Trace representation learning

Abstract

According to the method, when a multi-branch DNN is trained to encode a sequence, multi-task learning (MTL) and self-supervised learning (SSL) technologies are used to avoid overfitting in deep neural network (DNN) training. In an embodiment, a computer trains a DNN for a first time to perform a first task. The DNN includes a first encoder in a first branch, a second encoder in a second branch, and an interpreter layer that combines data from the first branch and the second branch. The DNN is trained for a second time to perform a second task. After the first training and the second training, production coding and inference occur. A first encoder encodes the sparse feature vectors as dense feature vectors inferred therefrom. In an embodiment, a sequence of log messages is encoded as an encoded trace. An anomaly detector inferes whether the sequence is abnormal. In an embodiment, the log message is a database command.

Description

Technical Field

[0001] The present invention relates to avoiding overfitting in deep neural network (DNN) training. This paper is a multi-task learning (MTL) and self-supervised learning (SSL) technique for training multi-branch DNN to encode sequences. Background Art

[0002] Anomaly detection has attracted a lot of attention in the industry due to its important role in protecting computer systems from harmful activities, whether malicious or accidental. Databases are vulnerable to various attacks. Machine learning (ML) algorithms that analyze system logs play an important role in detecting such activities. Database logs represent a structured data sequence consisting of messages, where each message consists of attributes that describe the message.

[0003] Referred to as traces in this paper, message subsequences are particularly important for anomaly detection tasks. Existing methods that convert trace information into numerical vectors usually extract hand-crafted features directly from messages and then aggregate the features across messages into a trace representation. Aggregation is done by strictly computing statistics such as mean, mode, sum, minimum, and maximum for each feature. The main limitations of these methods are (i) requiring manually defined aggregation strategies, (ii) giving equal weight to messages carrying different information, (iii) feature space dimensionality and sparsity, (iv) not capturing semantics, and (v) losing message ordering. To address these limitations, a data-driven approach is required. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] In the figure:

[0005] Figure 1A is a block diagram depicting an example computer for avoiding overfitting in deep neural network (DNN) training based on multi-task learning (MTL) and self-supervised learning (SSL) techniques for training a multi-branch DNN to encode a sequence;

[0006] Figure 1B is a block diagram depicting an example computer for reusing an already trained encoder in a production application;

[0007] Figure 2 is a flow chart depicting a first example computer process for avoiding overfitting via MTL and SSL techniques for training a multi-branch DNN to encode a sequence;

[0008] Figure 3 is a flow chart depicting a first example computer process for avoiding overfitting via MTL and SSL techniques for training a multi-branch DNN to encode a sequence;

[0009] Figure 4is a flow chart depicting an example computer process for future-proof training of an encoder;

[0010] Figure 5 is a block diagram illustrating a computer system upon which embodiments of the present invention may be implemented;

[0011] Figure 6 is a block diagram illustrating a basic software system that may be used to control the operation of a computing system. DETAILED DESCRIPTION

[0012] In the following description, for the purpose of explanation, many specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent that the present invention can be practiced without these specific details. In other cases, well-known structures and devices are shown in block diagram form to avoid unnecessarily obscuring the present invention.

[0013] General Overview

[0014] For anomaly detection in computer system activities, the representation of sequences of related log messages can play a crucial role. The goal is to condense message sequences into feature vectors whose content and format facilitate task-specific machine learning (ML). This paper is an ML approach to automatically discover the best representation for such sequences. The approach is completely data-driven, eliminates the need for manual feature engineering, and improves scalability and performance. As an alternative to heuristic feature engineering, the learned representations are useful for a variety of tasks such as anomaly detection, clustering, similarity detection, predictive analytics, and search.

[0015] Deep learning (DL) is an example of a data-driven approach to capture data structure and learn useful feature representations from input data. The techniques in this article can extract and reuse the neural layers of DL models that provide data representation. The motivation comes from the fact that neural networks need to learn useful features of the data (including data representation) in order to solve a given task. The representations obtained in this way are contextualized to capture semantics and can facilitate different downstream tasks such as classification, regression or clustering, which perform better with better input representations.

[0016] In this paper, we apply DL for extracting useful data representations to logs and log-based anomaly detection. Existing methods are not suitable for this case due to its supervised learning nature. Supervised learning requires a large amount of labeled data. The problem addressed in this paper is when no labels are provided, which requires a different approach.

[0017] Self-supervised learning (SSL) in this paper drives representation learning. Generating data with reliable labels is expensive and requires significant manpower. Self-supervised learning in this paper is a way to train ML models to learn tasks without humans providing labeled data. In this approach, labels are automatically synthesized based on the data itself and according to the specified self-supervised learning task.

[0018] For example, if the application domain is computer vision, then images can be randomly rotated and then automatically labeled according to the rotation performed to help train the ML model to detect the degree of rotation or whether the rotation exceeds a threshold. This is a human-made task whose purpose is to help the ML model learn high-quality and reusable features from the given data. Various self-supervised tasks can be designed to provide supervisory signals for training. Once trained, the ML model reliably extracts learned representations that can be reused for other (e.g., new) ML tasks. The learned representations carry semantic and structural information that is beneficial to downstream tasks. The quality of the resulting representations can be directly related to the quality and / or diversity of the human-made self-supervised tasks.

[0019] SSL has achieved success in Natural Language Processing (NLP). However, there are big differences between log analysis and NLP. Unlike words associated with a finite-sized vocabulary, the space of possible log messages can be very large. Some experiments show a mismatch between tasks for database logs and related anomaly detection and tasks in other application domains. This paper is a self-supervised approach with an innovative customization of representation learning for log traces. The approach includes a novel self-supervised task and a customized model architecture.

[0020] In this paper, we propose multiple unique self-supervised tasks for representation learning. These tasks are carefully designed to fit the nature of the data and may or may not be inspired by downstream tasks of real applications (i.e., log-based anomaly detection). The motivation for introducing multiple tasks for model training is improved generalization, which can be achieved by pooling labels from different tasks to a greater or lesser extent. The model architecture can be adjusted in novel ways to fit the nature of the designed tasks.

[0021] This approach to self-supervised representation learning of structured data sequences that contain arbitrary attributes and can be partitioned has not been proposed in the literature. Applying this approach to database logs provides trace representations that increase the accuracy and reliability of anomaly detection applications. The increase in accuracy means fewer false positives (i.e., false alarms), which saves computer resources such as time and space for other purposes (such as more intensive automation of executing the underlying application and / or reacting to true positives).

[0022] Example artificial tasks for self-supervised representation learning of log traces include: (i) detecting whether a given trace has been corrupted (corruption task) and (ii) detecting subsequences that do not belong to a given sequence (false subtrace detection task). The goal of the tasks is to encourage the ML model to carefully check the validity of the provided input sequence during training, thereby capturing temporal data structures that can be reused for anomaly detection tasks (such as in production environments).

[0023] For both artificial training tasks, both positive and negative examples are obtained or synthesized to provide the necessary supervisory signal for training the model. For the corruption task, the negative examples (not corrupted) are the original traces themselves. The positive examples are obtained by corrupting the messages of the original traces (such as by replacing a certain percentage of the trace messages with messages randomly selected from another trace).

[0024] In an embodiment, the reconfigurable model architecture is based on a multi-branch sequential neural network. The model consists of two input branches, each of which contains a bidirectional long short-term memory (BiLSTM) network layer with a memory component that facilitates capturing dependencies and preserving ordering information. BiLSTM is an extension of a conventional long short-term memory (LSTM) network for improving model performance for sequence-related problems.

[0025] Following are the advantages of the technology in this article.

[0026] ● Dimensionality reduction: Our experiments achieve satisfactory anomaly detection performance by reducing the feature space by about 60% compared to the dimensionality of feature vectors produced using non-learned representations.

[0027] ● Reduce feature vector complexity: Methods based on non-learned representations require manual selection of (one or more) aggregations (e.g., mean, mode, minimum, etc.) for each feature, and tend to conservatively over-engineer using too many statistically aggregated features to avoid losing information without knowing the relative importance of many features and their aggregate statistics.

[0028] ● Improved generalization and robustness: Multi-task learning (MTL) provides advantages such as reduced overfitting through shared representations, improved data and learning efficiency, and improved prediction accuracy. The learned representations can be used for any kind of database behavior analysis.

[0029] ● Improved scalability / reusability: SSL automatically learns representations that express common characteristics of different applications, which requires transfer learning.

[0030] In an embodiment, a computer trains a neural network for a first time to perform a first task. The neural network includes: a first encoder in a first branch, a second encoder in a second branch, and an interpreter layer that combines data from the first branch and the second branch. The neural network is trained a second time to perform a second task. After the first training and the second training, production encoding and inference occur. The first encoder encodes the sparse feature vector into a dense feature vector from which an inference is inferred.

[0031] In an embodiment, the computer first self-supervises the first training of the encoder to encode the sequence of log messages into the encoded trace. The computer connects the encoder to the neural network after the first training. The neural network is trained a second time to detect whether the sequence of log messages is abnormal. In various embodiments, the second training is self-supervised or not self-supervised.

[0032] In an embodiment, a computer generates a neural network that accepts a complete sequence of log messages and a subsequence of log messages as input. The neural network includes an encoder that can encode the complete sequence of log messages into an encoded trace. The neural network is self-supervisedly trained to detect whether the complete sequence of log messages contains the subsequence of log messages. The encoder is trained by training the neural network, and the encoder can be deployed without the neural network.

[0033] 1.0 Sample Computer

[0034] Figure 1A 1 is a block diagram depicting an example computer 101 in an embodiment. The computer 101 avoids overfitting in deep neural network (DNN) training based on multi-task learning (MTL) and self-supervised learning (SSL) techniques for training multi-branch DNN to encode sequences. The computer 101 can be one or more of a rack server (such as a blade), a personal computer, a mainframe, a virtual computer, a smart phone, or other computing devices.

[0035] Neural network 110 is an artificial neural network (ANN), such as a DNN, hosted in the memory of computer 101 and operated by computer 101. Unlike other ANNs that are only trained once and have the same internal architecture throughout the life cycle of the ANN, neural network 110 is trained many different times. Each time neural network 110 is trained, the internal architecture of neural network 110 changes.

[0036] 1.1 Multi-Task Learning (MTL)

[0037] In this example, neural network 110 undergoes a first training and a second training, as shown in illustrative legend 120, which is not a component of computer 101. Legend 120 shows a different line style for each of the two trainings. Components of computer 101 that were present during only one respective training are drawn with the line style shown for that training in legend 120. Alternatively, components of computer 101 drawn with solid lines are present for both trainings.

[0038] Each of the two trainings requires the neural network 110 to learn a different task. As shown, the first training and the second training each require the neural network 110 to perform corresponding tasks 191-192 that are not performed as part of the production application. A production task in this context is a task that is a) part of a production application and b) that the neural network 110 is not trained to perform.

[0039] The training tasks prevent the encoder 171 (discussed later in this article) from overfitting that would otherwise occur if multiple training tasks were not used. The first training and the second training should occur in sequence, but the ordering of the training tasks does not matter. For example, the second training can occur before the first training.

[0040] This paper refers to training for multiple tasks as multi-task learning (MTL). The MTL in this paper can be different from other types of MTL in the following ways.

[0041] ●Our MTL distinguishes the training task from the production task. Other kinds of MTL may lack the training task and have the production task instead.

[0042] ● Tasks 191-192 in this paper are trained separately and sequentially. Other types of MTL can be trained for all tasks simultaneously in a single training.

[0043] The internal architecture of the neural network 110 may be different for different tasks. Other kinds of MTL may instead keep the internal architecture unchanged across the entire lifecycle of the neural network 110.

[0044] The input format (e.g., feature vector count and / or width) may be different for different tasks. Other kinds of MTL may instead keep the input format constant across the entire lifecycle of the neural network 110.

[0045] 1.2 Feature Engineering Design

[0046] In this example, the first training requires a subsequence detection task 191, during which the neural network 110 includes internal components 131, 161-162, 171-172, and 180, but does not include training layer 132. The first training simultaneously accepts two sparse feature vectors 141-142 as input. Each of the feature vectors 141-142 is a sparse encoding of a sequence of messages (e.g., some of the messages 151-156).

[0047] Each of the messages 151-156 may be a structured or semi-structured aggregation of data fields of the same or different data types. Each of the messages 151-156 may be a record (such as a database table row, a network packet, or a multi-packet protocol data unit (PDU)), a document (such as JavaScript Object Notation (JSON) or Extensible Markup Language (XML)), a command (such as a shell command or a database statement), or a log entry (such as a line of text in a console output log file).

[0048] In an embodiment, a feature vector such as feature vectors 141-142 contains a sparse encoding of a sequence of messages as a sequence (e.g., an array) of individual sparse encodings of each message in the sequence. Each message is encoded in the same format that contains a corresponding value for each of a number of features (e.g., data fields) in the message. A feature vector is the concatenation of all feature values ​​for all messages in the sequence.

[0049] All messages have corresponding values ​​for the same feature. For example, if there are ten features and sequence feature vector 141 consists of an array of all feature values ​​for messages 151-154, then the corresponding value for the first feature of messages 151-152 may be encoded into the first and eleventh elements of the array.

[0050] Each feature has a corresponding data type. For example, two features can have the same or different corresponding data types. The data types can variously be: a) a number that is either an integer or a real number, b) a primitive type that can be easily encoded as a number (such as a Boolean or a text character), c) a sequence of discrete values ​​with a semantic order (such as a month) that can be easily encoded as a corresponding number preserving the original order, or d) an enumeration of categories of different categorical values ​​that are semantically unordered.

[0051] A categorical feature can be hash-encoded as a single number in the feature vector, or n-hot or 1-hot encoded as multiple numbers. For example, 1-hot encoding generates one for categorical values ​​that actually appear in the feature vector, and also generates zero for each possible categorical value that does not appear in the feature vector. Encoding a feature as multiple numbers is an example of sparse coding.

[0052] A feature may be a corresponding data field, attribute, or column that may appear in each of the messages 151-156. In an embodiment, the feature vectors are homogeneous, and the corresponding values ​​of all features are encoded as the same data type, such as the same primitive data type (such as an integer) or a unit-normalized real number (such as a floating point). In an embodiment, the feature vectors are heterogeneous, and each feature may have its own corresponding encoded data type.

[0053] In an embodiment, ordinal features such as calendar months may be encoded as zero or one based unsigned integers such as 1-12, instead of text strings such as January. In an embodiment, categorical features such as features of unordered and mutually exclusive choices such as tea flavors may be so-called one-hot encoded as a set of mutually exclusive Boolean features. For example, a choice of three flavors may be encoded as three Boolean features where the corresponding feature in the feature vector is true and the other two Boolean features are false. In an embodiment, Boolean features are encoded as numbers.

[0054] 1.3 Domain-specific features

[0055] In an embodiment, sparse feature vectors 141-142 are sparse encodings of one or more database statements. For example, some features may be: a timestamp of the database statement, an identifier of the database session, a network address of the database client, an identifier of the operating system (OS) of the database client, and at least a portion of the database statement. The following are example features that may or may not appear in messages 151-156, each of which represents a corresponding database statement in real time or stored in a log of a database server.

[0056] ●Open Database Connectivity for establishing network connections and database sessions

[0057] (ODBC) or Java ODBC (JDBC) Uniform Resource Locator

[0058] All or part of a URL. Example connection string parts include standard URL parts (for example, protocol, server host, and network port number) and the path or

[0059] ODBC / JDBC-specific parts of the query parameters, such as the name of the database

[0060] name, architecture, or user account.

[0061] ●An indication of how old the database session was when the database statement was issued by the database session.

[0062] ●One-hot encoding of dialects of Structured Query Processing Language (SQL) for database statements such as Data Definition Language (DDL), Data Manipulation Language (DML), Data Query Language (DQL), and Transaction Control Language (TCL).

[0063] ● Database statement verbs (such as SELECT, INSERT, DELETE,

[0064] UPDATE, CREATE, DROP, GRANT, BEGIN and

[0065] COMMIT).

[0066] • n-hot encoding of the state or context of a database statement (such as: outside a transaction, inside a demarcated transaction, autocommitted transactions, and prepared statements).

[0067] ●Return codes from database statements, such as error codes.

[0068] ●The number of rows in the result set returned by the database statement.

[0069] ● n-hot encodings of database tables referenced by database statements.

[0070] ● Details of the WHERE clause, such as the count of joins specified, the LIMIT clause on the results, the sort direction, and the DISTINCT keyword.

[0071] Subsequence detection task 191 detects whether the sequence of messages encoded in sequence feature vector 141 contains a subsequence of the message encoded in subsequence feature vector 142. For example, messages 155-156 may or may not be identical to corresponding messages 152-153 or corresponding messages 153-154. Neural network 110 may be slightly inefficient or less accurate in performing subsequence detection task 191.

[0072] However, the efficiency and accuracy of the training tasks 191-192 are not the main purpose of the first training and the second training. The main purpose of the training tasks 191-192 is to use the MTL training encoder 171 to transcode the sparsely coded sequence feature vector 141 into a densely coded dense feature vector 145 without overfitting the encoder 171. Overfitting will make the encoder 171 reliable for familiar instances of the sequence feature vector 141, but unreliable for unfamiliar instances of the sequence feature vector 141.

[0073] Preventing Overfitting The future-proof encoder 171 handles message sequences that were not present and not considered when training the neural network 110. Future-proofing tolerates data drift and / or concept drift, such as when production data gradually deviates from the training data. Future-proofing promotes retraining the encoder 171 with less frequency with updated data (such as for data drift). Less frequent retraining saves resources of the computer 101, such as time and space.

[0074] The first training and the second training adopt self-supervised learning (SSL). Using SSL, the computer 101 automatically derives the labeled training corpus from the unlabeled training corpus. In the first training, the messages can be sorted into sequences of three general sizes (i.e., counts of messages), which are respectively referred to as original sequences, uniform sequences, and subsequences in this article.

[0075] The unlabeled corpus contains raw sequences, which are the longest sequences and whose message counts can vary due to application semantics (e.g., database sessions) and due to logistics (e.g., log file rotation). In various embodiments, the log file contains interleaved message sequences for corresponding clients or sessions, and the computer 101 may or may not unpack the log file into completely separate raw sequences, each of which contains messages from only one session or client. In an embodiment, the entire log file is used as one overall raw sequence, no matter how many sessions or clients contribute messages to the log file.

[0076] Computer 101 divides each original sequence into multiple uniform sequences, and the uniform sequence contains a fixed count of messages, that is, how many messages are encoded into one instance of sequence feature vector 141. In various embodiments, message 152 may or may not appear in multiple uniform sequences. For example, the window can have the same message count as sequence feature vector 141, and the window can be incrementally slid over the original sequence to generate multiple uniform sequences.

[0077] As the window slides, (one or more) older messages slide out of the window, and (one or more) newer messages slide into the window. All messages that exist in the window at the same time are taken together as a uniform sequence. If the increment of sliding (i.e., stride) is less than the number of messages contained in the window, then the same message can be in multiple, partially overlapping uniform sequences. Otherwise, uniform sequences are continuous but non-overlapping, and a message can only be in one uniform sequence.

[0078] For SSL, some or all of the uniform sequence is encoded into corresponding instances of the sequence feature vector 141. For each instance of the sequence feature vector 141 used in the first training, a corresponding instance of the subsequence feature vector 142 is generated so that both instances can be accepted by the corresponding branches 161-162 at the same time. Some of the instances of the subsequence feature vector 142 actually encode subsequences of the corresponding uniform sequence, and those instances are marked as true. Other instances of the subsequence feature vector 142 instead encode unrelated (i.e., non-corresponding) subsequences of the uniform sequence or encode randomly generated or randomly tampered subsequences, and those instances are marked as false.

[0079] The subsequence detection task 191 learns to infer the label of a pair of feature vectors 141-142. SSL provides the correct label required for supervised training of the neural network 110 based on whether the training layer 131 inferred the correct or incorrect label. When the first training starts, the neural network 110 is more or less inaccurate. When the first training ends, the neural network 110 is more or less accurate.

[0080] 1.4 Encoder

[0081] Encoder 171 provides dimensionality reduction, which: a) avoids analyzing and integrating irrelevant features of the message sequence, and b) generates a more concise (i.e., dense) representation of the message sequence, in which only meaningful input features are retained. In other words, encoder 171 extracts semantic details of complex, noisy, and ambiguous inputs. Thus, encoder 171 converts sparse feature vector 141, which is a sparse representation of the message sequence, into dense feature vector 145, which is a dense encoding.

[0082] Generally during the first training and the second training, the encoder 171 learns which features should be weakened and how to encode the retained semantic features. In an embodiment, the encoder 171 is an autoencoder. The architecture for the autoencoder will be discussed later in this article. In an embodiment, the encoder 171 is a recurrent neural network (RNN) for analyzing sequences. In an embodiment, the encoder 171 is composed of bidirectional long short-term memory (BiLSTM) neurons to prevent the gradient vanishing problem in back propagation.

[0083] 1.5 Multi-branch Neural Network

[0084] During the first training, the neural network 110 is multi-branched. In this article, the multi-branch neural network contains multiple input branches, such as training branches 161-162 that operate simultaneously during the first training. Neurons and neural layers in one branch are not directly connected to other branches, and branches cannot communicate with each other.

[0085] Each branch accepts a separate corresponding feature vector simultaneously. Although the feature vectors 141-142 of branches 161-162 may have different corresponding widths and formats, in an embodiment, the encoding format of all messages 151-156 is the same in both feature vectors 141-142. For example, if messages 151 and 156 are exactly the same, then their encodings are exactly the same in feature vectors 141-142.

[0086] The encoder 172 in the training branch 162 can be somewhat similar to the encoder 171 in the branch 161. The encoders 171-172 transcode the sparse feature vectors 141-142 containing message sequences of different corresponding lengths into dense encodings of different corresponding widths. During the first training period, the two dense encodings performed by the encoders 171-172 are simultaneously accepted by the interpreter layer 180.

[0087] The interpreter layer 180 learns to integrate the two dense encodings into a combined representation that the training layer 131 accepts and preserves the message sequence semantics required by the training layer 131 to perform the subsequence detection task 191. In this article, each of the layers 131-132 and 180 and branches 161-162 can contain a corresponding sequence of one or more neural layers.

[0088] The neurons of each neural layer in the illustrated layer or branch are (e.g., completely) connected to the neurons of the corresponding next neural layer in the illustrated layer or branch. Similarly, the neurons of the last neural layer in the illustrated layer or branch (e.g., branch 161) are (e.g., completely) connected to the neurons of the first neural layer in the corresponding next illustrated layer (e.g., interpreter layer 180).

[0089] Reinforcement learning in the neural network 110 can be based on back propagation, as discussed later in this article. For example, back propagation can be transmitted in reverse order, which requires training layer 131, interpreter layer 180, and concurrent branches 161-162 in the following order. Therefore, the first training trains all internal components 131, 161-162, 171-172, and 180.

[0090] 1.6 Changes between training tasks

[0091] The second training requires the destruction detection task 192. During the second training, the neural network 110 includes internal components 132, 161, and 171, but does not include internal components 131, 162, 172, and 180. The second training uses instances of sequence feature vectors 141, but does not use subsequence feature vectors 142. During the second training, the neural network 110 is not multi-branched in this example.

[0092] In the first training, the neural network 110 learns accurate connection weights, which are the coefficients discussed later in this article. These connection weights are retained for the second training to refine the connection weights. Therefore, the encoder 171 is refined during the second training to prevent overfitting.

[0093] In various embodiments, the second training may or may not reuse some or all of the instances of uniform sequences or sequence feature vectors 141. Some instances of sequence feature vectors 141 encode true uniform sequences and are labeled as true. Other instances of sequence feature vectors 141 encode randomly generated or randomly tampered sequences and are labeled as fake. In the second training and based on SSL, training layer 132 learns to infer labels of instances of sequence feature vectors 141 in a supervised manner somewhat similar to the first training.

[0094] The following are example negative aspects (ie, exclusions) of various example embodiments of neural network 110.

[0095] ●Neural network 110 does not include a convolutional neural network (CNN), a recurrent neural network (RNN), or a natural language processing (NLP) converter.

[0096] • Neural network 110 does not accept graphical data such as photographs or other two-dimensional or three-dimensional images.

[0097] • Neural network 110 does not use attention, which is a known alternative.

[0098] 1.7 Anomaly Detection

[0099] Figure 1B 1 is a block diagram depicting an example computer 102 in an embodiment. Computer 102 reuses trained encoder 171 in a production application that does not include neural network 110. Computer 102 can be the same or a different computer than computer 101 in the same or a different environment. Figure 1A discuss Figure 1B .

[0100] Computer 102 hosts in memory anomaly detector 195 and operates anomaly detector 195, which, when receiving dense feature vector 145 as input, draws inference 197 indicating whether sequence feature vector 141 is anomalous. Figure 1A-1B Data structures 141, 145, and 151-154 are shown in both figures, and although they have the same format and structure in both figures, their content values ​​may or may not be different in the two figures. For example, Figure 1B A specific instance of messages 151-154 in may or may not be present in Figure 1Aexists during the training of the neural network 110. Figure 1A-1B In the embodiment, the encoder 171 converts the sparse feature vector 141 which is a sparse representation of the message sequence into a dense feature vector 145 which is a dense encoding.

[0101] In various embodiments, the anomaly detector 195 is or is not a machine learning (ML) model that has been trained or not trained. In various embodiments, the anomaly detector 195 is a ML model and the training is or is not supervised, semi-supervised, or unsupervised. In an embodiment, supervised training uses manual labeling.

[0102] In an embodiment, unsupervised training instead uses a reconstruction loss as an error for back propagation, in which case anomaly detector 195 learns to detect whether instances of sequence feature vectors 141 are familiar or unfamiliar. In various embodiments, back propagation includes or does not include encoder 171. That is, encoder 171 may or may not be immutable during training of anomaly detector 195.

[0103] In embodiments, anomaly detector 195 is a neural network other than neural network 110. In various embodiments, anomaly detector 195 is not connected to, does not include, and is not included in one, some (e.g., at least two or three), or all of: neural network 110 and internal components 131-132, 162, 172, and 180.

[0104] In an embodiment, anomaly detector 195 infers inference 197 indicating whether an instance of sequence feature vector 141 is anomalous or non-anomalous. In an embodiment, anomaly detector 195 is a binary classifier, and inference 197 identifies a class that directly indicates anomaly or non-anomalous. In an embodiment, anomaly detector 195 is instead a numerical regression, and inference 197 contains a numerical anomaly score that measures how unfamiliar, abnormal, or suspicious an instance of sequence feature vector 141 is.

[0105] For example, the anomaly score can be: a) a probability that an instance of the sequence feature vector 141 is abnormal and / or b) based on the reconstruction loss. The numerical anomaly score can be compared to an anomaly threshold to detect anomalies. In a production environment, the computer 102 can react by handling an abnormal instance of the sequence feature vector 141 in a special way, such as alerting it to human attention, logging it for later in-depth analysis, rejecting it and not processing it further, further processing it with enhanced security (such as fewer permissions), and / or adding it to the training corpus for later retraining of the encoder 171 in the neural network 110.

[0106] 2.0 First Example Training Process

[0107] Figure 2 is a flow chart depicting an example process that an embodiment of computer 101-computer 102 may perform to avoid overfitting by using multi-task learning (MTL) and self-supervised learning (SSL) techniques for training encoder 171 to encode a sequence. Figure 1A-1B discuss Figure 2 .

[0108] Training steps 202 and 204 are similar to Figure 1A Step 206 corresponds to Figure 1B Computer 101 and neural network 110 cooperate to perform training steps 202 and 204. Computer 102 and anomaly detector 195 cooperate to perform step 206. Computer 101-computer 102 can be the same computer or independent computers.

[0109] Steps 202, 204, and 206 all use encoder 171 to transcode sparse feature vector 141 into dense feature vector 145. Steps 202 and 204 train neural network 110 and encoder 171. Training steps 202 and 204 do not use anomaly detector 195. Step 206 does not train encoder 171, which may be immutable. Step 206 does not use neural network 110.

[0110] Steps 202 and 204 correspond to the first training and the second training, respectively. Embodiments with more training (i.e., non-production) tasks may have additional steps for additional training. The ordering of the training steps (e.g., steps 202 and 204) for neural network 110 depends on the embodiment.

[0111] Non-production training tasks are used for MTL and to prevent overfitting of encoder 171. In this document, a training environment is any place where neural network 110 undergoes non-production or production training, and a production environment is any place where neural network 110 will be deployed for production use. The production environment and the training environment can be the same or different environments, and either environment can be a lab environment or an actual production environment.

[0112] Which training of the neural network 110 is or is not multi-branched depends on the embodiment. Steps 202 and 204 are example steps in an example MTL training process.

[0113] Based on the subsequence detection task 191 as the first training task for non-production training to prevent overfitting of the encoder 171, step 202 performs the first training when the neural network 110 does not include the training layer 132 and includes the following internal components:

[0114] The encoder 171 in the branch 161 acts as the first encoder in the first branch,

[0115] • training encoder 172 in branch 162 as a second encoder in the second branch,

[0116] An interpreter layer 180 that combines data from the first branch and the second branch (i.e., from the first encoder and the second encoder), and

[0117] • A training layer 131 , which is dedicated to learning the first training task.

[0118] Based on the destruction detection task 192 as the second training task to prevent overfitting of the encoder 171, step 204 performs the second training when the neural network 110 does not include the internal components 131, 162, 172 and 180 and includes the following internal components:

[0119] The encoder 171 in branch 161, and

[0120] • A training layer 132, which is dedicated to learning the second training task.

[0121] In step 206, anomaly detector 195 infers inference 197 indicating whether sequence feature vector 141 is abnormal. In step 206, encoder 171 transcodes sparse feature vector 141 into dense feature vector 145, and anomaly detector 145 then accepts dense feature vector 145 as input for inference. Inference 197 is directly based on dense feature vector 145 and indirectly based on sparse feature vector 141.

[0122] Although detection tasks 191-192 and anomaly detection are actually binary classification tasks, other embodiments may have non-production training tasks and production tasks of other functions (such as clustering or regression), including a mixture of training tasks of different functions. The above example steps and example processing demonstrate the following additional aspects of the neural network 110 with MTL:

[0123] ● Internal components such as training layer 131 may only exist in one training,

[0124] ● Internal components such as encoder 171 may be present in all training of neural network 110 and anomaly detector 195, and

[0125] ● Which internal component directly accepts the output from an internal component (such as encoder 171) can vary from training to training. For example, in the first training, the output of encoder 171 is directly accepted by interpreter layer 180, while in the second training, it is instead directly accepted by training layer 132.

[0126] 3.0 Second Example Training Process

[0127] Figure 3is a flow chart depicting an example training process that an embodiment of computer 101-computer 102 may perform using a self-supervised learning (SSL) technique for training encoder 171 to encode a sequence. Figure 1A-1B discuss Figure 3 . Figure 2-Figure 3 The steps and / or processes may be complementary, interleaved and / or combined.

[0128] Step 302 and Figure 1A Steps 304 and 306 correspond to Figure 1B In an embodiment, computer 101 and encoder 171 cooperate to perform step 302. Computer 102 and anomaly detector 195 cooperate to perform steps 304 and 306. Computer 101-computer 102 can be the same computer or separate computers.

[0129] Steps 302, 304, and 306 all involve encoder 171 in various ways. Steps 302 and 306 use encoder 171 to transcode sparse feature vector 141 into dense feature vector 145. Step 302 trains encoder 171 and does not use anomaly detector 195.

[0130] In this example, anomaly detector 195 is an untrained neural network that is not neural network 110. Steps 304 and 306 do not use neural network 110. In an embodiment, Figure 3 The processing does not use the neural network 110.

[0131] To prevent overfitting of encoder 171, step 302 first self-supervised trains encoder 171 to encode a sequence of log messages into an encoded trace. Here, the encoded trace is contained in dense feature vector 145, which is the dense output of encoder 171 discussed earlier in this document, and the trace is a sequence of messages. Here, the sequence is a uniform sequence of messages in sequence feature vector 141, which is a sparse sequence discussed earlier in this document. Here, this first training may or may not be Figure 1A and Figure 2 First or second training session.

[0132] Here, the self-supervised training of the encoder 171 requires back-propagation, which in various embodiments may or may not occur during the self-supervised training of the neural network 110, as discussed previously herein. Various embodiments of the encoder 171 may train the encoder 171 self-supervised as per step 302, or alternatively train the encoder 171 unsupervised, such as with a reconstruction error, as discussed previously herein.

[0133] In various embodiments, step 302: a) trains encoder 171 in deep neural network 110, b) trains encoder 171 in a different DNN, or c) trains encoder 171 without a DNN. For example, encoder 171 may be trained with a DNN (or without a DNN) in a future-proof manner, which facilitates steps 304 and 306 to occur later with anomaly detector 195 for new software applications that were not envisioned when step 302 occurred.

[0134] Step 304 connects the encoder 171 to the anomaly detector 195 or embeds the encoder 171 within the anomaly detector 195 .

[0135] In the absence of self-supervision, step 306 trains the anomaly detector 195 a second time to detect whether the sequence of log messages in the sequence feature vector 141 is abnormal. Step 306 can be unsupervised or supervised, such as based on manual labeling. The unsupervised training of the anomaly detector 195 can be based on the reconstruction error discussed earlier in this article.

[0136] 4.0 The third example training process

[0137] Figure 4 is a flow chart depicting an example process that an embodiment of computer 101-computer 102 may perform for future protection training of encoder 171. Figure 1A-1B discuss Figure 4 . Figure 2-Figure 4 The steps and / or processes may be complementary, interleaved and / or combined.

[0138] Future proofing may require: a) training encoder 171 in neural network 110 as a training DNN; and then b) deploying encoder 171 in a different DNN or without a DNN.

[0139] Steps 402 and 404 are Figure 1A Step 406 corresponds to Figure 1B In an embodiment, computer 101 and neural network 110 cooperate to perform steps 402 and 404. Computer 102 performs step 406. Computers 101-102 may be the same computer or independent computers.

[0140] Steps 402, 404, and 406 all involve encoder 171 in various ways. Step 404 uses encoder 171 to transcode sparse feature vector 141 into dense feature vector 145. Step 404 trains neural network 110 and encoder 171 and does not use anomaly detector 195.

[0141] Step 402 generates a neural network 110 that: a) accepts a complete sequence of log messages, such as a uniform sequence of messages in a sequence feature vector 141 discussed earlier herein, b) simultaneously accepts subsequences of log messages discussed earlier herein, and c) contains an encoder 171 that learns to encode the sparse sequence feature vector 141 into a dense feature vector 145 containing a densely encoded trace. Here, a trace is a sequence of messages.

[0142] Step 404 self-supervisedly trains the encoder 171 and the neural network 110 to detect whether the complete sequence of log messages contains a subsequence of log messages according to the subsequence detection task 191 discussed earlier in this document.

[0143] Step 406 deploys encoder 171 without deploying neural network 110 for use as a training neural network. In various embodiments, step 406 deploys encoder 171: a) into a different DNN, either for production use or to train a different DNN, or b) without deploying a DNN. If step 406 trains a different DNN, encoder 171 may or may not be immutable during step 406, as discussed earlier herein. Encoder 171 may be future-proofed so that step 406 may eventually occur with a different DNN for new software applications that were not envisioned when training steps 402 and 404 occurred.

[0144] 5.0 Database Overview

[0145] Embodiments of the present invention are used in the context of a database management system (DBMS). Accordingly, a description of an example DBMS is provided.

[0146] Generally speaking, a server (such as a database server) is a combination of integrated software components and allocations of computing resources (such as memory, nodes, and processes on the nodes for executing the integrated software components), where the combination of software and computing resources is dedicated to providing a specific type of functionality on behalf of the server's clients. A database server governs and facilitates access to a specific database, processing client requests to access the database.

[0147] A user interacts with the database server of a DBMS by submitting commands to the database server, which cause the database server to perform operations on the data stored in the database. A user may be one or more applications running on a client computer that interacts with the database server. Multiple users may also be collectively referred to as users in this article.

[0148] A database consists of data stored on a persistent storage mechanism (such as a collection of hard disks) and a database dictionary. A database is defined by its own separate database dictionary. The database dictionary includes metadata that defines the database objects contained in the database. In fact, the database dictionary defines most of the contents of the database. Database objects include tables, table columns, and tablespaces. A tablespace is a collection of one or more files used to store data for various types of database objects (such as tables). If the data for a database object is stored in a tablespace, then the database dictionary maps the database object to one or more tablespaces that hold the data for the database object.

[0149] The DBMS consults the database dictionary to determine how to execute database commands submitted to the DBMS. Database commands can access database objects defined by the dictionary.

[0150] Database commands can be in the form of database statements. In order for a database server to process a database statement, the database statement must conform to a database language supported by the database server. A non-limiting example of a database language supported by many database servers is SQL, including proprietary forms of SQL supported by database servers such as Oracle (such as Oracle Database 11g). SQL data definition language ("DDL") instructions are issued to a database server to create or configure database objects, such as tables, views, or complex types. Data manipulation language ("DML") instructions are issued to a DBMS to manage data stored in a database structure. For example, SELECT, INSERT, UPDATE, and DELETE are examples of common DML instructions in some SQL implementations. SQL / XML is a common extension of SQL used when manipulating XML data in an object-relational database.

[0151] A multi-node database management system consists of interconnected nodes that share access to the same database. Typically, the nodes are interconnected via a network and share access to shared storage to varying degrees, such as sharing access to a collection of disk drives and the data blocks stored thereon. The nodes in a multi-node database system may be in the form of a group of computers, such as workstations and / or personal computers, interconnected via a network. Alternatively, the nodes may be nodes of a grid consisting of nodes in the form of server blades interconnected to other server blades on a rack.

[0152] Each node in a multi-node database system hosts a database server. A server, such as a database server, is a combination of integrated software components and an allocation of computing resources, such as memory, nodes, and processes on nodes for executing the integrated software components on processors, that are dedicated to performing specific functions on behalf of one or more clients.

[0153] Resources from multiple nodes in a multi-node database system can be allocated to software running a particular database server. Each combination of allocation of software and resources from a node is a server referred to herein as a "server instance" or "instance." A database server may include multiple database instances, some or all of which run on separate computers (including separate server blades).

[0154] 5.1 Query Processing

[0155] A query is an expression, command, or set of commands that, when executed, causes a server to perform one or more operations on a collection of data. A query may specify (one or more) source data objects, such as (one or more) tables, (one or more) columns, (one or more) views, or (one or more) snapshots, from which (one or more) result sets are to be determined. For example, (one or more) source data objects may appear in the FROM clause of a Structured Query Language ("SQL") query. SQL is a well-known example language for querying database objects. As used herein, the term "query" is used to refer to any form of representation of a query, including queries in the form of database statements and any data structure used for internal query representation. The term "table" refers to any source object that is referenced or defined by a query and represents a collection of rows, such as a database table, a view, or an inline query block (such as an inline view or a subquery).

[0156] The query may perform operations on data from the source data object(s) row by row as the object(s) are loaded, or on the entire source data object(s) after the object(s) have been loaded. The result set generated by some operation(s) may be made available to other operations(s), and in this manner, the result set may be filtered out or narrowed down based on certain criteria, and / or joined or combined with other result set(s) and / or other source data object(s).

[0157] A subquery is a portion or component of a query that is distinct from and can be evaluated separately from (i.e., as a separate query) the other portion(s) or component(s) of the query. The other portions or components of the query may form an outer query, which may or may not include other subqueries. A subquery nested within an outer query may be evaluated separately one or more times when computing results for the outer query.

[0158] Generally speaking, a query parser receives a query statement and generates an internal query representation of the query statement. Typically, the internal query representation is a collection of interrelated data structures that represent various components and structures of the query statement.

[0159] The internal query representation may be in the form of a graph of nodes, with each interrelated data structure corresponding to a node and a component of the query statement being represented. The internal representation is typically generated in memory for evaluation, manipulation, and transformation.

[0160] Hardware Overview

[0161] According to one embodiment, the techniques described herein are implemented by one or more special-purpose computing devices. Special-purpose computing devices may be hardwired to perform these techniques, or may include digital electronic devices (such as one or more application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are permanently programmed to perform these techniques), or may include one or more general-purpose hardware processors that are programmed to perform these techniques according to program instructions in firmware, memory, other storage devices, or combinations. Such special-purpose computing devices may also combine customized hard-wired logic, ASICs, or FPGAs with custom programming to implement these techniques. Special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices, or any other devices that combine hard-wiring and / or program logic to implement these techniques.

[0162] For example, Figure 5 is a block diagram illustrating a computer system 500 upon which embodiments of the present invention may be implemented. Computer system 500 includes a bus 502 or other communication mechanism for communicating information, and a hardware processor 504 coupled to bus 502 for processing information. Hardware processor 504 may be, for example, a general purpose microprocessor.

[0163] The computer system 500 also includes a main memory 506, such as a random access memory (RAM) or other dynamic storage device, coupled to the bus 502 for storing information and instructions to be executed by the processor 504. The main memory 506 may also be used to store temporary variables or other intermediate information during the execution of instructions executed by the processor 504. When stored in a non-transitory storage medium accessible to the processor 504, these instructions cause the computer system 500 to become a special-purpose machine customized to perform the operations specified in the instructions.

[0164] Computer system 500 also includes a read only memory (ROM) 508 or other static storage device coupled to bus 502 for storing static information and instructions for processor 504. A storage device 510, such as a magnetic disk, optical disk, or solid state drive, is provided and coupled to bus 502 for storing information and instructions.

[0165] The computer system 500 may be coupled to a display 512, such as a cathode ray tube (CRT), via the bus 502 for displaying information to a computer user. An input device 514, including alphanumeric and other keys, is coupled to the bus 502 for communicating information and command selections to the processor 504. Another type of user input device is a cursor control 516, such as a mouse, trackball, or cursor direction keys, for communicating direction information and command selections to the processor 504 and for controlling cursor movement on the display 512. Such input devices typically have two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), which facilitates the device to specify a position in a plane.

[0166] Computer system 500 may implement the techniques described herein using custom hardwired logic, one or more ASICs or FPGAs, firmware, and / or program logic that is combined with a computer system to make or program computer system 500 into a special purpose machine. According to one embodiment, computer system 500 performs the described techniques in response to processor 504 executing one or more sequences of one or more instructions contained in main memory 506. These instructions may be read into main memory 506 from another storage medium, such as storage device 510. Execution of the sequences of instructions contained in main memory 506 causes processor 504 to perform the process steps described herein. In alternative embodiments, hardwired circuitry may be used in place of or in combination with software instructions.

[0167] The term "storage medium" as used herein refers to any non-transitory medium that stores data and / or instructions that cause a machine to operate in a particular manner. Such storage media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical disks, magnetic disks, or solid state drives, such as storage device 510. Volatile media include dynamic memory, such as main memory 506. Common forms of storage media include, for example, floppy disks, flexible disks, hard disks, solid state drives, magnetic tapes or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with a pattern of holes, RAM, PROMs and EPROMs, FLASH-EPROMs, NVRAMs, any other memory chips, or cassette tapes.

[0168] Storage media are distinct from but can be used in conjunction with transmission media. Transmission media participate in the transfer of information between storage media. For example, transmission media include coaxial cables, copper wire, and optical fiber, including the wires that comprise bus 502. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0169] Various forms of media may be involved in transmitting one or more sequences of one or more instructions to the processor 504 for execution. For example, the instructions may initially be carried on a disk or solid-state drive of a remote computer. The remote computer may load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to the computer system 500 may receive the data on the telephone line and use an infrared transmitter to convert the data into an infrared signal. An infrared detector may receive the data carried in the infrared signal and appropriate circuitry may place the data on the bus 502. The bus 502 transfers the data to the main memory 506 from which the processor 504 retrieves and executes the instructions. The instructions received by the main memory 506 may optionally be stored on the storage device 510 before or after execution by the processor 504.

[0170] Computer system 500 also includes a communication interface 518 coupled to bus 502. Communication interface 518 provides bidirectional data communication coupled to network link 520, wherein network link 520 is connected to local network 522. For example, communication interface 518 can be an integrated services digital network (ISDN) card, a cable modem, a satellite modem, or a modem that provides a data communication connection with a corresponding type of telephone line. As another example, communication interface 518 can be a local area network (LAN) card to provide a data communication connection with a compatible LAN. A wireless link can also be implemented. In any such implementation, communication interface 518 sends and receives electrical signals, electromagnetic signals, or optical signals that carry digital data streams representing various types of information.

[0171] The network link 520 typically provides data communication to other data devices through one or more networks. For example, the network link 520 can provide a connection to a host computer 524 or to data equipment operated by an Internet Service Provider (ISP) 526 through a local network 522. The ISP 526 in turn provides data communication services through a global packet data communication network, now commonly referred to as the "Internet" 528. Both the local network 522 and the Internet 528 use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link 520 and through the communication interface 518 (which carry the digital data to and from the computer system 500) are example forms of transmission media.

[0172] Computer system 500 can send messages and receive data, including program code, through the network(s), network link 520, and communication interface 518. In the Internet example, server 530 can send the requested code for an application program through Internet 528, ISP 526, local network 522, and communication interface 518.

[0173] The received code may be executed by processor 504 as it is received, and / or stored in storage device 510 or other non-volatile storage for later execution.

[0174] Software Overview

[0175] Figure 6 6 is a block diagram of a basic software system 600 that may be used to control the operation of computing system 500. Software system 600 and its components, including their connections, relationships, and functions, are merely exemplary and are not meant to limit implementation of the example embodiment(s). Other software systems suitable for implementing the example embodiment(s) may have different components, including components with different connections, relationships, and functions.

[0176] Software system 600 is provided for directing the operation of computing system 500. Software system 600, which may be stored on system memory (RAM) 506 and fixed storage (eg, hard disk or flash memory) 510, includes a kernel or operating system (OS) 610.

[0177] OS 610 manages low-level aspects of computer operation, including managing the execution of processes, memory allocation, file input and output (I / O), and device I / O. One or more applications, represented as 602A, 602B, 602C ... 602N, may be "loaded" (e.g., transferred from fixed storage 510 into memory 506) for execution by system 600. Applications or other software intended for use on computer system 500 may also be stored as a downloadable set of computer-executable instructions, for example, for downloading and installation from an Internet location (e.g., a Web server, app store, or other online service).

[0178] The software system 600 includes a graphical user interface (GUI) 615 for receiving user commands and data in a graphical (e.g., "click" or "touch gesture") manner. In turn, these inputs can be operated by the system 600 according to instructions from the operating system 610 and / or (one or more) applications 602. The GUI 615 is also used to display the results of operations from the OS 610 and (one or more) applications 602, and the user can provide additional input or terminate the session (e.g., log out).

[0179] The OS 610 may execute directly on the bare hardware 620 (e.g., the processor(s) 504) of the computer system 500. Alternatively, a hypervisor or virtual machine monitor (VMM) 630 may be inserted between the bare hardware 620 and the OS 610. In this configuration, the VMM 630 acts as a software "buffer" or virtualization layer between the OS 610 and the bare hardware 620 of the computer system 500.

[0180] VMM 630 instantiates and runs one or more virtual machine instances ("clients"). Each client includes a "guest" operating system (such as OS 610), and one or more applications (such as (one or more) applications 602) designed to execute on the client operating system. VMM 630 presents a virtual operating platform to the client operating system and manages the execution of the client operating system.

[0181] In some instances, VMM 630 can allow a guest operating system to run as if it were running directly on bare hardware 620 of computer system 500. In these instances, the same version of a guest operating system that is configured to execute directly on bare hardware 620 can also execute on VMM 630 without modification or reconfiguration. In other words, VMM 630 can provide full hardware and CPU virtualization to guest operating systems in some cases.

[0182] In other instances, the guest operating system may be specifically designed or configured to execute on VMM 630 to improve efficiency. In these instances, the guest operating system is "aware" that it is executing on a virtual machine monitor. In other words, VMM 630 may provide paravirtualization to the guest operating system in some cases.

[0183] A computer system process includes an allocation of hardware processor time, as well as an allocation of memory (physical and / or virtual), an allocation of memory for storing instructions executed by the hardware processor, for storing data generated by the execution of instructions by the hardware processor, and / or for storing hardware processor state (e.g., contents of registers) between allocations of hardware processor time when the computer system process is not running. A computer system process runs under the control of an operating system and may run under the control of other programs executing on the computer system.

[0184] cloud computing

[0185] The term "cloud computing" is used generally herein to describe a computing model that enables on-demand access to a shared pool of computing resources, such as computer networks, servers, software applications, and services, and allows resources to be rapidly provisioned and released with minimal management effort or service provider interaction.

[0186] A cloud computing environment (sometimes called a cloud environment or just a cloud) can be implemented in a variety of different ways to best suit different requirements. For example, in a public cloud environment, the underlying computing infrastructure is owned by an organization that makes its cloud services available to other organizations or the public. In contrast, a private cloud environment is generally intended for use by or within a single organization. A community cloud is intended to be shared by several organizations within a community; while a hybrid cloud includes two or more types of clouds (e.g., private, community, or public) bound together by data and application portability.

[0187] In general, the cloud computing model enables some of those responsibilities that might previously have been provided by an organization's own information technology department to instead be delivered as a service layer within a cloud environment for use by consumers (either internally or externally to the organization, depending on the public / private nature of the cloud). Depending on the specific implementation, the precise definition of the components or features provided by or within each cloud service layer may vary, but common examples include: Software as a Service (SaaS), in which consumers use software applications running on a cloud infrastructure, while the SaaS provider manages or controls the underlying cloud infrastructure and applications. Platform as a Service (PaaS), in which consumers can use software programming languages ​​and development tools supported by the supplier of the PaaS to develop, deploy, and otherwise control their own applications, while the PaaS provider manages or controls other aspects of the cloud environment (i.e., everything under the runtime execution environment). Infrastructure as a Service (IaaS), in which consumers can deploy and run arbitrary software applications, and / or provide processes, storage, networks, and other basic computing resources, while the IaaS provider manages or controls the underlying physical cloud infrastructure (i.e., everything below the operating system layer). Database as a Service (DBaaS), where the consumer uses a database server or database management system running on a cloud infrastructure, while the DbaaS provider manages or controls the underlying cloud infrastructure and applications.

[0188] The above basic computer hardware and software and cloud computing environment are given to illustrate the basic underlying computer components that can be used to implement (one or more) example embodiments. However, (one or more) example embodiments are not necessarily limited to any particular computing environment or computing device configuration. Instead, according to the present disclosure, (one or more) example embodiments can be implemented in any type of system architecture or processing environment that a person skilled in the art will understand in view of the present disclosure as being able to support the features and functions of (one or more) example embodiments given herein.

[0189] Machine Learning Models

[0190] A machine learning model is trained using a specific machine learning algorithm. Once trained, the input is applied to the machine learning model to make a prediction, which may also be referred to as a predicate output or output in this article. The attributes of the input may be referred to as features, and the values ​​of the features may be referred to as feature values ​​in this article.

[0191] A machine learning model includes a model data representation or model artifact. The model artifact includes parameter values, which may be referred to herein as theta values, and are applied to the input by the machine learning algorithm to generate a predicted output. Training a machine learning model requires determining theta values ​​of the model artifact. The structure and organization of theta values ​​depends on the machine learning algorithm.

[0192] In supervised training, training data is used by a supervised training algorithm to train a machine learning model. The training data includes inputs and "known" outputs. In an embodiment, the supervised training algorithm is an iterative process. In each iteration, the machine learning algorithm applies the model artifacts and inputs to generate a predicted output. The error or variance between the predicted output and the known output is calculated using an objective function. In practice, the output of the objective function indicates the accuracy of the machine learning model based on the specific state of the model artifacts in the iteration. By applying an optimization algorithm based on the objective function, the theta value of the model artifact can be adjusted. An example of an optimization algorithm is gradient descent. Iterations can be repeated until the desired accuracy is achieved or some other criterion is met.

[0193] In software embodiments, when a machine learning model is referred to as receiving inputs, executing and / or generating outputs or predicates, a computer system process executing a machine learning algorithm applies a model artifact to the inputs to generate a predicted output. A computer system process executes a machine learning algorithm by executing software configured to cause the algorithm to execute. When a machine learning model is referred to as performing an action, a computer system process executes a machine learning algorithm by executing software configured to cause the action to execute.

[0194] Inference requires a computer to apply a machine learning model to inputs such as feature vectors to generate inferences by processing the inputs and content of the machine learning model in an integrated manner. Inference is data-driven based on the data contained in the machine learning model (such as learned coefficients). In this article, this is referred to as inference through a machine learning model, and in fact, the inference is the computer executing the machine learning algorithm that processes the machine learning model.

[0195] Classes of problems that machine learning (ML) excels at include clustering, classification, regression, anomaly detection, prediction, and dimensionality reduction (i.e., simplification). Examples of machine learning algorithms include decision trees, support vector machines (SVMs), Bayesian networks, random algorithms such as genetic algorithms (GAs), and connectionist topologies such as artificial neural networks (ANNs). Implementations of machine learning can rely on matrices, symbolic models, and hierarchical and / or associative data structures. Parameterized (i.e., configurable) implementations of the best machine learning algorithms can be found in open source libraries such as Google's TensorFlow for Python and C++ or Georgia Tech's MLPack for C++. Shogun is an open source C++ ML library with adapters for several programming languages, including C#, Ruby, Lua, Java, Matlab, R, and Python.

[0196] Artificial Neural Networks

[0197] An artificial neural network (ANN) is a machine learning model that models at a high level a system of neurons interconnected by directed edges. An overview of neural networks is described in the context of a hierarchical feedforward neural network. Other types of neural networks share the characteristics of the neural network described below.

[0198] In a layered feedforward network such as a multilayer perceptron (MLP), each layer comprises a set of neurons. A layered neural network comprises an input layer, an output layer, and one or more intermediate layers known as hidden layers.

[0199] The neurons in the input layer and the output layer are referred to as input neurons and output neurons, respectively. Neurons in the hidden layer or the output layer may be referred to as activation neurons in this article. Activation neurons are associated with activation functions. The input layer does not contain any activation neurons.

[0200] From each neuron in the input layer and hidden layer, there is one or more directed edges to the activated neuron in the subsequent hidden layer or output layer. Each edge is associated with a weight. The edge from a neuron to an activated neuron represents the input from the neuron to the activated neuron, as adjusted by the weight.

[0201] For a given input to a neural network, each neuron in the neural network has an activation value. For an input neuron, the activation value is simply the input value for that input. For an activation neuron, the activation value is the output of the corresponding activation function that activated the neuron.

[0202] Each edge from a particular neuron to an activated neuron represents that the activation value of the particular neuron is the input to the activated neuron, i.e., the input to the activation function of the activated neuron, as adjusted by the weight of the edge. Thus, an activated neuron in a subsequent layer represents that the activation value of the particular neuron is the input to the activation function of the activated neuron, as adjusted by the weight of the edge. An activated neuron may have multiple edges pointing to the activated neuron, each edge representing that the activation value from the source origin neuron (as adjusted by the weight of the edge) is the input to the activation function of the activated neuron.

[0203] Each activated neuron is associated with a bias. To generate an activation value for an activated neuron, the neuron's activation function is applied to the weighted activation value and the bias.

[0204] Illustrative Data Structures for Neural Networks

[0205] Artifacts of a neural network may include matrices of weights and biases. Training a neural network may iteratively adjust the matrices of weights and biases.

[0206] For layered feedforward networks and other types of neural networks, the artifacts may include one or more matrices of edges W. Matrix W represents the edges from layer L-1 to layer L. If the number of neurons in layers L-1 and L is N[L-1] and N[L] respectively, then the dimensions of matrix W are N[L-1] columns and N[L] rows.

[0207] The bias for a particular layer L may also be stored in a matrix B having N[L] rows and one column.

[0208] The matrices W and B may be stored in RAM memory as vectors or arrays, or as a comma-separated set of values ​​in memory. When the artifact is stored persistently in a persistent storage device, the matrices W and B may be stored as comma-separated values ​​in a compressed and / or serialized form or other suitable persistent form.

[0209] The specific input applied to the neural network includes the value of each input neuron. The specific input can be stored as a vector. The training data includes multiple inputs, each input is called a sample in the sample set. Each sample includes the value of each input neuron. The sample can be stored as a vector of input values, and the multiple samples can be stored as a matrix, where each row in the matrix is ​​a sample.

[0210] When input is applied to a neural network, activation values ​​are generated for the hidden and output layers. For each layer, the activation values ​​can be stored in a column of a matrix A that has a row for each neuron in the layer. In a vectorized approach for training, the activation values ​​can be stored in a matrix that has a column for each sample in the training data.

[0211] Training a neural network requires storing and processing additional matrices. The optimization algorithm generates matrices of derivative values ​​used to adjust the weights W and bias B matrices. Generating derivative values ​​can use and require matrices that store intermediate values ​​generated when calculating the activation values ​​of each layer.

[0212] The number of neurons and / or edges determines the size of the matrices required to implement a neural network. The fewer the number of neurons and edges in a neural network, the smaller the matrices and the memory required to store them. In addition, a smaller number of neurons and edges reduces the amount of computation required to apply or train a neural network. Fewer neurons means fewer activation values ​​that need to be calculated and / or fewer derivatives that need to be calculated during training.

[0213] The properties of the matrix used to implement the neural network correspond to neurons and edges. A cell in the matrix W represents a specific edge from the L-1 layer to a neuron in the L layer. An activated neuron represents the activation function of that layer, including the activation function. The activated neurons in the L layer correspond to the rows of the matrix W for the weights of the edge between the L layer and the L-1 layer and the columns of the matrix W for the weights of the edge between the L layer and the L+1 layer. During the execution of the neural network, the neurons also correspond to one or more activation values ​​stored in the matrix A for that layer and generated by the activation function.

[0214] ANN is suitable for vectorization of data parallelism, which can utilize vector hardware, such as single instruction multiple data (SIMD), such as utilizing a graphics processing unit (GPU). Matrix partitioning can achieve horizontal scaling, for example, utilizing symmetric multiprocessing (SMP), such as utilizing a multi-core central processing unit (CPU) and / or multiple coprocessors (such as GPU). Feedforward calculations in ANN can occur with only one step in each neural layer. The activation values ​​in one layer are calculated based on the weighted propagation of the activation values ​​of the previous layer, so that the values ​​are calculated in turn for each subsequent layer, such as sequentially calculating the values ​​for each subsequent layer, such as utilizing the corresponding iterations of a for loop. Layering imposes the ordering of non-parallelizable calculations. Therefore, the network depth (i.e., the number of layers) can cause computational delays. Deep learning requires giving multilayer perceptrons (MLPs) multiple layers. Each layer implements data abstraction, while complex (i.e., multidimensional with several inputs) abstractions require multiple layers to implement cascade processing. Implementations of ANNs based on reusable matrices and matrix operations for feed-forward processing are readily available and parallelizable in neural network libraries such as Google's TensorFlow for Python and C++, OpenNN for C++, and Fast Artificial Neural Networks (FANN) from the University of Copenhagen. These libraries also provide model training algorithms such as backpropagation.

[0215] Back Propagation

[0216] The output of an ANN can be more or less correct. For example, an ANN that recognizes letters may mistake an I for an L because the letters have similar features. The correct output may have a specific value(s), while the actual output may have a slightly different value. The arithmetic or geometric difference between the correct output and the actual output may be measured as an error according to a loss function, such that zero represents error-free (i.e., perfectly accurate) behavior. For any edge in any layer, the difference between the correct output and the actual output is the delta value.

[0217] Backpropagation requires distributing the error backward through the layers of the ANN to all connected edges within the ANN in varying amounts. The propagation of the error results in adjustments to the edge weights, which depend on the gradient of the error on each edge. The gradient of an edge is calculated by multiplying the error delta of the edge by the activation value of the upstream neuron. When the gradient is negative, the greater the error contribution of the edge to the network, the more the edge weight should be reduced, which is negative reinforcement. When the gradient is positive, positive reinforcement requires increasing the weight of the edge whose activation will reduce the error. Edge weights are adjusted based on a percentage of the edge's gradient. The steeper the gradient, the greater the adjustment. Not all edge weights are adjusted by the same amount. As model training continues with additional input samples, the error of the ANN should decrease. Training can stop when the error stabilizes (i.e., stops decreasing) or disappears below a threshold (i.e., approaches zero). Christopher M. Bishop teaches example mathematical formulas and techniques for feed-forward multilayer perceptrons (MLPs), including matrix operations and backpropagation, in the related reference "EXACT CALCULATION OF THE HESSIAN MATRIX FOR THE MULTI-LAYER PERCEPTRON".

[0218] Model training can be supervised, or unsupervised. For supervised training, the expected (i.e., correct) output is already known for each example in the training set. The training set is configured by pre-assigning classification labels to each example (e.g., by a human expert). For example, a training set for optical character recognition may have blurred photos of individual letters, and an expert may pre-label each photo according to which letter is shown. Error calculation and back-propagation occur as explained above.

[0219] Autoencoder

[0220] Because the desired output needs to be discovered during training, more unsupervised model training is involved. Unsupervised training can be easier to adopt because no human experts are required to pre-label training examples. Therefore, unsupervised training saves manpower. The natural way to implement unsupervised training is to use an autoencoder, which is a type of ANN. The autoencoder acts as an encoder / decoder (codec) with two sets of layers. The first set of layers encodes the input example into a condensed code that needs to be learned during model training. The second set of layers decodes the condensed code to regenerate the original input example. The two sets of layers are trained together as a combined ANN. The error is defined as the difference between the original input and the input regenerated after decoding. After sufficient training, the decoder outputs the original input more or less exactly.

[0221] For each input example, the autoencoder relies on a condensed code as an intermediate format. The intermediate condensed code does not exist initially, but emerges only through model training, which may be counterintuitive. Unsupervised training can implement a vocabulary of intermediate encodings based on features and distinctions of unexpected correlations. For example, which examples and which labels are used during supervised training can depend on the human expert's understanding of the problem space, which is somewhat unscientific (e.g., anecdotal) or incomplete. Unsupervised training, on the other hand, discovers a suitable intermediate vocabulary more or less entirely based on statistical trends that reliably converge to optimality with enough training due to internal feedback generated by regenerating decodings. Techniques for unsupervised training of autoencoders for anomaly detection based on reconstruction error are taught in the following non-patent literature (NPL) by Jinwon An et al.: "VARIATIONAL AUTOENCODER BASED ANOMALY DETECTION USING RECONSTRUCTION PROBABILITY", Special Lecture on IE. 2015 Dec 27;2(1):1-18.

[0222] Principal component analysis

[0223] Principal Component Analysis (PCA) provides dimensionality reduction by leveraging and organizing mathematical correlation techniques such as normalization, covariance, eigenvectors, and eigenvalues. PCA combines aspects of feature selection by eliminating redundant features. PCA can be used for prediction. PCA can be used in conjunction with other ML algorithms.

[0224] Random Forest

[0225] A random forest or random decision forest is a family of learning methods that construct a collection of randomly generated nodes and decision trees during a training phase. The different decision trees of the forest are constructed such that each is randomly restricted to only a specific subset of the feature dimensions of the dataset, such as by feature bootstrapping aggregation (bagging). Thus, as the decision trees grow, they gain accuracy without being forced to overfit the training data, as would happen if the decision trees were forced to learn all feature dimensions of the dataset. The predictions can be calculated based on the average (or other integral, such as softmax) of the predictions from the different decision trees.

[0226] Random forest hyperparameters can include: number-of-trees-in-the-forest (the number of trees in the forest), maximum-number-of-features-considered-for-splitting-a-node (the maximum number of features considered for splitting a node), number-of-levels-in-each-decision-tree (the number of levels in each decision tree), minimum-number-of-data-points-on-a-leaf-node (the minimum number of data points on a leaf node), method-for-sampling-data-points (the method for sampling data points), and so on.

[0227] In the foregoing specification, embodiments of the present invention have been described with reference to numerous specific details, which may vary from implementation to implementation. Accordingly, the specification and drawings are to be regarded as illustrative rather than restrictive. The sole and exclusive indicator of the scope of the invention, and what the applicants intend as the scope of the invention, is the literal and equivalent range of the set of claims issuing from this application in the specific form in which such claims are issued, including any subsequent corrections.

Claims

1. A computer-implemented method comprising: The neural network is first trained to perform the first task, where the neural network comprises: The first encoder in the first branch, a second encoder in the second branch, and an interpreter layer that combines data from the first branch and the second branch; Train the neural network a second time to perform the second task; After the first and second training, execute: The sparse feature vector is encoded into a dense feature vector by a first encoder, and Infer inferences from dense feature vectors; The execution after the first training and the second training does not use at least one selected from the following: a neural network, an interpreter layer, a second branch, and a second encoder.

2. The method of claim 1, wherein the neural network does not include at least one selected from the group consisting of: The interpretation layer during the second training, The second branch during the second training period, Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNNs), and Natural Language Processing (NLP) Transformers.

3. The method of claim 1, wherein: The neural network includes a first task layer during a first training period to perform a first task; The neural network includes a second task layer during the second training period to perform the second task; The neural network contains only one of the first task layer and the second task layer at the same time.

4. The method of claim 1, wherein: A specific task detects whether a sequence of messages matches a specific condition selected from the following: The sequence of messages is disrupted, and The sequence of messages is abnormal; The specific task is selected from the group consisting of a second task and inference.

5. The method of claim 1, further comprising the first branch accepting feature vectors of the same width during the first training and the second training. The method of claim 1 , wherein the self-supervised task is a task selected from the group consisting of a first task and a second task.

7. The method of claim 6, wherein: The method also includes a third training of the machine learning model that does not include the neural network; The third training is not self-supervised; Inference is performed by machine learning models.

8. A computer-implemented method comprising: The self-supervised first trains an encoder to encode sequences of log messages into encoded traces; After the first training, the encoder is connected to the neural network; The neural network is trained a second time to detect whether a sequence of log messages is anomalous, where the second training is not self-supervised.

9. The method of claim 8, wherein the sequence of log messages is a sequence of database commands.

10. A computer-implemented method comprising: generating a neural network that accepts as input a complete sequence of log messages and a subsequence of log messages, wherein the neural network comprises an encoder capable of encoding the complete sequence of log messages into an encoded trace; Self-supervised training of a neural network to detect whether a complete sequence of log messages contains a subsequence of log messages, wherein training the neural network includes training an encoder; After training the encoder, deploy the encoder without deploying the neural network.

11. One or more computer-readable non-transitory media storing instructions, which, when executed by one or more processors, cause the steps of any one of claims 1 to 10 to be performed.

Images