequence learning.

7. An apparatus configured to train a recurrent neural network to create a model for anomaly detection in a topology of a network, the apparatus comprising: The preprocessor is configured as: Based on applying the KubeNode2Vec method to the network on the basis of the Kubernetes system, an embedding vector for each resource in the network is created, wherein the KubeNode2Vec method includes: collecting snapshots corresponding to the topology of the network; mapping scale nodes, edges, and steps based on the snapshots; learning all features corresponding to the results from the mapping by storing as a sampling strategy; initializing the steps from the mapping; and Using the sampling strategy to obtain one or more feature vectors representing neighbors of each of the scale nodes and the step; creating a feature vector from the one or more feature vectors for each of the changes to the resources in the network based on one or more attributes of the changes to the resources in the network, and a training processor configured to train a recurrent neural network using the embedding vector and the feature vector to create the model for anomaly detection in the topology of the network, and Wherein, the recurrent neural network comprises: The input layer is configured to receive the embedding vector; a sequence learning layer following the input layer; A concatenation layer configured to concatenate the feature vector with an output of the sequence learning layer; one or more dense layers; and The output layer is used to output the model for anomaly detection.

8. The device according to claim 7, wherein: The one or more attributes of the change are one or more of the following: the entity type corresponding to the resource to which the change was made; Change type; and Change the time.

9. The device according to claim 7, wherein: Creating the one or more feature vectors is based on one-hot encodings corresponding to the one or more attributes of the change.

10. The device according to claim 7, wherein: The sequence learning layer is a long short-term memory (LSTM) layer.

11. The device according to claim 7, wherein: The sequence learning layer is a gated recurrent unit (GRU) layer.

12. The device according to any one of claims 7 to 11, wherein: Training the recurrent neural network is based on sequence learning.

13. A computer program product comprising a computer readable medium, the computer readable medium comprising software code portions executable on a computing device for performing a method for training a recurrent neural network to create a model for anomaly detection in a topology of a network, the computer program product comprising: One or more non-transitory computer-readable storage media and program instructions stored on the one or more non-transitory computer-readable storage media, the program instructions comprising: Program instructions for creating an embedding vector for each resource in the network based on applying a KubeNode2Vec method to the network on the basis of a Kubernetes system, wherein the KubeNode2Vec method includes: collecting snapshots corresponding to the topology of the network; mapping scale nodes, edges, and steps based on the snapshots; learning all features corresponding to the results from the mapping by storing as a sampling strategy; initializing the steps from the mapping; and using the sampling strategy to obtain one or more feature vectors representing the neighbors of each of the scale nodes and the steps; program instructions for creating a feature vector from the one or more feature vectors for each of the changes to the resources in the network based on one or more attributes of each of the changes to the resources in the network; and program instructions for training a recurrent neural network using the embedding vector and the feature vector to create the model for anomaly detection in the topology of the network, and Wherein, the recurrent neural network comprises: An input layer, configured to receive the embedding vector; a sequence learning layer following the input layer; A concatenation layer, used for concatenating the feature vector with the output of the sequence learning layer; one or more dense layers; and The output layer is used to output the model for anomaly detection.

14. The computer program product of claim 13, wherein the one or more attributes that are changed are one or more of: The entity type corresponding to the resource on which the change was made; Change type; and Change the time.

15. The computer program product of claim 13, wherein: The program instructions for creating the one or more feature vectors are based on one hot encoding or one cold encoding of the one or more attributes associated with the change.

16. The computer program product of claim 13, wherein: The sequence learning layer is a long short-term memory (LSTM) layer.

17. The computer program product of claim 13, wherein: The sequence learning layer is a gated recurrent unit (GRU) layer.

Images