Fully unsupervised pipeline for clustering anomalies detected in computerized systems

Abstract

A computer-implemented method of clustering anomalies detected in a computerized system. The proposed method utilizes an unsupervised cognitive model that is performed based on an input data set to obtain a cluster of anomalies. The method accesses an input data set corresponding to the detected exception of the computerized system. These anomalies span respective time windows. Each input data set includes a set of time series of key performance metrics. The key performance metrics of each input data set are extended over a corresponding time window. That is, each anomaly corresponds to a respective time window. The model comprises a first stage comprising an encoder designed to learn a fixed size representation of an input data set and a second stage being a clustering stage. The model is executed based on the accessed input dataset, a fixed size representation of the input dataset learned in the first stage, and a clustering of the learned representation in the second stage.

Description

Background Art

[0001] The present invention generally relates to the field of computer-implemented methods and computer program products for clustering anomalies detected in a computerized system. In particular, the present invention relates to a method that relies on a fully unsupervised pipeline that learns a fixed-size representation of an input data set corresponding to a time series set of key performance indicators, and clusters the learned representation to obtain clusters of anomalies.

[0002] Time series clustering is important in situations where classification labels are few or infrequently available and the ability to detect patterns is critical. Recently, deep learning models have shown remarkable results in supervised tasks by using representation learning. However, ensuring that such representations are clustering-friendly and effectively capture the temporal and multidimensional dynamics of variable-length time series remains a challenge. Summary of the invention

[0003] According to a first aspect, the present invention is implemented as a computer-implemented method for clustering anomalies detected in a computerized system. The proposed method utilizes an unsupervised cognitive model, which is executed based on an input data set to obtain a clustering of anomalies. The input data sets are accessed by the method; they correspond to the anomalies of the computerized system detected. These anomalies span corresponding time windows. Each corresponding input data set includes a set of time series of key performance indicators (KPIs). The KPI of each input data set is extended over a corresponding time window. That is, each anomaly corresponds to a corresponding time window. Before executing the unsupervised cognitive model, it is loaded (e.g., in the main memory of a computer executing the method). The model includes a first stage and a second stage. The first stage includes an encoder designed to learn a fixed-size representation of the input data set, and the second stage is a clustering stage. The model is executed based on the accessed input data set so that the first stage learns a fixed-size representation of the input data set, and the second stage clusters the learned representation so that the clustering of anomalies is finally obtained by the method.

[0004] In an embodiment, the unsupervised cognitive model is performed using a combined loss function that combines a first loss function and a second loss function. The first loss function and the second loss function are designed to optimize representation and clustering, respectively.

[0005] Preferably, the first loss function is designed as a triple loss function. The latter ensures that the representation learned for the reference part of each data set of the input data set (corresponding to the corresponding anomaly) is on average closer to the representation learned for the different part of each data set than the representation learned for the other parts of other data sets in the input data set. Each of the reference part, the different part and the other part corresponds to a corresponding time period. Moreover, each part aggregates several KPIs, that is, all KPIs of each anomaly (although extending over a specific time period). The representation learned for each reference part can be used as a representation for the corresponding anomaly. As a result, the representation learned for the reference anomaly is on average closer to the representation learned for other similar anomalies than the representation learned for the dissimilar anomaly.

[0006] According to another aspect, the present invention is implemented as a computer program for clustering anomalies detected in a computerized system. The computer program product includes a computer-readable storage medium having program instructions. The program instructions can be executed by a processing device to cause the processing device to perform a method such as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] These and other objects, features and advantages of the present invention will become apparent from the following detailed description of illustrative embodiments thereof read in conjunction with the accompanying drawings. These descriptions are intended to clearly assist those skilled in the art in understanding the present invention in conjunction with the specific embodiments. In the accompanying drawings:

[0008] Figure 1 A computer interacting with a computerized system of interest is schematically shown in order to cluster anomalies detected for the computerized system of interest, as in an embodiment.

[0009] Figure 2 is a graph representing various KPIs evolving over a given time period. The KPI values ​​form a corresponding (univariate) time series. Assume that seven anomalies have been detected based on this KPI over the time period. The anomalies are depicted as corresponding time windows as used in the embodiment.

[0010] Figure 3 is a high-level diagram of an unsupervised two-stage model for learning representations of anomalies and clustering such anomalies, as in an embodiment.

[0011] Figure 4 yes Figure 3 A more detailed diagram of the model of , showing the preferred structure of the first stage of the model (dedicated to representation learning).

[0012] Figure 5 is a 2D graph of an example of clustering of anomalies obtained in an embodiment.

[0013] Figure 6 is a flow chart showing high-level steps of a method of clustering anomalies according to an embodiment.

[0014] Figure 7 is a flowchart illustrating the lower-level steps of the first and second stages of an unsupervised model that relies on a combined loss function as in an embodiment.

[0015] Figure 8 A general purpose computerized system is schematically shown, which is suitable for implementing one or more method steps involved in embodiments of the present invention.

[0016] The accompanying drawings show simplified representations of devices or parts thereof as involved in the embodiments. Unless otherwise specified, similar or functionally similar elements in the drawings are assigned the same reference numerals.

[0017] A computerized method and a computer program product embodying the present invention will now be described by way of non-limiting examples. DETAILED DESCRIPTION

[0018] Reference now Figure 1 -3 and 6 describe in detail a first aspect of the present invention, which relates to a computer-implemented method for clustering anomalies detected in a computerized system. Note that the present method and its variants are collectively referred to as "the present method".

[0019] Formally, anomalies are defined as rare events that are so different from other observations that they cast doubt on the mechanism that produced them. Anomalies may arise, for example, due to malicious or inappropriate actions, fraud, or system failures. Anomalies may particularly be data service anomalies, such as those occurring during a cyber attack (e.g., to a business environment), unauthorized access, network intrusion, inappropriate data disclosure, data leakage, system failure, or data and / or resource deletion. Anomaly detection is important in a variety of fields, such as network security, fraud detection, and health care. Early detection is often extremely important because failure to act on the cause of the anomaly may result in significant harm.

[0020] The method can be used, for example, on a given computer 1 (see Figure 1 ) is executed at a computer that interacts with a target computerized system 2 (i.e., a system of interest) and can detect and analyze anomalies of the target computerized system. The computerized system 2 may, for example, involve a networked computerized device, such as Figure 1 As assumed in the above, cloud computing is implemented. In variations, system 2 may be a data center, a supercomputer, a general-purpose computer, memory and storage hardware, a load / store engine, or any other type of computerized device or system. Note that the computer implementing the present method (i.e., Figure 1The computer 1) in may form part of a computerized system 2 of interest.

[0021] The method relies on a KPI of the computerized system 2, which is usually obtained from a computing device and / or storage device constituting the system 2, such a KPI can be continuously monitored, for example, by monitoring S10 the computerized system 2, the monitored signal or data can, for example, include or contain a monotonic sequence or tabular data, in order to be able to detect potential anomalies in the system 2. The KPI values ​​of the KPI form a respective time series. Each KPI usually corresponds to a corresponding quantity, so that the corresponding time series is usually univariate. However, the KPI can also correspond to a multivariate time series in principle.

[0022] For simplicity, it is assumed below that each KPI corresponds to a univariate time series. A time series is a series of values ​​(KPI values) of a given quantity obtained at continuous time, such as Figure 4 For N single variable KPIs (denoted as KPI1 to KPI N ). For example, these KPI values ​​can be continuously collected and aggregated from a data stream of raw KPI values. Some preprocessing is usually performed on the aggregated values. Note that the entire KPI set can be viewed as a multivariate time series as a whole.

[0023] Therefore, the present method can detect anomalies in the computerized system 2 based on the monitored KPIs ( Figure 6 In step S10 in ( ), any suitable anomaly detection algorithm may be used. The algorithm may, for example, reflect a model, which may be an analytical model. Various examples of anomaly detection algorithms and pipelines are known. Figure 2 Assume that seven anomalies are detected at different time points within a large time period. The detected anomalies are depicted as corresponding time windows, which may span different time periods and may further overlap.

[0024] When an anomaly is detected, the method can automatically determine (or cause to be determined) a corresponding time window extending over a given time period. The time window is usually determined as the endpoint of a specific time interval. Self-organizing heuristics can be used to determine such a time window. If necessary, the determined window can be verified by an expert (system or person). That is, the method can automatically determine the troubleshooting time window and prompt the expert to verify them. In a variant, the anomaly is detected by another entity (e.g., another computer) and is provided as input to a computer implementing the abnormal clustering method described below.

[0025] In all the cases mentioned above, the clustering method will access (step S20, Figure 6) An input data set corresponding to detected anomalies of the computerized system 2, the detected anomalies spanning corresponding time windows (which may be different and overlapping). That is, each input data set comprises a collection of time series of KPIs and corresponds to detected anomalies. All KPIs of the same input data set extend over the same time window. Each input data set can be considered as a multivariate time series.

[0026] The method relies on an unsupervised cognitive model 15, which is loaded into, for example, the main memory of the computer 1 at step S32, for subsequent execution of the model. Note that, in practice, the model 15 may be loaded before accessing the input data set of interest at S20. Figure 3 and 4 As schematically shown in , the unsupervised cognitive model 15 includes a first stage 151 and a second stage 152. The first stage 151 includes an encoder (i.e., a feature extractor) that is designed to learn a representation of an input data set. Importantly, the encoder is designed herein to learn a fixed-size representation of an input data set. The second stage 152 is a clustering stage. Suitable examples of encoder and clustering stages are described in detail later.

[0027] The unsupervised cognitive model 15 is then executed based on the input data set accessed in step S20. The two-stage structure of the model 15 enables the first stage 151 to learn ( Figure 6 The representation of the input data set is obtained in step S33. According to the design of the encoder, the learned representation is a fixed-size representation, which makes the subsequent clustering process easy. That is, the second stage 152 clusters the learned representation (step S35) so that abnormal clusters are finally obtained (step S40).

[0028] The proposed method advantageously relies on a fully unsupervised pipeline: the model 15 learns a fixed-size representation of the input dataset, from which features of the input dataset are extracted, e.g. as a 1D or 2D array (i.e., a vector or a matrix). Preferably, the encoder is designed to extract features as a 1D array to facilitate the subsequent clustering process performed by the second stage 152. In practice, tens to hundreds of input datasets (corresponding to respective anomalies) may be fed to the model 15, where such input datasets may have time windows of different lengths, and such time windows may overlap, e.g. Figure 2 as assumed in (compare the 3rd, 4th, 5th and 6th anomalies).

[0029] That is, the encoder (first stage) can allow useful representations (e.g., vectors) with fixed-size representations to be learned, regardless of the time window characteristics of the input data set, which is very convenient in practice. In other words, the encoder makes it possible to compare prior data sets that are difficult to compare. Specifically, as discussed in the embodiments below, a fast encoder-only CNN with dilated causal convolutions can be used to process long time series that may overlap and have variable lengths. "Encoder-only" means that the decoder is not involved, as opposed to the encoder-decoder architecture. Finally, due to the encoder, a fixed-size representation of the input data set can be extracted from the input data set, so that the representation can then be simply clustered. Due to the learned fixed-size representations (although the durations are different and the time windows overlap), in principle any clustering method can be envisioned. However, a preferred clustering method is disclosed herein, which can be advantageously used in this context.

[0030] Model 15 is designed to generate meaningful clusters of anomalies, which generally correspond to different types of anomalies. That is, clustering can be performed to identify groups of anomalies that reflect different kinds of abnormal behavior, which makes subsequent investigation by support engineers easier. The obtained clusters facilitate anomaly analysis because time series belonging to the same cluster can be assumed to reflect the same anomaly type.

[0031] Advantageously, the two-stage architecture of model 15 lends itself well to iterative and alternating training based on a combined loss function, as discussed below with reference to a preferred embodiment. In particular, anomaly representations can be optimized along with clustering objectives, using a novel triple loss function and an iterative, alternating training scheme that is computationally tractable for real systems. Thus, the present method can be used to at least partially automate the deeply involved analysis of abnormal events occurring in complex systems such as cloud infrastructures. However, in addition to cloud infrastructures, the present method can be applied to data centers, supercomputers, general-purpose computers, memory and storage hardware, load / store engines, or any other type of computerized device or system, as previously described.

[0032] All of this is now described in detail with reference to a specific embodiment of the present invention. First, the unsupervised cognitive model 15 may preferably be performed using a combined loss function. The combined loss function may combine a first loss function and a second loss function. The first loss function may be designed (and used) to optimize the learned representation, while the second loss function may be intended to optimize the finely obtained clustering. That is, the second loss function incorporates the clustering task.

[0033] In practice, the combined loss can be written as a mathematical function with two loss functions as independent variables. The combined loss function is usually the sum of two losses, one of which aims to learn a suitable representation and the other minimizes the clustering loss. The first loss function can be advantageously decomposed into two terms to allow time-based negative sampling, as in the preferred embodiment discussed below. Therefore, the composite loss function can actually include three functions.

[0034] Using a combined loss function as described above makes it possible to optimize representation learning (i.e., learning a fixed-length representation) and clustering simultaneously. Thus, the combined loss function can be aimed at learning a suitable representation for anomalies and obtaining clustering of good quality. This can preferably be achieved through an iterative and alternating scheme as discussed below. Using an iterative process makes training computationally more tractable.

[0035] In a preferred embodiment, the second stage may consist of one or more layers above the encoder layer, thus forming a single network 15, which may however alternatively be optimized for representation learning and clustering. Figure 3 and 4 Shown in.

[0036] In more detail, the first loss function is preferably designed as a triple loss function, which ensures that the representation learned for the reference part (or chunk) of each input data set (corresponding to the corresponding anomaly) is on average closer to the representation learned for different parts of the same input data set, rather than closer to the representation learned for other parts of other (i.e., different) input data sets. Each of the above parts can correspond to a corresponding time period. Moreover, each part can aggregate several KPIs, i.e., all KPIs of each anomaly (although extending over a specific time period). Therefore, the representation learned for each reference part can be used as the representation of the corresponding anomaly. As a result, the representation learned for the reference anomaly is on average closer to the representation learned for other similar anomalies than the representation learned for dissimilar anomalies. This triple loss function involves time-based negative sampling. As a result, the learned representation is closer to those anomalies that ultimately belong to the same cluster, and farther away from other representations.

[0037] Using the triple loss algorithm as described above has been shown to work surprisingly well. The same model can be used for all types of anomalies. Therefore, the resulting trained cognitive model is agnostic to the anomaly type. Combination losses have been used for representation learning. However, combination loss functions are not typically used in the context of temporal data (time series), and even less so in a fully unsupervised setting.

[0038] In more detail, the preferred method is a triple loss function that ensures that given an input dataset y i The reference part (denoted as y ref) is closer to the representation learned for different parts of the same input dataset than for other parts of the dataset. Each part corresponds to a certain time segment, and it should be noted that the various time segments involved may have different time lengths. Similarly, y i can be considered as corresponding to a multivariate time series, while the KPIs it contains are usually univariate time series. ref The learned representation can be viewed as a representation (e.g., a vector) of the entire dataset (i.e., the entire anomaly). That is, each anomaly can be represented by the representation learned for any of its reference parts. The same operation can be performed for each input dataset to allow subsequent clustering of all input datasets.

[0039] In practice, for example, we can consider a given input dataset y i The given part y ref , where y ref can be chosen randomly. Then, the combined loss needs to ensure that y ref The representation of y remains close to any different parts of the same data set pos , while being far away from another dataset y j The selected part y neg . It may be advantageous to consider multiple negative samples to increase the stability of the training step and to ensure a higher degree of separation in the learned representations of sequences belonging to different clusters. In turn, the distances between the individual sequences may be calculated according to any suitable metric. If necessary, this metric may be specifically chosen to avoid potential dimensionality effects. It is preferred to use the angular cosine distance, as will be shown later.

[0040] For example, the first loss (triplet loss) function can be expressed as:

[0041]

[0042] where θ represents the parameters of the encoder and σ is the sigmoid function. The goal is to push the learned representation to distinguish y ref and neg , while assimilating y ref and pos You can select y neg The length of the sample to match y pos The length of y is chosen to speed up the training process. Algorithm 1 below shows ref ,y pos and {y neg} p Examples of appropriate procedures.

[0043]

[0044]

[0045] That is, from ref Randomly select y from the same input data set pos , and use cosine similarity (cos sim )Select {y neg} p More specifically, if and ref If the similarity between them is lower than the threshold th, then is an ideal negative sample to be used in the representation learning process (i.e., the closer the cosine similarity is to 0, the less similar the compared sequences are). For example, th can be set to 0.4. Once P subsequences satisfying the similarity constraint are found, {y neg} p The selection process is completed. In special cases where this cannot be done (i.e., the sequences in the data set are too similar), the threshold th can be reduced in an exponential decay manner and the process can be repeated. As will be appreciated by those skilled in the art, several variations of the above algorithm can be envisioned.

[0046] Now more specifically refer to Figure 3 and 6 The unsupervised cognitive model 15 is preferably executed in an alternating, iterative manner. That is, the execution of the model 15 may be such that the first stage 151 ( Figure 6 The two stages 151, 152 are repeatedly performed (the process loops back to step S33) so that several iterations are performed. Thus, the learned representations and the obtained clusters (S33, S35) are alternately optimized through several iterations. The purpose of the optimization performed can be to reduce the combined loss function.

[0047] like Figure 7 As shown, in each iteration, the first loss function and the second loss function may be calculated alternately in the first stage and the second stage, respectively (steps S332 and S353, respectively), so as to finally obtain the combined loss (step S354). Ideally, the goal would be to completely minimize the combined loss function. However, it is preferred to adopt an early stopping strategy (such as Figure 7 ) to reduce computation, so that when stopping, the combined loss function may not be fully minimized.

[0048] Furthermore, the unsupervised cognitive model 15 may preferably be executed so as to achieve predefined structural properties of the clusters. Such predefined structural properties may be achieved, for example, based on silhouette scores of the clusters.

[0049] Figure 7A preferred process is shown, according to which each iteration may result in obtaining (step S331) a representation of the input data set at a first stage 151, followed by calculating (step S332) a first loss (using a first loss function) based on the obtained representation. The second stage 152 preferably involves a k-means algorithm. That is, the k-means algorithm is run at step S351 based on the previously obtained representation before optimizing S352 the number of clusters based on the silhouette scores obtained for the clusters. Next, at S353, a second loss may be calculated using a second loss function, whereby a current combined loss may be calculated based on the first and second losses at step S354.

[0050] As described above, an early stopping strategy can preferably be used to limit the calculation. That is, at step S36, the algorithm can decide whether to stop S38 training by comparing the current combined loss with the previous combined loss, that is, the loss obtained during the previous iteration. A default loss value can be used in the first iteration. In detail, at each iteration, the algorithm can check whether the composite loss has decreased (step S36). If so (S36: yes), the algorithm can check S37 whether a predetermined maximum number of iterations has been reached. If this is indeed the case (S37: yes), the process stops; the algorithm selects S39 the current representation and clustering and returns to S40. If not (S37: no), another iteration is started, thereby calculating a new representation, step S331. If it is found during the iteration that the combined loss is no longer reduced (S36: no), the iterative process is stopped at S38, and the algorithm selects the previously obtained representation and clustering at S38. Finally, the algorithm returns S40 to the optimized clustering. Figure 5 An example of clusters (502 to 508) obtained using dimensionality reduction techniques as projected in a 2D plane is schematically depicted.

[0051] In summary, the cognitive model 15 can be advantageously trained in an iterative and alternating manner using an early stopping strategy based on a combined loss function. This scheme can be considered to be directed to two objectives. The first objective is to minimize the total loss corresponding to the combined loss function, while the second objective is to achieve the predefined structural properties of the clusters obtained via the second stage. By training the network on various input lengths from the shortest to the longest time series, the network gradually becomes able to output meaningful representations regardless of the input length of the input time series.

[0052] like Figure 6As further seen in , the clusters returned by the algorithm can then be used, for example, by a support engineer to investigate S50 the anomaly. Specifically, the support engineer can attempt to identify S50 the type of anomaly corresponding to each cluster obtained at step S40. If necessary, the method can further include indicating that an action be taken with respect to the target computerized system 2 based on the type of anomaly identified. This can result in modifying the functionality of the computerized system 2 with the goal of optimally resolving the observed anomaly.

[0053] like Figure 4 As shown, the encoder (first stage 151) is preferably configured as an exponentially expanded causal convolutional neural network. In particular, the first stage 151 may include k convolution blocks 151k, where k≥2. However, in practice, the number k of convolution blocks 151k is typically greater than or equal to 3. Each convolution block 151k may include one or more expanded causal convolution layers. That is, in each block, each layer has a dilation parameter 2i of the type for layer i. As the dilation factor increases, the expanded temporal convolution filter layer enables causal convolution.

[0054] like Figure 4 As further seen in , the first stage 151 may include a hierarchy of neural layers arranged at the output of each dilated causal convolutional layer. In particular, this hierarchy of neural layers may include a weight normalization (“WeightNorm”) layer and an activation layer. The activation layer may, for example, be a leaky rectified linear unit (leaky ReLU). This structure may be repeated, whereby each convolutional layer is followed by a weight normalization layer and an activation layer, which itself is followed by another convolutional layer.

[0055] Figure 4 The example assumes that each convolution block 151K includes two connected sub-blocks, each of which includes a convolution layer, a weight normalization layer, and an activation layer. In addition, the first stage 151 can advantageously include a global maximum pooling layer ("Max pool1D") arranged in the output of the k convolution blocks 151k. This layer squeezes the time dimension and gathers all time information in an array of fixed size, for example, a vector of fixed size, as assumed below. In this regard, a linear transformation layer ("linear layer") may be provided in the output of the global maximum pooling layer. The linear transformation of the vector represents the learned representation, which is passed to the clustering stage 152 to perform the clustering task. In principle, any clustering algorithm can be used - without specific considerations for temporal data, different sampling frequencies or lengths - because the learned representations are of fixed length and comparable in the target space.

[0056] In summary, the first stage can preferably be configured in such a way that each layer is a combination of causal convolution, weight normalization, leaky ReLU, and residual connection, such as Figure 4As shown, each layer has a dilation parameter 2 of the type of layer i. i The output of the first stage network 151 then passes through a global max pooling layer that compresses the temporal dimension and aggregates all temporal information in a fixed-size vector. The linear transformation represents the learned representation, which is passed to the clustering stage 152 that performs the clustering task.

[0057] This encoder can ensure that similar representations are extracted from similar time series without any supervision to learn such similarities. Note that the unsupervised cognitive model 15 can still be designed as a single network as a whole. That is, the second stage 152 can be implemented by an external neural layer connected to the output of the first stage 151, such as Figure 4 However, as mentioned above, the resulting network can still be trained using an iterative training scheme based on the combined loss function.

[0058] In contrast, most existing methods treat representation learning and clustering as separate and sequential tasks. Such models are optimized to generate representations that minimize the reconstruction loss of the decoder alone. When using a decoder (rather than an encoder-only structure in the above structure), not only does such a model incur a large computational cost caused by training and inference, but more importantly, the clustering objective is not actively considered during the representation learning process.

[0059] Next, according to another aspect, the present invention can be implemented as a computer program for clustering anomalies detected in a computerized system. The computer program product includes a computer-readable storage medium having program instructions contained therein. These instructions typically form software stored, for example, in the storage system 120 of the computerized unit, such as Figure 8 As shown, for example, corresponding to Figure 1 The program instructions are executable by the processing means 105 of such a unit 101 so as to cause the latter to perform the steps according to the method. Additional features of the computer program product are described in Section 3.2.

[0060] The preferred embodiment relies on a completely unsupervised and efficient approach that optimizes representation learning and clustering tasks simultaneously. This is achieved by combining a stacked dilated causal convolutional neural network (CNN) encoder-only architecture with a combined loss function with cosine similarity-based negative sampling and iterative training.

[0061] The proposed architecture can learn non-linear temporal representations for clustering variable-length time series in a fully unsupervised setting. A particularly attractive feature of the approach is the integration (via an efficient combined loss function) and simultaneous optimization (through iterative training) of representation learning and clustering tasks, thanks to a network based on an encoder formed by dilated convolutions.

[0062] This method outperforms existing methods in at least 70% of cases and is comparable in other cases. Such experiments have demonstrated the effectiveness of the model when compared to the state-of-the-art classical and deep learning clustering methods. In particular, the efficiency and scalability of the method have been evaluated and demonstrated based on sequences including millions of data points. For completeness, the inventors have simplified the invention to a real-world industrial application starting from a cloud computing platform to practice and implement the invention.

[0063] Computerized systems and devices can be appropriately designed to implement embodiments of the present invention as described herein. In this regard, it will be appreciated that the methods described herein are largely non-interactive and automated. In an exemplary embodiment, the methods described herein can be implemented in an interactive, partially interactive or non-interactive system. The methods described herein can be implemented in software, hardware or a combination thereof. In an exemplary embodiment, the methods proposed herein are implemented as executable programs in software, which are executed by suitable digital processing equipment. More generally, embodiments of the present invention can be implemented using virtual machines and / or general-purpose digital computers, such as personal computers, workstations, etc.

[0064] For example, Figure 1 Each of the systems 1 and 2 shown in FIG. 1 may include one or more computerized units 101 (eg, general-purpose or special-purpose computers), such as Figure 8 Each unit 101 can interact with other generally similar units 101 to perform steps according to the method.

[0065] In an exemplary embodiment, if Figure 8 As shown, in terms of hardware architecture, each unit 101 includes at least one processor 105 and a memory 110 coupled to a memory controller 115. Several processors (CPUs and / or GPUs) may be involved in each unit 101. To this end, a corresponding memory controller may be assigned to each CPU / GPU, which is known per se.

[0066] One or more input and / or output (I / O) devices 145, 150, 155 (or peripheral devices) may be communicatively coupled via a local input / output controller 135. The I / O controller 135 may be coupled to or include one or more buses and a system bus 140, as is known in the art. The I / O controller 135 may have additional elements, which are omitted for simplicity, such as controllers, buffers (caches), drivers, repeaters, and receivers, to enable communications. In addition, the local interface may include address, control, and / or data connections to enable appropriate communications between the above components.

[0067] The processor 105 may be a hardware device for executing software including instructions such as those that come as part of a computerized task triggered by a machine learning algorithm. The processor 105 may be any custom or commercially available processor. In general, they may involve any type of semiconductor-based microprocessor (in the form of a microchip or chipset), or more generally, any device for executing software instructions, including quantum processing devices.

[0068] The memory 110 may generally include volatile memory elements (eg, random access memory), and may also include non-volatile memory elements. In addition, the memory 110 may include electrical, magnetic, optical, and / or other types of storage media.

[0069] The software in the memory 110 may include one or more separate programs, each of which includes executable instructions for implementing logical functions. Figure 8 In the example of , the instructions loaded into the memory 110 may include instructions resulting from the execution of the computerized method described herein according to the exemplary embodiments. The memory 110 may also load a suitable operating system (OS) 111. The OS 111 substantially controls the execution of other computer programs or instructions and provides scheduling, I / O control, file and data management, memory management, and communication control and related services.

[0070] Possibly, a conventional keyboard and mouse may be coupled to the input / output controller 135. Other I / O devices 140-155 may be included. The computerized unit 101 may also include a display controller 125 coupled to the display 130. The computerized unit 101 may also include a network interface or transceiver 160 for coupling to a network (not shown) to in turn enable data communications to / from other external components (e.g. other units 101).

[0071] The network sends and receives data between a given unit 101 and other devices 101. The network may be implemented wirelessly, for example using wireless protocols and technologies such as Wifi, WiMax, etc. The network may be, in particular, a fixed wireless network, a wireless local area network (LAN), a wireless wide area network (WAN), a personal area network (PAN), a virtual private network, an intranet or other suitable network system, and includes devices for receiving and sending signals. However, preferably, the network should allow very fast message delivery between units.

[0072] The network may also be an IP-based network for communicating between any given unit 101 and any external unit via a broadband connection. In an exemplary embodiment, the network may be a managed IP network managed by a service provider. In addition, the network may be a packet-switched network, such as a LAN, WAN, the Internet, the Internet of Things, etc.

[0073] The present invention may be a method and / or a computer program product. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform various aspects of the present invention.

[0074] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0075] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0076] The computer-readable program instructions for performing the operation of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data of an integrated circuit, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a LAN or WAN, or may be connected to an external computer (e.g., using an Internet service provider via the Internet). In some embodiments, in order to perform various aspects of the present invention, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array, or a programmable logic array may execute a computer-readable program instruction by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0077] Various aspects of the present invention are described herein with reference to the flow chart and / or block diagram of the method, system and computer program product according to embodiments of the present invention. It will be understood that each frame of the flow chart and / or block diagram and the combination of frames in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0078] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in the flowchart and / or one or more blocks.

[0079] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0080] Flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in the flow chart or block diagram can represent the module, segment or part of instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure.For example, two frames shown continuously can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved.It will also be noted that the combination of the frames in each frame of the block diagram and / or flow chart illustration and the block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special hardware and computer instructions.

[0081] It should be understood that although the present disclosure relates to embodiments of cloud computing, implementation of the teachings set forth herein is not limited to a cloud computing environment. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed. Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage systems, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the provider of the service.

[0082] Although the present invention has been described with reference to a limited number of embodiments, variations and drawings, it will be appreciated by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the present invention. In particular, the features (equipment class or method class) described in a given embodiment, variation or shown in the drawings may be combined with or substituted for another feature in another embodiment, variation or drawings without departing from the scope of the present invention. Therefore, various combinations of features described with respect to any of the above-mentioned embodiments or variations may be considered, which remain within the scope of the appended claims. In addition, many minor modifications may be made to adapt specific situations or materials to the teachings of the present invention without departing from the scope of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed, but the present invention will include all embodiments falling within the scope of the appended claims. In addition, many other variations other than those explicitly mentioned above may be expected.

Claims

1. A computer-implemented method for clustering anomalies detected in a computerized system, wherein: The method comprises: accessing input data sets corresponding to detected anomalies of the computerized system, wherein the anomalies span corresponding time windows and each of the corresponding input data sets includes a set of time series of key performance indicators extending over a corresponding one of the time windows; loading an unsupervised cognitive model, wherein the model comprises a first stage and a second stage, wherein the first stage comprises an encoder designed to learn a fixed-size representation of a given data set, and the second stage is a clustering stage; and The unsupervised cognitive model is executed based on accessing the input data set for the first stage learning a fixed-size representation of the input data set and the second stage clustering the learned representation to obtain clustering of anomalies.

2. The method according to claim 1, wherein: executing the unsupervised cognitive model using a combined loss function that combines the first loss function and the second loss function; and The first loss function and the second loss function are designed to optimize the representation and the clustering, respectively.

3. The method according to claim 2, wherein: The first loss function is designed as a triple loss function to ensure that the representation learned for a reference part of each data set of the input data sets is on average closer to the representation learned for a different part of each data set than the representation learned for other parts of other data sets in the input data sets, wherein each of the reference part, the different part and the other parts corresponds to a corresponding time period.

4. The method according to claim 2, wherein: The unsupervised cognitive model is executed by iteratively alternating the first and second stages with the goal of reducing the combined loss function, such that the learned representations and the obtained clustering are alternately optimized over several iterations.

5. The method according to claim 4, wherein: The unsupervised cognitive model is executed so as to achieve predefined structural properties of the clusters.

6. The method according to claim 5, wherein: The predefined structural property is implemented based on a silhouette score of the clusters.

7. The method according to claim 6, wherein: Each of said iterations comprises: In the first stage: obtaining a representation of the input data set; and Based on the obtained representation, calculating a first loss using the first loss function; In the second stage: Run the k-means algorithm based on the previously obtained representation; optimizing a plurality of clusters based on the silhouette scores obtained for the clusters; Calculating a second loss using the second loss function; and Calculating a current combined loss based on the first loss and the second loss; and Whether to stop training is determined by comparing the current combined loss with a previous combined loss obtained during a previous iteration.

8. The method according to claim 1, wherein: The encoder is configured as an exponentially dilated causal convolutional neural network.

9. The method according to claim 8, wherein: The unsupervised cognitive model is designed as a single network, and The second stage is implemented by an external neural layer of the cognitive model, which is connected to the output of the first stage.

10. The method according to claim 9, wherein: The first stage includes at least two convolutional blocks; and Each of the at least two convolutional blocks includes one or more dilated causal convolutional layers.

11. The method according to claim 10, wherein: The first stage also includes a hierarchy of neural layers arranged in the output of each of the dilated causal convolutional layers.

12. The method according to claim 11, wherein: The hierarchy of neural layers includes weight normalization layers and activation layers.

13. The method according to claim 12, wherein: The activation layer is a leaky rectified linear unit.

14. The method of claim 12, wherein: The first stage further comprises a global max pooling layer arranged in the outputs of the at least two convolutional blocks.

15. The method according to claim 14, wherein: The first stage further comprises a linear transformation layer at the output of the global max pooling layer.

16. The method according to claim 1, wherein: The method further comprises: The type of anomaly corresponding to each obtained cluster is identified.

17. The method of claim 1, wherein: The method further includes monitoring the computerized system to detect the anomaly prior to accessing the input data set and executing the unsupervised cognitive model.

18. A computer program product for clustering anomalies detected in a computerized system, the computer program product comprising: One or more computer-readable tangible storage media and program instructions stored on at least one of the one or more tangible storage media, the program instructions being executable by a processor capable of performing a method comprising: accessing input data sets corresponding to detected anomalies of the computerized system, wherein the anomalies span corresponding time windows and each of the corresponding input data sets includes a set of time series of key performance indicators extending over a corresponding one of the time windows; loading an unsupervised cognitive model, wherein the model comprises a first stage and a second stage, wherein the first stage comprises an encoder designed to learn a fixed-size representation of a given data set, and the second stage is a clustering stage; and The unsupervised cognitive model is executed based on the input data set accessed for the first stage learning of a fixed-size representation of the input data set and the representation learned by the second stage clustering to obtain clustering of anomalies.

19. A computer program according to claim 18, wherein: The unsupervised cognitive model involves a combined loss function that combines a first loss function and a second loss function, wherein the first loss function and the second loss function are designed to optimize the representation and the clustering, respectively, and In operation, the first stage and the second stage are iteratively performed to reduce the combined loss function.

20. The computer program of claim 18, wherein: The first loss function is designed as a triple loss function to ensure that the representation learned for a reference part of each data set of the input data sets is on average closer to the representation learned for a different part of each data set than the representation learned for other parts of other data sets in the input data sets, wherein each of the reference part, the different part and the other parts corresponds to a corresponding time period.

Images