Context-aware anomaly detection

Abstract

A computer-implemented method for context-aware anomaly detection includes receiving a signal containing real-time data, dividing the received signal into a set of training wavelets bounded by respective training contexts, and generating a predictive model for the training scenarios to identify patterns in data sequences of respective training wavelets by processing the set of training wavelets through a recurrent neural network. The method includes, in response to a current context being different from the training contexts, extracting a current wavelet from a signal of the current context, identifying pairwise matches between the current wavelet and wavelet patterns of the predictive model by aligning sequences of the current wavelet and sequences of wavelet patterns of the predictive model. An anomaly is identified upon determining that a total cumulative distance between the two sequences exceeds a predetermined threshold.

Description

Background Technology

[0001] This invention relates to a context-aware anomaly detection system and method. Specifically, this disclosure relates to a system and method for automatically determining the context of real-time data and, based on the context, determining the detection of anomalies from real-time data from one or more data sources.

[0002] Existing methods for anomaly detection require users to manually identify the context of real-time data and pinpoint any anomalies present. It may be necessary to automate the context identification and anomaly detection process, thereby reducing reliance on user-provided classifications and / or identifications. Summary of the Invention

[0003] Embodiments of this disclosure relate to a computer-implemented method for context-aware anomaly detection. The method includes: receiving a signal comprising real-time data; dividing the received signal into a set of training wavelets defined by corresponding training contexts; and processing the training wavelet set via a recurrent neural network to generate a predictive model for the training context, identifying patterns in the data sequences of the corresponding training wavelets. The method further includes, in response to the execution of a current context different from the training context, extracting a current wavelet from the signal of the current context, and identifying pairwise matches between the same dimensions of the current wavelet and the wavelet patterns of the predictive model by aligning the sequence of the current wavelet with the sequence of wavelet patterns of the predictive model. The method further includes, in response to determining that the total cumulative distance between two sequences exceeds a predetermined threshold, identifying an anomaly.

[0004] Other embodiments relate to computer program products utilizing the methods described above.

[0005] Other embodiments relate to a computer-implemented method for identifying context. The method includes: receiving real-time data of the context over a period of time; setting the context to a first granularity level; dividing the real-time data into wavelets based on the first granularity level; and attempting to identify patterns in the wavelets based on dynamic time warping.

[0006] The above overview is not intended to describe every illustrated embodiment or every implementation of this disclosure. Attached Figure Description

[0007] The accompanying drawings included in this application are incorporated in and form a part of this specification. They illustrate embodiments of the present disclosure and, together with the description, explain the principles of the disclosure. The drawings are for illustrative purposes only and do not limit the scope of the disclosure.

[0008] Figure 1 This is a diagram illustrating an example recurrent neural network based on an implementation method.

[0009] Figure 2This is a real-time data graph of different stages of an example of a long-running database server according to an implementation method.

[0010] Figure 3 This is a real-time data graph of different stages of an example of a long-running database server according to an implementation method.

[0011] Figure 4 This is a flowchart illustrating a method for determining the context according to an implementation method.

[0012] Figure 5 This is a comparison diagram showing the wavelet patterns learned using a recurrent neural network according to an implementation method and the anomalous wavelet patterns.

[0013] Figure 6 This is an example diagram illustrating the wavelet pattern of the change from a normal state to an abnormal state according to an implementation method.

[0014] Figure 7 This is a block diagram of the processing system according to the implementation method.

[0015] Figure 8 This is a block diagram of an illustrative cloud computing environment according to various embodiments, having one or more computing nodes with local computing devices used by cloud customers to communicate.

[0016] Figure 9 It is a block diagram of a set of functional abstraction layers provided by a cloud computing environment according to the implementation method.

[0017] It should be understood that the elements in the figures are shown for simplicity and clarity. To simplify and aid in understanding the illustrated embodiments, easily understood elements that might be useful or necessary in commercially viable embodiments may not be shown. Detailed Implementation

[0018] This disclosure relates to context-aware anomaly detection methods and systems. In some embodiments, a system is provided that is configured to perform real-time anomaly detection and automatically discover these contexts (i.e., without requiring user input).

[0019] Data analytics and data science are becoming increasingly popular. With the rise of the Internet of Things (IoT) and sensing devices, and the growing prevalence of cloud computing, the quality of data collected in real-time from various components has become crucial for several reasons. One reason is to ensure that the analysis of real-time data yields useful insights and that the analysis is not misleading. Another reason is the ability to analyze the performance of systems deployed in the cloud based on real-time performance data, which is collected from cloud infrastructure. Therefore, there is a growing focus on identifying anomalies in real-time data so that erroneous data can be filtered out from the broader dataset before insights are gained. Anomaly detection can also be useful in identifying faulty components of a system, potentially leading to performance improvements.

[0020] Some embodiments utilize algorithms based on a combination of deep learning (e.g., recurrent neural networks) and signal processing (dynamic time warp) techniques to train a model for each context, and then compare real-time data with predictions from existing models to detect anomalies. Some embodiments also leverage user feedback to dynamically enrich the model, thereby further reducing the ratio of false positives (i.e., incorrect detection of anomalies) and false negatives.

[0021] In general, in time series analysis, Dynamic Time Warping (DTW) is one of the algorithms used to measure the similarity between two time series that may differ in speed or duration. DTW has been applied to time series data such as video, audio, and graphics data. Specific examples applicable to DTW include speech recognition and signature recognition. However, in a more general sense, DTW can be applied to any data that can be transformed into a linear sequence. One of the concepts in DTW is comparing arrays of different lengths, and this can be achieved by establishing one-to-many and many-to-one matches that minimize the total distance between them. Typically, DTW is a method for computing the best match between two given sequences (e.g., time series) with certain constraints and rules. It should be understood that any suitable DTW techniques known to those skilled in the art can be applied to this embodiment, and specifically to examples related to real-time data streams associated with software programs running in the cloud and real-time sensor data collected from smart cities.

[0022] In this embodiment, neural networks and other deep learning systems can be used to assist in automatic context determination and anomaly detection. Artificial neural networks (ANNs) (more generally also called neural networks) are computational systems composed of multiple simple, highly interconnected processing elements (nodes) that process information through their dynamic state responses to external inputs. ANNs are processing devices (algorithms and / or hardware) that are loosely modeled based on the neuronal structure of the mammalian cerebral cortex, but on a much smaller scale. Such systems learn tasks progressively and autonomously through examples, and they have been successfully applied to, for example, speech recognition, text processing, and computer vision. Large ANNs may have hundreds or thousands of processor units, while the mammalian brain has billions of neurons, and the magnitude of their overall interaction and developmental behavior increases accordingly.

[0023] Many types of neural networks are known, starting with feedforward neural networks such as multilayer perceptrons, deep learning neural networks (DNNs), and convolutional neural networks. A feedforward neural network is a type of artificial neural network (ANN) where connections between units do not form loops. A deep learning neural network is an artificial neural network with multiple layers of hidden units between the input and output layers. Similar to shallow ANNs, DNNs can model complex nonlinear relationships. For example, DNN architectures used for object detection and parsing generate synthetic models where objects are represented as hierarchical synthesis of image primitives. Additional layers enable the synthesis of features from lower layers, thus giving the potential to model complex data with fewer units than shallow networks that perform similarly. DNNs are often designed as feedforward networks.

[0024] In some embodiments described herein, systems, methods, and computer program products are provided that utilize big data and artificial intelligence (AI) to facilitate anomaly detection on diverse real-time big data sources, such as parking occupancy data collected over time via multiple sensors. Machine learning, a subset of AI, leverages algorithms to learn from data (e.g., big data) and create visions based on that data. AI refers to the intelligence when machines are able to make decisions based on information, maximizing the chances of success in a given subject. More specifically, AI is able to learn from datasets to solve problems and provide relevant recommendations. AI is a subset of cognitive computing, which refers to systems that learn at scale, for purposeful reasons, and interact naturally with humans. Cognitive computing is a hybrid of computer science and cognitive science. Cognitive computing utilizes self-teaching algorithms that use data, visual recognition, and natural language processing to solve problems and optimize processes.

[0025] As used in this article, "big data" refers to data characterized in part by large volumes of data (e.g., terabytes, petabytes, etc.), large amounts of data (e.g., including structured data, unstructured data, etc.), and diverse data sources. An example of structured data is transactional data in a relational database. Examples of unstructured data include images, email data, sensor data, and resource monitoring data. Some examples of big data sources include banking information, travel information, medical records, geographic information, transportation system data, passenger data, parking lot occupancy data, and resource monitoring data from various layers of cloud deployments.

[0026] As used in this article, a "smart city" typically refers to a metropolitan area that utilizes different types of big data and collects information from various citizens, electronic Internet of Things (IoT) sensors, and other devices. This information is processed and analyzed to monitor and manage different aspects of urban infrastructure, such as transportation and logistics systems, power plants, water supply networks, waste management, police and fire departments, information systems, schools, libraries, hospitals, community services, and more. The data can be used to optimize the efficiency of city operations and services, such as the efficient use of parking facilities, as discussed in this article.

[0027] As used in this article, "smart home" generally refers to a building (e.g., office, residence, etc.) that utilizes various data collected from IoT sensors and other devices. Similar to the description of smart cities above, this information is processed and analyzed to monitor and manage different aspects, such as residences. This data can be used to monitor and optimize the efficiency of home appliances, services, alarm systems, etc.

[0028] In some embodiments utilizing anomaly detection techniques, real-time data originates from one or more data sources. In these embodiments, learning the behavior of any event (i.e., context) occurs in real time. An event can be, for example, a sequence of data occurring over a period of time. In a particular example, an event or context can be associated with traffic data of certain roads in a city over a period of time, and this can exhibit patterns within that timeframe. Another example of context or event can be part of a running software application and can be used by a time-tracking processor. This processor usage can also reveal patterns. Once a model for a particular event has been trained in real time, the model can be used to predict the future behavior of those events, and the model can be used to identify whether the behavior of the event is normal or anomalous (e.g., whether one or more anomalies exist for a given dataset).

[0029] In some embodiments, the behavior (B) of the event (context) is represented by an n-dimensional signal (captured in real time), where each dimension represents time-series data collected from the generator (e.g., the time-series data may relate to different resource usages for running a process, or it may be data generated from IoT sensors in the context of a smart home or smart city). In this embodiment, the system identifies the same dimension s of two signals. i and s j Pairwise matching (m) between them.

[0030] To learn the behavior of each dimension of a signal, the first step is to break the signal down into smaller wavelets defined by its context (event). Typically, a wavelet is a mathematical function that segments data into components with varying durations, and these different components are then studied using a resolution matched to their scale. The basic idea behind wavelets is scale-based analysis, and therefore, wavelet algorithms process data at different scales or resolutions. If a signal is examined using a large “window” (i.e., coarse-grained), coarse features can be identified. Similarly, if a signal is examined using a small “window” (i.e., fine-grained), small features can be noticed. Thus, the result of wavelet analysis is seeing both coarse and small features within a given context (or event).

[0031] In this embodiment, the context is defined based on the usage scenario. Different methods for discovering the context are described below. Once the context has been identified and the signal has been divided into smaller wavelets, this embodiment utilizes one or more deep learning techniques (e.g., recurrent neural networks) to learn wavelet patterns.

[0032] Now refer to the accompanying drawings, in which the same numbers denote the same or similar elements, and first refer to... Figure 1 An example of a recurrent neural network 100 is shown. As discussed above, recurrent neural networks are techniques that allow the identification of patterns in a data sequence. After forming wavelets by truncating the real-time signal according to its context, the wavelets are fed as input into the recurrent neural network 100. For the output y of a given resource... j The generated input sequence (i.e., the n wavelets formed after context decomposition), for the j-th input (j = 1, 2, ... n), is expressed by x. j These inputs represent the values. In this example, the j-th output is calculated using the following Equation 1:

[0033] y j =Wx j +W r y j-1 Equation 1.

[0034] Weight matrix (W) rThe output of the previous step is linearly incorporated into the current output. In some architectures, there is an input layer 106, a hidden layer 104, and an output layer 102. In this example, the hidden layer 104 is recursively connected to itself. Let h j Let 104 be the hidden layer at time step j. The formula is expressed by equations 2, 3, and 4:

[0035] h 0 =0 Equation 2

[0036] h j =σ(W1x j +W r h i-1 Equation 3

[0037] y j =W2h j Equation 4.

[0038] In the above equations, σ is a suitable nonlinear / transfer function of sigmoid shape. W1 and W2 are the connection weights between input layer 106 and hidden layer 104, and between hidden layer 104 and output layer 102. r This represents the recursive weight.

[0039] exist Figure 1 The diagram illustrates the workflow of a recurrent neural network 100. Running the recurrent neural network 100 on n training wavelets generates a predictive model for a given context. Using this model, one can predict the behavior when the next context occurs, or detect anomalies in future occurrences of the context.

[0040] Anomaly detection using wavelet matching against a recurrent neural network (RNN) is now described. During the execution of a context / event, wavelets can be extracted from a real-time signal used for that specific context. Dynamic Time Warping (DTW) is then used to identify matches between the current wavelet and wavelet patterns learned from previous executions of the context. As mentioned above, DTW is a set of signal processing techniques or algorithms used to measure the similarity between two time series that may differ in velocity or duration. When matching two wavelets, both wavelets have d data points. In one example, wavelet T... i and P i It consists of the following sampled values, represented by equations 5 and 6:

[0041] T i = t1, t2, ..., t d Equation 5

[0042] P i =p1, p2, ..., p d Equation 6.

[0043] To align these two sequences using DTW, we first construct a d-by-d matrix, where the (i, j) elements of the matrix correspond to the squared distance d(t). i ,p j )=(t i ,p j ) 2 The distance to point t is... i With point p j Alignment between the two sequences. To find the best match between these two sequences, a path is retrieved by minimizing the matrix of their total cumulative distance. Specifically, the optimal path is the one that minimizes the twist cost, and this is represented by Equation 7:

[0044]

[0045] In equation 7, w k It is a matrix element (i,j) k This is also the k-th element of the deformed path W, representing a continuous set of matrix elements representing the mapping between T and P. The twisted path can be found using dynamic programming to evaluate the following recursion, represented by Equation 8.

[0046]

[0047] In Equation 8, d(i,j) is the distance found in the current cell, and γ(i,j) is the cumulative distance of d(i,j) and the minimum cumulative distance to three neighboring cells. At the end of the DTW algorithm, the minimum distance dist that will transform T into P is determined. min The shorter the distance, the more similar the signals.

[0048] In some embodiments, a predetermined threshold is set to detect a match between two wavelets. In some embodiments, this threshold may be continuously modified based on user feedback.

[0049] In some embodiments, automatic context discovery is used for software context. In these embodiments, boundaries can be placed on real-time data to extract wavelets from real-time resource usage data used by the running server software. When deployed in the cloud, the server goes through different phases. Now refer to Figure 2 This diagram illustrates examples of different stages of a long-running HBase database server 200. Figure 3 Examples of different phases of a long-running MongoDB database server 300 are described. Figure 2 and Figure 3 Both figures show CPU utilization traces (captured stack traces of different functions being executed by the workload) for the two servers sampled at 100Hz. When capturing CPU traces, on those two servers (see... Figure 2 HBase database server 200 and Figure 3 Three different workloads are running on a MongoDB database server 300 (see...). Figure 2 The elements 202, 204, 206 and Figure 3 Elements 302, 304, and 306.

[0050] Figure 2 and Figure 3 This illustrates two interesting facts. First, when the workload is running, the two servers experience two main phases: an idle phase (see...). Figure 2 Element 208 and Figure 3 Element 308) and busy phase (see element ... Figure 2 Element 210 and Figure 3 (Element 310). Furthermore, micro-phases exist within these two main phases. For example, during the idle phases of both servers, occasional spikes exist in CPU utilization, providing an indication of some work the server is performing. Depending on the server, the work in progress may differ. Secondly, for the same workload, the CPU utilization of different servers differs. For example, for the same workload 1, the CPU usage pattern of HBase database server 200 differs from that of MongoDB database server 300. As described above, this embodiment identifies phase boundaries (context) from CPU usage time-series data, enabling the use of recurrent neural networks to learn the recurrent patterns of that phase.

[0051] In this embodiment, the automatic identification of phase boundaries can be determined by utilizing program snapshots. In some embodiments, a program snapshot at a given time is defined by the following tuple represented by Equation 9:

[0052]

[0053] In Equation 9, t is the thread dump, c is the CPU utilization, and m is the program's memory utilization at a given time. Based on this definition of snapshots, the program's stage p can be defined as the following tuple represented by Equation 10:

[0054]

[0055] This embodiment uses periodically collected snapshots to identify phase changes during application runtime. In some examples, phase changes are detected when significant changes are present in two consecutively collected snapshots of the program. For change detection in program snapshots, a sliding window-based method is used. During analysis, application phases are identified online, and thread dumps are collected for a sliding window of size w. Each window of w thread dumps has a set of w three-dimensional data points. In this example, the three dimensions are: the set of functions in the thread dumps; CPU utilization; and memory consumption. To transform the set of functions in the application's thread dumps into real numbers so that it can be used to identify phase changes, the following metric, represented by Equation 11, is used:

[0056]

[0057] The superposition of metrics represents the current state (t) of the program. cur The set of functions below is relative to the previously observed set of functions (t). prev The degree of difference. In one example, stack sim =1.0 stack sim The value indicates no change, while the stack... sim A value <1.0 indicates that the contents of the stack trace have changed.

[0058] Stack at the current time quantum. sim Subsequently, a complete representation of a snapshot of the program at that quantum level is generated, where all dimensions are in the real number domain. To detect changes in the phase, this embodiment mathematically determines whether the current snapshot is an outlier within a window of w last collected snapshots. In some embodiments, a principal component analysis (PCA)-based technique is used to determine whether the current snapshot is an outlier. Outliers identify phase changes and provide boundaries where real-time signals must be defined to identify the context.

[0059] In some of the embodiments described above, automatic context discovery and anomaly detection are used in the software context. However, in other embodiments, in the context of smart city applications, automatic context discovery and anomaly detection are utilized for real-time sensor data. In one example of real-time data from a smart city, the data is vehicle occupancy collected by sensors from parking lots at different locations within the smart city. However, it should be understood that parking lot data is merely one example of smart city data, and other data sources can be used. In this example, parking data for each garage (i) includes data from (m) months and is represented by the following Equation 12:

[0060] occ i ={mon1, mon2, ..., mon m Equation 12.

[0061] Monthly parking dataset The data has a set of (d) data points, which depends on the number of days in the month. The monthly data is represented in the form of Equation 13:

[0062]

[0063] Finally, in this example, when data is collected in real time at 5-minute intervals, each collection day k There are w <= 288 data points. To discover the context of the real-time sensor data, context discovery begins with coarse-grained analysis, followed by searching for repeating patterns of wavelets with finer granularity.

[0064] Now for reference Figure 4 This illustrates an exemplary method 400 for determining patterns in real-time data. In operation 402, the context is set to the coarsest granularity (e.g., month in this particular use case), and then in operation 404, the signal is divided into wavelets according to this context. Then, in operation 406, dynamic time warping is used to see if any patterns exist in those wavelets. If a pattern exists (operation 406: yes), the context finding system stops at operation 412. If no pattern is found, then in operation 408, the system determines whether there is a finer granularity level that can be applied to divide the wavelets. If a finer granularity level is available (operation 408: yes), the process increases the granularity level at operation 410 (setting the granularity to finer), and then continues its search in the next finer granularity level (e.g., week) by returning to operation 404. At this stage, method 400 again searches for repeating patterns in all combinations of sequences of weeks (i.e., not months) for the same time range of the data. Because this search is highly parallelizable, searches can be performed in parallel (i.e., different searches at different granularities) to significantly reduce the overall processing time. For example, to discover recurring patterns in a weekly context, if the weekly index is given as w = {1, 2, 3, 4}, the signal can be divided into wavelets as follows. In the example of analyzing data from four months of valuable real-time data, the index forming the wavelets used for pattern discovery can be represented by equations 14 and 15:

[0065] {w1_m1,w1_m2,w1_m3,w1_m4},{w2_m1,w2_m2,w2_m3,w2_m4}…..Equation 14.

[0066] {w1_m1,w2_m1,w1_m2,w2_m2,w1_m3,w2_m3,w1_m4,w2_m4}…Equation 15.

[0067] In some embodiments, if n finer contexts exist, the search length for all such combinations extends up to (n-1). Therefore, in this case, the search is performed over all four months (i.e., n=4 in this case), up to {w1, w2, w3}, {w2, w3, w4}, {w1, w3, w4}. The search then continues in a similar manner to the more finer contexts (days and hours). Once the search has been completed for all patterns across all contexts (i.e., up to the finest granularity level, for example, hourly in this use case), the process ends at operation 412, and the matching values ​​are sorted. The highest-ranked matching value is then designated as the discovered repeating pattern. In some embodiments, the system can be retrained periodically to discover new patterns as new real-time data arrives.

[0068] Using contextual information on top of real-time data, this embodiment can successfully identify anomalies in both software application workload data and smart city data. As described above, although examples of software data and smart city data have been presented, this embodiment can be applied to any other suitable real-time data source. Experiments have been performed to analyze several popular software programs used in the cloud (e.g., Cassandra, MongoDB, Spark, etc.) to identify their context. These experiments have shown that context-aware anomaly detection can identify significant anomalies with 100% accuracy and less than 10% false positives.

[0069] Now for reference Figure 5 The figure illustrates an example of such wavelets learning from context while running a workload on a Cassandra database server. The predicted wavelets (i.e., the darkest black lines) show the patterns learned using a recurrent neural network, as well as anomalous runs as a result of disk failures (i.e., the lightest gray lines). Therefore, Figure 5 The visual differences between the learning mode and the abnormal operation are shown. The significant difference in DTW values ​​confirms that the visual inspection is consistent with the anomalies automatically detected by the method of this embodiment.

[0070] Detected anomalies can be automatically removed from the data, which advantageously removes their impact from insights that are automatically or manually determined within that data. In some embodiments, the system may alert the user to the anomaly after it is detected. This can serve as a supplement to or alternative to removing anomalous data. The user can then decide what to do (e.g., remove the anomalous data, determine if it was caused by a faulty component, etc.).

[0071] Now for reference Figure 6The figure illustrates an example of real-time parking data collected from a garage on a weekday, as determined by context. The gray area of ​​the figure shows anomaly wavelets over a 2.5-day period. Visual inspection confirmed the presence of anomalies, as the minimum values ​​for these two days showed an upward trend compared to historical data. By using the context-sensitive anomaly detection method of this embodiment, up to 40% (or more) improvement in prediction accuracy and up to 50% (or more) reduction in false positives can be achieved compared to existing anomaly detection methods. In some embodiments, the sensitivity of anomaly detection can be tuned to be more aggressive or more relaxed based on user feedback.

[0072] This embodiment has described the details of automatically identifying context in real-time data in two scenarios: a method for discovering context in the case of software programs running in the cloud, and a method for discovering context in the case of real-time sensor data collected from a smart city. The addition of discovered context helps improve prediction accuracy and also reduces the amount of false alarms detected (i.e., compared to existing methods that do not consider context). Furthermore, the addition of discovered context can help reduce the resource utilization of anomaly detection systems (e.g., by increasing accuracy, reducing the amount of unnecessary confirmations or corrections). It should be understood that this embodiment is not limited to the example of software running in a cloud environment or smart city data collection, and the embodiment can be applied to any suitable example of real-time data feed.

[0073] Now for reference Figure 7 An exemplary processing system 500 according to one embodiment is shown, to which this embodiment can be applied. The processing system 500 includes at least one processor (CPU) 504 operatively coupled to other components via a system bus 502. A cache 506, a read-only memory (ROM) 508, a random access memory (RAM) 510, an input / output (I / O) adapter 520, a sound adapter 530, a network adapter 540, a user interface adapter 550, and a display adapter 560 are operatively coupled to the system bus 502.

[0074] First storage device 522 and second storage device 524 are operatively coupled to system bus 502 via I / O adapter 520. Storage devices 522 and 524 can be any of disk storage devices (e.g., magnetic disk or optical disk storage devices), solid-state magnetic devices, etc. Storage devices 522 and 524 can be the same type of storage devices or different types of storage devices.

[0075] Speaker 532 is operatively coupled to system bus 502 via sound adapter 530. Transceiver 542 is operatively coupled to system bus 502 via network adapter 540. Display device 562 is operatively coupled to system bus 502 via display adapter 560.

[0076] First user input device 552, second user input device 554, and third user input device 556 are operatively coupled to system bus 502 via user interface adapter 550. User input devices 552, 554, and 556 may be any of a keyboard, mouse, keypad, image capture device, motion sensing device, microphone, device incorporating the functionality of at least two of the preceding devices, or any other suitable type of input device. User input devices 552, 554, and 556 may be of the same type or different types. User input devices 552, 554, and 556 are used to input information to and output information to system 500. In some embodiments, a neural network component 590 with context and anomaly detection modes is operatively coupled to system bus 502.

[0077] The processing system 500 may also include other elements (not shown), as readily apparent to those skilled in the art, and certain elements may be omitted. For example, various other input and / or output devices may be included in the processing system 500, depending on the specific implementation of the processing system 500, as readily understood by those skilled in the art. For example, different types of wireless and / or wired input and / or output devices may be used. Furthermore, additional processors, controllers, memories, etc., in different configurations may be utilized, as readily understood by those skilled in the art. Given the teachings of this disclosure provided herein, these and other variations of the processing system 500 will readily occur to those skilled in the art.

[0078] It should be understood that while this disclosure includes a detailed description of cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0079] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage devices, applications, virtual machines, and services), which can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0080] The features are as follows:

[0081] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0082] Extensive network access: Capabilities are available through networks and accessed via standard mechanisms that facilitate the use of heterogeneous thin client or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0083] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence because consumers typically do not have control or knowledge of the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0084] Rapid flexibility: The ability to provide capacity quickly and flexibly, automatically scaling down and up rapidly in some situations to scale up rapidly. For consumers, the available supply capacity often appears unlimited and can be purchased in any quantity at any time.

[0085] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0086] The service model is as follows:

[0087] Software as a Service (SaaS): This provides consumers with the ability to use the provider's applications running on cloud infrastructure. Applications can be accessed from different client devices via thin client interfaces such as web browsers (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0088] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created or acquired by the consumer using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of any application hosting environment.

[0089] Infrastructure as a Service (IaaS): The capabilities offered to consumers are processing, storage, networking, and other basic computing resources that enable consumers to deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0090] The deployment model is as follows:

[0091] Private cloud: A cloud infrastructure that operates solely for an organization. It can be managed by the organization or a third party and can exist on-site or off-site.

[0092] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0093] Public cloud: Makes cloud infrastructure available to the public or large industry groups and is owned by an organization that sells cloud services.

[0094] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported (e.g., cloud bursting for load balancing between clouds).

[0095] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure comprising a network of interconnected nodes.

[0096] See now Figure 8 This describes an illustrative cloud computing environment 650. As shown, the cloud computing environment 650 includes one or more cloud computing nodes 610 that can communicate with local computing devices used by cloud consumers, such as, for example, personal digital assistants (PDAs) or cellular phones 654A, desktop computers 654B, laptop computers 654C, and / or automotive computer systems 654N. The nodes 610 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 650 to provide infrastructure, platforms, and / or software as services that cloud consumers do not need to maintain on their local computing devices. It should be understood that... Figure 6 The types of computing devices 654A-N shown are intended to be illustrative only, and computing node 610 and cloud computing environment 650 can communicate with any type of computerized device via any type of network and / or network-addressable connection (e.g., using a web browser).

[0097] See now Figure 9 This demonstrates the 650 (cloud computing environment) Figure 8 This provides a set of functional abstractions. It should be understood beforehand that... Figure 9The components, layers, and functions shown are merely illustrative, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0098] The hardware and software layer 760 includes hardware and software components. Examples of hardware components include: a mainframe 761; a server 762 based on a RISC (Reduced Instruction Set Computer) architecture; a server 763; a blade server 764; a storage device 765; and a network and network components 766. In some embodiments, the software components include network application server software 767 and database software 768.

[0099] The virtualization layer 770 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 771; virtual storage 772; virtual networks 773, including virtual private networks; virtual applications and operating systems 774; and virtual clients 775.

[0100] In one example, management layer 780 may provide the following functionalities: Resource Provisioning 781 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 782 provides cost tracking as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User Portal 783 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 784 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 785 provides pre-scheduling and procurement of cloud resources, anticipating future requirements for those resources according to the SLA.

[0101] The workload layer 790 provides examples of functions that can leverage a cloud computing environment. Examples of workloads and functions that can be provided from this layer include: mapping and navigation 791; software development and lifecycle management 792; virtual classroom education delivery 793; data analysis and processing 794; transaction processing 795; and neural network anomaly detection training processing 796.

[0102] This invention can be a system, method, and / or computer program product with any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of the invention.

[0103] Computer-readable storage media can be tangible means for retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital universal disk (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or protrusions in slots having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0104] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the suitable computing / processing device.

[0105] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to personalize the electronic circuitry in order to perform aspects of this invention.

[0106] The present invention will now be described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0107] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium storing the instructions includes an article of manufacture containing instructions that implement aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0108] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, such that the instructions executed on the computer, other programmable apparatus, or other device perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0109] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than indicated in the figures. For example, two blocks shown consecutively may actually be completed as a single step, executed simultaneously, substantially simultaneously, or with partial or complete temporal overlap, or the blocks may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function.

[0110] Various embodiments have been described for illustrative purposes, and these descriptions are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or technical improvements to technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. A computer-implemented method for context-aware anomaly detection, the method comprising: Receive signals containing real-time data; The received signal is divided into a training wavelet set defined by the corresponding training context; A predictive model for the training context is generated by processing the training wavelet set through a recurrent neural network to identify patterns in the corresponding training wavelet data sequence. In response to the execution of the current context being different from the training context, the current wavelet is extracted from the signal of the current context; By aligning the sequence of the current wavelet with the sequence of wavelet patterns of the prediction model, pairwise matches between the current wavelet and the wavelet patterns of the prediction model in the same dimension are identified; and An anomaly is identified in response to the determination that the total cumulative distance between two sequences exceeds a predetermined threshold.

2. The method according to claim 1, wherein, The real-time data is received from multiple data sources, including n-dimensional signal representations captured in real time, where each dimension represents collected time-series data.

3. The method according to claim 2, wherein, The n dimensions include: The set of functions in a thread dump; CPU usage; and Memory consumption.

4. The method according to claim 1, wherein, The training context is identified by using periodically collected snapshots of phase changes during application runtime.

5. The method according to claim 4, wherein, The stage change is detected when there is a change exceeding a threshold between two consecutively collected snapshots of the program.

6. The method according to claim 4, wherein, The sliding window method is used to detect the changes in the aforementioned stages.

7. The method of claim 1, wherein identifying the pairwise match comprises: Construct a d-by-d matrix using d data points from each of the current wavelets, where each element of the matrix corresponds to the squared distance d(ti, pj) = (ti, pj). 2 This indicates the alignment between points ti and pj, and The best match between two sequences is identified by searching for the optimal path through a d-by-d matrix, where the optimal path minimizes the total cumulative distance between the two sequences.

8. The method according to claim 7, wherein, The optimal path is retrieved by minimizing the matrix representing the twist cost: Among them, w k It is also the matrix element (i,j) that is the kth element of the deformed path W. k , represents the continuous set of matrix elements that represent the mapping between T and P.

9. The method according to claim 8, wherein, Use dynamic programming to evaluate the recursion represented by the following to determine the distorted path: in, d(t i , p j ) It is the squared distance corresponding to the matrix element (i,j), and γ(i,j) is the... d(t i , p j ) The cumulative distance and the minimum cumulative distance to three adjacent units.

10. The method according to claim 1, wherein, The predetermined threshold is modifiable based on user input.

11. A computer program product for context-aware anomaly detection, the computer program product comprising: Program instructions, the program instructions including: Program instructions used to receive signals containing real-time data; Program instructions for dividing the received signal into a set of training wavelets defined by the corresponding training context; Program instructions for generating a predictive model for the training context by processing the training wavelet set through a recurrent neural network to identify patterns in the corresponding training wavelet data sequence; In response to the execution of the current context being different from the training context, the program instructions of the current wavelet are extracted from the signals of the current context; Program instructions for identifying pairwise matches between the current wavelet and the wavelet patterns of the prediction model in the same dimension by aligning the sequence of the current wavelet with the sequence of wavelet patterns of the prediction model; and A program instruction used to identify an anomaly in response to determining that the total cumulative distance between two sequences exceeds a predetermined threshold.

12. The computer program product according to claim 11, wherein, The real-time data is received from multiple data sources, including n-dimensional signal representations captured in real time, where each dimension represents collected time-series data.

13. The computer program product according to claim 12, wherein, The n dimensions include: The set of functions in a thread dump; CPU usage; and Memory consumption.

14. The computer program product according to claim 11, wherein, The training context is identified by using periodically collected snapshots to observe phase changes during application runtime.

15. The computer program product according to claim 14, wherein, The stage change is detected when there is a change exceeding a threshold between two consecutively collected snapshots of the program.

16. The computer program product according to claim 14, wherein, The sliding window method is used to detect the changes in the aforementioned stages.

17. The computer program product of claim 11, wherein identifying the pairwise match comprises: Construct a d-by-d matrix using d data points from each of the current wavelets, where each element of the matrix corresponds to the squared distance d(ti, pj) = (ti, pj). 2 This indicates the alignment between points ti and pj, and The best match between two sequences is identified by searching for the optimal path through a d-by-d matrix, where the optimal path minimizes the total cumulative distance between the two sequences.

18. The computer program product according to claim 11, wherein, The predetermined threshold is modifiable based on user input.

19. A computer-implemented method for recognizing context, the method comprising: Receive real-time contextual data over a period of time; Set the context to the first granularity level; The real-time data is divided into wavelets based on the first granularity level; as well as An attempt was made to identify patterns in the wavelet based on dynamic time warp.

20. The computer-implemented method according to claim 19, wherein, When it is determined that no pattern is identified in the wavelet: Set the context to a second granularity level that is finer than the first granularity level; The real-time data is divided into wavelets based on the second granularity level; and An attempt was made to identify the pattern in the wavelet based on the dynamic time warp.

21. A computer system, comprising: One or more processors; A computer-readable storage device coupled to the processor, the computer-readable storage device including instructions that, when executed by the processor, perform the actions of the method according to any one of claims 1-10 and 19-20.

Images