A Fully Unsupervised Pipeline for Clustering Detected Anomalies in Computerized Systems

Abstract

The present invention is particularly directed to a computer-implemented method for clustering detected anomalies in a computerized system. The proposed method utilizes an unsupervised cognitive model executed on an input dataset to obtain a clustering of the anomalies. The method accesses an input dataset corresponding to detected anomalies of the computerized system, where the anomalies span respective time windows. Each input dataset includes a set of time series of key performance indicators. The key performance indicators of each input dataset span respective time windows. That is, each anomaly corresponds to a respective time window. The model includes a first stage including an encoder designed to learn a fixed-size representation of the input dataset, and a second stage, which is a clustering stage. The model is executed on the accessed input dataset, where the first stage learns a fixed-size representation of the input dataset, and the second stage clusters the learned representations.

Description

[Technical Field]

[0001] The present invention relates generally to the field of computer-implemented methods and computer program products for clustering detected anomalies in computerized systems. In particular, it is directed to methods that rely on a fully unsupervised pipeline to learn fixed-size representations of an input dataset corresponding to a set of time series of key performance indicators, and cluster the learned representations to obtain clusters of anomalies.

[0002] Clustering time series is important when categorical labels are rarely or sparsely available and the ability to detect patterns is essential. In recent years, deep learning models have shown outstanding results in supervised tasks by using representation learning. However, a challenge remains ensuring that such representations are cluster-friendly and effectively capture the temporal and multidimensional dynamics of variable-length time series. Summary of the Invention

[0003] According to a first aspect, the present invention is embodied as a computer-implemented method for clustering detected anomalies in a computerized system. The proposed method utilizes an unsupervised cognitive model executed on an input dataset to obtain a clustering of the anomalies. The input datasets accessed by the method correspond to detected anomalies of the computerized system. These anomalies span respective time windows. Each of the corresponding input datasets includes a set of time series of key performance indicators (KPIs). The KPIs of each input dataset span respective time windows. That is, each anomaly corresponds to a respective time window. The unsupervised cognitive model is loaded (e.g., into the main memory of a computer implementing the method) before being executed. The model includes a first stage and a second stage. The first stage includes an encoder designed to learn a fixed-size representation of the input dataset, while the second stage is a clustering stage. The model is run on the accessed input dataset such that the first stage learns a fixed-size representation of the input dataset and the second stage clusters the learned representation, whereby clusters of anomalies are finally obtained by this method.

[0004] In an embodiment, the unsupervised cognitive model is implemented using a composite loss function that combines a first loss function and a second loss function, which are designed to optimize the representation and the cluster, respectively.

[0005] Preferably, the first loss function is designed as a triplet loss function. The latter ensures that the representations learned for the reference portion of each of the input datasets (corresponding to the respective anomalies) are, on average, closer to the representations learned for the separate portions of each of the input datasets than the representations learned for the other portions of the other input datasets of the input datasets. Each of the reference portion, the separate portion, and the other portions corresponds to a respective time segment. Still, each portion may aggregate several KPIs, i.e., all KPIs of the respective anomaly (albeit spread over a certain time segment). The representations learned for each reference portion can serve as the representation of the corresponding anomaly. As a result, the representations learned for the reference anomaly are, on average, closer to the representations learned for other similar anomalies than the representations learned for dissimilar anomalies.

[0006] According to another aspect, the invention is embodied as a computer program product for clustering detected anomalies in a computerized system. The computer program product comprises a computer-readable storage medium having program instructions embodied thereon, the program instructions being executable by processing means to cause the processing means to perform a method such as that described above. [Brief explanation of the drawings]

[0007] These and other objects, features, and advantages of the present invention will become apparent from the following detailed description of illustrative embodiments, which should be read in connection with the accompanying drawings, which are provided for clarity in order to facilitate understanding of the invention by those skilled in the art and which, together with the detailed description, include:

[0008] [Figure 1] 1 shows a schematic representation of a computer interacting with a computerized system of interest with a view to clustering anomalies detected for the computerized system of interest, according to an embodiment;

[0009] [Figure 2] 1 is a graph showing the evolution of various KPIs over a given period. The KPI values form respective (univariate) time series. It is assumed that seven anomalies have been detected based on such KPIs over this period. The anomalies are illustrated as corresponding time windows, as used in the embodiment.

[0010] [Figure 3] FIG. 1 is a high-level diagram of an unsupervised two-stage model used to learn representations of anomalies and cluster such anomalies, according to an embodiment.

[0011] [Figure 4] FIG. 4 is a more detailed view of the model of FIG. 3, showing the preferred structure of the first stage (dedicated to representation learning) of this model.

[0012] [Figure 5] 2D plots of example clusters of anomalies obtained in an embodiment.

[0013] [Figure 6] 1 is a flowchart illustrating high-level steps of a method for clustering anomalies, according to an embodiment.

[0014] [Figure 7] FIG. 1 is a flowchart illustrating the low-level steps of the first and second stages of an unsupervised model that relies on a combined loss function, as in an embodiment.

[0015] [Figure 8] 1 schematically represents a general-purpose computerized system suitable for implementing one or more method steps involved in embodiments of the present invention.

[0016] The accompanying drawings show simplified representations of devices or portions thereof, as included in the embodiments. Similar or functionally similar elements in the drawings are assigned the same reference numbers unless otherwise indicated.

[0017] Computerized methods and computer program products embodying the present invention will now be described by way of non-limiting examples. DETAILED DESCRIPTION OF THE INVENTION

[0018] A first aspect of the present invention will now be described in detail with reference to Figures 1-3 and 6. This aspect relates to a computer-implemented method for clustering detected anomalies in a computerized system, and this method and variations thereof will be collectively referred to as "the method."

[0019] Formally, anomalies are defined as rare events that differ significantly from other findings, raising suspicions about the mechanism that produced them. Anomalies can arise, for example, due to malicious or inappropriate behavior, fraud, or system failures. Among other things, anomalies can be data traffic anomalies that occur during network attacks (e.g., in a business environment), unauthorized access, network intrusion, inappropriate data disclosure, data leaks, system malfunctions, or deletion of data and / or resources. Anomaly detection is important in various domains, such as cybersecurity, fraud detection, and healthcare. Early detection is often paramount, as failure to address the cause of an anomaly can result in significant damage.

[0020] The method may be implemented, for example, in a given computer 1 (see FIG. 1 ), which interacts with a target computerized system 2, i.e., a system of interest in which anomalies may be detected and analyzed. For example, the computerized system 2 may comprise a networked computerized device, as assumed in FIG. 1 , enabling, for example, cloud computing. In a variant, the system 2 may be a data center, a supercomputer, a general-purpose computer, memory and storage hardware, a load / store engine, or any other type of computerized device or system. It should be noted that the computer implementing the method (i.e., computer 1 in FIG. 1 ) may optionally form part of the target computerized system 2.

[0021] The method relies on KPIs of the computerized system 2. The KPIs are typically obtained from computing and / or storage devices that make up the system 2. For example, such KPIs may be continuously monitored by monitoring S10 the computerized system 2. For example, the monitored signals or data may consist of or include monotonic columns or tabular data, the purpose of which is to enable detection of potential anomalies in the system 2. The KPI values of the KPIs form respective time series. Each KPI typically corresponds to a respective quantity, so that the respective time series are typically univariate. However, the KPIs may in principle also correspond to multivariate time series.

[0022] In what follows, for simplicity, we assume that each KPI corresponds to a univariate time series. A time series is a sequence of values (KPI values) of a given quantity (KPI) obtained at successive times. In Figure 2, we have N univariate KPIs (KPI1 to KPI NSuch KPI values may be continuously collected and aggregated, for example, from a data stream of raw KPI values. The aggregated values typically undergo some pre-processing. Note that the entire set of KPIs can be viewed as a multivariate time series as a whole.

[0023] Thus, the method may result in detecting anomalies in the computerized system 2 based on the monitored KPIs (step S10 in FIG. 6). Any suitable anomaly detection algorithm may be used. The algorithm may, for example, reflect a model, possibly an analytical model. Various examples of anomaly detection algorithms and pipelines are known. FIG. 2 assumes that seven anomalies have been detected at different times over a long period of time. The detected anomalies are illustrated as corresponding time windows, which may span separate periods and may even overlap.

[0024] When an anomaly is detected, the method may automatically determine (or cause to be determined) a corresponding time window spanning a given period of time. The time window is typically determined as the endpoints of a certain time interval. A tentative heuristic method may be used to determine such a time window. If necessary, the determined window may be subject to validation by an expert (system or human). That is, the method may automatically determine troubleshooting time windows and prompt an expert to validate them. In a variant, the anomalies are detected by another entity (e.g., another computer) and provided as input to a computer implementing the anomaly clustering method described below.

[0025] In all of the scenarios recalled above, the clustering method accesses input data sets corresponding to the detected anomalies of the computerized system 2 (step S20 in FIG. 6). The detected anomalies span respective time windows (which may possibly differ or overlap). That is, each input data set comprises a set of time series of KPIs, corresponding to the detected anomalies. All KPIs of the same input data set span the same time window. Each input data set may be considered as a multivariate time series.

[0026] The method relies on an unsupervised cognitive model 15, which is loaded into, for example, the main memory of the computer 1 in step S30 with a view to subsequently executing the model. Note that in practice, the model 15 may be loaded before the target input dataset is accessed S20. As shown schematically in FIGS. 3 and 4, the unsupervised cognitive model 15 includes a first stage 151 and a second stage 152. The first stage 151 includes an encoder (i.e., a feature extractor) designed to learn a representation of the input dataset. Importantly, the encoder here is designed to learn a fixed-size representation of the input dataset. The second stage 152 is a clustering stage. Suitable examples of encoders and clustering stages are described in more detail below.

[0027] Then, based on the input dataset accessed in step S20, an unsupervised cognitive model 15 is executed. The two-stage structure of the model 15 involves training a representation of the input dataset in the first stage 151 (step S33 in FIG. 6). As per the encoder design, the trained representation is a fixed-size representation, facilitating the subsequent clustering process, i.e., the second stage 152 clusters the trained representation (step S35), thereby finally obtaining clusters of anomalies (step S40).

[0028] The proposed approach advantageously relies on a fully unsupervised pipeline. Model 15 learns a fixed-size representation of the input dataset, whereby features of the input dataset are extracted, for example, as 1D or 2D arrays (i.e., vectors or matrices). Preferably, the encoder is designed to extract features as 1D arrays to facilitate the subsequent clustering process performed by second stage 152. In practice, tens to hundreds of input datasets (corresponding to respective anomalies) may potentially be fed to model 15, where such input datasets may have time windows of different lengths, and such time windows may possibly overlap, as assumed in FIG. 2 (compare the third, fourth, fifth, and sixth anomalies).

[0029] That is, the encoder (first stage) may enable learning of useful representations (e.g., vectors) with fixed-size representations regardless of the characteristics of the time window of the input dataset, which is very useful in practice. In other words, the encoder allows for a priori comparison of datasets that are largely incomparable. In particular, a fast encoder-only CNN with dilated causal convolutions can be used to handle long time series, which may be overlapping and of variable length, as in the embodiments discussed below. "Encoder-only" means that it is not an encoder-decoder architecture and does not include a decoder. Ultimately, the encoder may extract fixed-size representations of the input dataset from the input dataset, which can then easily cluster the representations. By learning fixed-size representations (despite different durations and overlapping time windows), in principle, any clustering method may be contemplated. However, a preferred clustering method that can be advantageously used in this context is disclosed herein.

[0030] Model 15 is designed to generate meaningful clustering of anomalies, which typically correspond to different types of anomalies, i.e., clustering can be performed to identify groups of anomalies that reflect different kinds of anomalous behavior, which facilitates subsequent investigation by support engineers. The obtained clusters facilitate anomaly analysis, since time series that belong to the same cluster can be assumed to reflect the same anomaly type.

[0031] An advantage is that the two-stage architecture of model 15 lends itself well to iterative and alternating training based on a composite loss function, as discussed below with reference to preferred embodiments. In particular, the anomaly representation can be optimized along with the clustering objective using a novel triplet loss function and an iterative and alternating training scheme that is computationally tractable for real-world systems. Hence, the method can be used to at least partially automate in-depth analysis of anomaly events occurring in complex systems such as cloud infrastructures. However, beyond cloud infrastructures, the method can be applied to data centers, supercomputers, general-purpose computers, memory and storage hardware, load / store engines, or any other type of computerized device or system, as noted above.

[0032] All of this will now be described in detail with reference to specific embodiments of the present invention. First, the unsupervised cognitive model 15 may be implemented, preferably using a composite loss function. This composite loss function may combine a first loss function and a second loss function. The first loss function may be designed (and used) to optimize the learned representation, while the second loss function may aim to optimize the final obtained clusters, i.e., the second loss function incorporates the clustering task.

[0033] In practice, the combined loss may be described as a mathematical function that takes two loss functions as arguments. The combined loss function is typically the sum of two losses, one of which aims to learn an appropriate representation and the other of which minimizes the clustering loss. The first loss function may advantageously be decomposed into two terms to allow for time-based negative sampling, as in the preferred embodiment discussed below. Thus, the composite loss function may actually include three functions.

[0034] The use of the composite loss function described above allows for simultaneous optimization of representation learning (i.e., learning fixed-length representations) and clustering. The composite loss function may therefore aim to both learn good representations of anomalies and obtain good quality clusters. This may be preferably achieved in an iterative and alternating manner, as discussed below. The use of an iterative process makes training computationally more tractable.

[0035] In a preferred embodiment, the second stage may consist of one or more layers above the encoder layer, thus forming a single network 15, which can nevertheless be alternatively optimized for representation learning and clustering. This is shown in Figures 3 and 4.

[0036] More specifically, the first loss function is preferably designed as a triplet loss function, which ensures that representations learned for a reference portion (or chunk) of each input dataset (corresponding to a respective anomaly) are, on average, closer to representations learned for separate portions of the same input dataset than representations learned for other (i.e., separate) portions of the same input dataset. Each of the portions may correspond to a respective time segment. Still, each portion may aggregate several KPIs, i.e., all KPIs of each anomaly (albeit spread over a certain time segment). Thus, the representation learned for each reference portion can serve as a representation for the corresponding anomaly. As a result, the representation learned for the reference anomaly is, on average, closer to representations learned for other similar anomalies than representations learned for dissimilar anomalies. Such a triplet loss function involves time-based negative sampling. As a result, the learned representations are ultimately closer to anomalies that belong to the same cluster, and the other representations are farther away.

[0037] Using the triplet loss algorithm described above has proven to work surprisingly well. The same model can be used for all types of anomalies. The resulting trained cognitive model is therefore independent of the type of anomaly. Synthetic losses have already been used for representation learning. However, synthetic loss functions have not typically been used in the context of temporal data (time series), and even less in a fully unsupervised environment.

[0038] More specifically, the preferred approach is to i of,y refThe triplet loss function ensures that the representation of a reference portion, denoted y, is closer to representations learned for distinct portions of the same input dataset than for portions of other datasets. Note that each portion corresponds to a certain time segment, and the various time segments involved may have distinct time lengths. Again, y i may be considered to correspond to a multivariate time series, while the KPIs it contains are typically univariate time series. ref The representation learned for can be taken as a representation (e.g., vector) of the entire dataset, i.e., of the entire anomaly. That is, each anomaly can be represented by a representation learned for any of its reference parts. The same may be performed for each input dataset, allowing subsequent clustering of all input datasets.

[0039] In practice, for example, y ref can be randomly selected for a given input data set y i Given a part y of ref In this case, the combined loss is y ref is expressed as any distinct part y of that same data set. pos is still close to, but for another dataset y j The selected part from y neg It is necessary to ensure that the distance between the various sequences is far from . Advantageously, several negative samples may be considered in order to increase the stability of the training step and ensure a higher degree of separation in the learned representations of sequences belonging to different clusters. Furthermore, the distance between the various sequences can be calculated according to any suitable metric. If necessary, this metric can be chosen to avoid, among other things, insidious dimensionality effects. Preferably, the angular cosine distance is used, as will be shown later.

[0040] For example, the first loss (triplet loss) function can be expressed as:

number

[0041] That is, y pos is y rer are randomly selected from the same input dataset and are evaluated by cosine similarity (cos sim ) is {y neg}. More specifically,

number

number

[0042] 3 and 6, the unsupervised cognitive model 15 is preferably executed in an alternating iterative manner. That is, execution of the model 15 alternates between a first stage 151 (step S33 in FIG. 6) and a second stage 152 (step S35), and the two stages 151, 152 may be executed repeatedly (the process loops back to step S33), thereby performing several iterations. Thus, the learned representations and the obtained clusters are alternately optimized S33, S35 over several iterations. The objective of the performed optimization may be to reduce a composite loss function.

[0043] As shown in FIG. 7, in each iteration, the first loss function and the second loss function can be calculated alternately in the first stage and the second stage, respectively (steps S332 and S353), thereby finally obtaining a composite loss (step S354). Ideally, the goal is to completely minimize the composite loss function. However, to reduce computation, an early stopping strategy is preferably adopted (as assumed in FIG. 7), so that the composite loss function may not be completely minimized at the time of stopping.

[0044] The unsupervised cognitive model 15 may also be preferably implemented to implement predefined structural properties of the clusters, which may be implemented, for example, based on the silhouette scores of the clusters.

[0045] 7 illustrates a preferred process, whereby each iteration may involve, in a first stage 151, obtaining a representation of the input dataset (step S331), followed by calculating a first loss (using a first loss function) based on the obtained representation (step S332). The second stage 152 preferably includes a k-means algorithm, whereby the k-means algorithm is run in step S351 based on the previously obtained representation, followed by optimizing the number of clusters based on the silhouette scores obtained for the clusters S352. A second loss may then be calculated S353 using a second loss function, whereby a current combined loss may be calculated in step S354 based on the first loss and the second loss.

[0046] As mentioned above, an early stopping strategy may be preferably used to limit the calculation. That is, in step S36, the algorithm may decide whether to stop training S38 by comparing the current composite loss with the previous composite loss, i.e., the loss obtained during the previous iteration. In the very first iteration, a default loss value may be used. In particular, in each iteration, the algorithm may check whether the composite loss has decreased (step S36). If so (S36: Yes), the algorithm may check whether a predetermined maximum number of iterations has been reached S37. If this is indeed the case (S37: Yes), the process stops; the algorithm selects the current representation and cluster S39 and returns S40. If not (S37: No), another iteration is initiated, whereby a new representation is calculated (step S331). If it is found that the composite loss no longer decreases during the iteration (S36: No), the iteration process is stopped S38, and the algorithm selects the previously obtained representation and cluster S38. Finally, the algorithm returns to the optimized cluster S40. Figure 5 illustrates schematically examples of the obtained clusters (C1-C4) projected onto a 2D plane using the dimensionality reduction technique.

[0047] In short, the cognitive model 15 may be advantageously trained in an iterative, alternating manner based on combined loss functions using an early stopping strategy. Such a scheme may be considered as aiming at two objectives: the first is to minimize the total loss corresponding to the combined loss function, while the second is to achieve predefined structural properties of the clusters obtained via the second stage. By training the network for various input lengths ranging from the shortest to the longest time series, the network gradually becomes able to output meaningful representations of the input time series regardless of their input length.

[0048] 6, the clusters returned by the algorithm may then be used, for example, by a support engineer investigating the anomalies S50. In particular, the support engineer may attempt to identify S50 the type of anomaly that corresponds to each of the clusters obtained in step S40. If necessary, the method may further include ordering an action to be taken with respect to the target computerized system 2 based on the type of anomaly identified. This may lead to modifying the functionality of the computerized system 2, with the aim of best responding to the observed anomaly.

[0049] As shown in Figure 4, the encoder (first stage 151) is preferably configured as an exponentially expanding causal convolutional neural network. In particular, the first stage 151 may include k convolutional blocks 151k, where k > 2. In practice, however, the number k of convolutional blocks 151k is typically equal to or greater than 3. Each convolutional block 151k may include one or more expanded causal convolutional layers. That is, in each block, each layer is of type 2 for layer i. i The dilated temporal convolution filter layer allows for causal convolution with an increasing dilation factor.

[0050] As further seen in FIG. 4, the first stage 151 may include a hierarchy of neural layers disposed at the output of each of the dilated causal convolutional layers. In particular, this hierarchy of neural layers may include a weight normalization ("wnnormal") layer and an activation layer. The activation layer may be, for example, a leaky rectified linear unit (ReLU). This structure can be repeated, whereby each convolutional layer is followed by a weight normalization layer and an activation layer, which is itself followed by another convolutional layer.

[0051] The example of FIG. 4 assumes that each convolution block 151k includes two connected sub-blocks, each of which includes a convolution layer, a weight normalization layer, and an activation layer. The first stage 151 may also advantageously include a global max-pooling layer ("maxpool 1D") located at the output of the k convolution blocks 151k. This layer compresses the time dimension and aggregates all temporal information into a fixed-size array, e.g., a fixed-size vector, as assumed below. In this regard, a linear transformation layer ("linear layer") may be provided to the output of the global max-pooling layer. The linear transformation of the vector represents a learned representation, which is passed to the clustering stage 152 to perform the clustering task. In principle, any clustering algorithm can be used without special consideration of temporal data, different sampling frequencies, or lengths. This is because the learned representations are fixed length and comparable in the target space.

[0052] In summary, the first stage may be preferably configured such that each layer is a combination of causal convolution, weight normalization, leaky ReLU, and residual connections as shown in FIG. 4, where each layer is a type 2 iThe output of the first stage network 151 is then passed to a global max pooling layer, which compresses the time dimension and aggregates all the time information into a fixed-size vector. The linear transformation represents the learned representation, which is passed to the clustering stage 152, which performs the clustering task.

[0053] Such an encoder can ensure that similar representations are extracted from similar time series without any supervision to learn such similarities. Note that the unsupervised cognitive model 15 may still be designed entirely as a single network. That is, the second stage 152 may be implemented by an external neural layer connected to the output of the first stage 151, as assumed in FIG. 4. Nevertheless, the resulting network can be trained based on a composite loss function using an iterative training scheme, as discussed above.

[0054] In contrast, most existing approaches treat representation learning and clustering as separate, continuous tasks. Such models optimize to generate representations that only minimize the decoder's reconstruction loss. Not only do such models incur larger computational costs incurred by training and inference when using a decoder (instead, the above architectures use encoder-only architectures), but they also do not actively consider the clustering objective in the representation learning process.

[0055] According to another aspect, the present invention can be embodied as a computer program for clustering detected anomalies in a computerized system. The computer program product includes a computer-readable storage medium having program instructions embodied therein. Such instructions typically form software stored, for example, in storage 120, of a computerized unit such as that shown in FIG. 8, which corresponds, for example, to computer 1 in FIG. 1. The program instructions are executed by processing means 105 of such unit 101 to cause such unit 101 to perform steps according to the method. Additional features of this computer program product are described in Section 3.2.

[0056] The preferred embodiment relies on a fully unsupervised and efficient approach to simultaneously optimize both the representation learning and clustering tasks. This is achieved by combining an encoder-only architecture of stacked and dilated causal convolutional neural networks (CNNs) with a composite loss function via cosine similarity-based negative sampling and iterative training.

[0057] The proposed architecture may learn nonlinear temporal representations for clustering of variable-length time series in a fully unsupervised environment. A particularly attractive feature of this approach is the integration (via an efficient composite loss function) and joint optimization (by iterative training) of representation learning and clustering tasks by a network based on an encoder formed by dilated convolutions.

[0058] Such an approach outperforms existing methods in at least 70% of cases and compares favorably in others. Such experiments demonstrate the effectiveness of the model when compared with traditional deep learning clustering methods. In particular, the efficiency and scalability of the approach have been evaluated and proven based on series containing millions of data points. For completeness, the inventors have put the present invention into practice and implemented it for real-life industrial applications, starting with a cloud computing platform.

[0059] Computerized systems and devices may be suitably designed to implement embodiments of the present invention as described herein. In that regard, it may be understood that the methods described herein are largely non-interactive and automatic. In exemplary embodiments, the methods described herein may be implemented in either interactive, partially interactive, or non-interactive systems. The methods described herein may be implemented as software, hardware, or a combination thereof. In exemplary embodiments, the methods proposed herein may be implemented in software as an executable program, the latter being executed by a suitable digital processing device. More generally, embodiments of the present invention may be implemented using virtual machines and / or general-purpose digital computers, such as personal computers, workstations, and the like.

[0060] For example, each of systems 1 and 2 shown in Figure 1 may include one or more computerized units 101 (e.g., general-purpose or special-purpose computers) as shown in Figure 8. Each unit 101 may interact with other, typically similar, units 101 to perform steps according to the method.

[0061] 8, each unit 101 includes at least one processor 105 and a memory 110 coupled to a memory controller 115. Several processors (CPUs and / or GPUs) may possibly be included in each unit 101. To that end, each CPU and / or GPU may be assigned a respective memory controller, as known per se.

[0062] One or more input and / or output (I / O) devices 145, 150, 155 (or peripherals) may be communicatively coupled via a local input / output controller 135. The I / O controller 135 may be coupled to or include one or more buses and system bus 140, as known in the art. The I / O controller 135 may have additional elements such as controllers, buffers (caches), drivers, repeaters, and receivers that enable communication, but which are omitted for simplicity. Additionally, the local interface may include address, control, and / or data connections that enable appropriate communication between the aforementioned components.

[0063] Processor 105 may be a hardware device for executing software containing instructions, such as those that come as part of a computerized task triggered by a machine learning algorithm. Processor 105 may be any custom-made or commercially available processor. Generally, they may include any type of semiconductor-based microprocessor (in the form of a microchip or chipset), or more generally, any device for executing software instructions, including a quantum processing device.

[0064] Memory 110 may typically include volatile memory elements (e.g., random access memory) and may also include non-volatile memory elements, and may incorporate electronic, magnetic, optical, and / or other types of storage media.

[0065] The software in memory 110 may include one or more separate programs, each of which includes executable instructions for implementing logical functions. In the example of Figure 8, the instructions loaded into memory 110 may include instructions resulting from the execution of a computerized method described herein according to an exemplary embodiment. Memory 110 may further load a suitable operating system (OS) 111. OS 111 essentially controls the execution of other computer programs or instructions and provides scheduling, I / O control, file and data management, memory management, and communication control and related services.

[0066] In some cases, a conventional keyboard and mouse may be coupled to the input / output controller 135. Other I / O devices 140-155 may be included. The computerized unit 101 may further include a display controller 125 coupled to a display 130. The computerized unit 101 may also include a network interface or transceiver 160 for coupling to a network (not shown) to enable data communication with further external components, e.g., other units 101.

[0067] The network transmits and receives data between a given unit 101 and other devices 101. The network may in some cases be implemented in a wireless manner using wireless protocols and technologies such as, for example, Wifi, WiMax, etc. The network may be, among other things, a fixed wireless network, a wireless local area network (LAN), a wireless wide area network (WAN), a personal area network (PAN), a virtual private network, the Internet, or any other suitable network system, and includes equipment that receives and transmits signals. Preferably, however, the network should allow very high speed message passing between units.

[0068] The network may also be an IP-based network for communication between any given unit 101 and any external unit via a broadband connection. In an exemplary embodiment, the network may be a managed IP network operated by a service provider. The network may also be a packet-switched network such as a LAN, a WAN, an Internet network, an Internet of Things network, etc.

[0069] The present invention may be a method and / or a computer program product, which may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0070] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge-in-groove structures with instructions recorded thereon, and any suitable combination of the above. As used herein, computer-readable storage medium should not be construed as being a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through a wire.

[0071] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium in the respective computing / processing device for storage.

[0072] The computer-readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk® or C++, and procedural programming languages such as the “C” programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, as a standalone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a LAN or WAN, or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field programmable gate arrays, or programmable logic arrays may execute computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to perform aspects of the present invention.

[0073] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, systems and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0074] These computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine, whereby the instructions executing on the processor of the computer or other programmable data processing apparatus create means for implementing the functions / acts specified in a block or blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner, such that the computer-readable storage medium having stored thereon instructions comprises an article of manufacture containing instructions that implement aspects of the functions / acts identified in a block or blocks of the flowcharts and / or diagrams.

[0075] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device and cause the computer, other programmable apparatus, or other device to perform a series of processing steps to create a computer-implemented process, such that the instructions executing on the computer, other programmable apparatus, or other device implement the functions / acts specified in one or more blocks of the flowchart and / or block diagram.

[0076] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may in fact be executed substantially concurrently, or the blocks may be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations or executes a combination of special-purpose hardware and computer instructions.

[0077] While this disclosure refers to embodiments involving cloud computing, it should be understood that implementation of the teachings recited herein is not limited to cloud computing environments. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed. Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a service provider.

[0078] While the present invention has been described with reference to a limited number of embodiments, variations, and accompanying drawings, those skilled in the art will recognize that various modifications may be made and equivalents may be substituted without departing from the scope of the invention. In particular, features (such as devices or methods) described in a given embodiment, variation, or illustrated in a drawing may be combined with or substituted for other features of another embodiment, variation, or drawing without departing from the scope of the invention. Various combinations of the features described in connection with any of the above embodiments or variations may be contemplated as appropriate while remaining within the scope of the appended claims. In addition, many minor modifications may be made to adapt a particular situation or material to the teachings of the invention without departing from the scope of the invention. Therefore, the present invention is not limited to the specific embodiments disclosed, but is intended to include all embodiments falling within the scope of the appended claims. In addition, many variations other than those expressly mentioned above may be contemplated.

Claims

1. A computer-implemented method for clustering detected anomalies in a computerized system, the computer-implemented method comprising: accessing input data sets corresponding to detected anomalies of the computerized system, the anomalies spanning respective time windows, each of the corresponding input data sets having a set of time series of key performance indicators spanning a respective one of the time windows; loading an unsupervised cognitive model, the unsupervised cognitive model having a first stage and a second stage, the first stage including an encoder designed to learn a fixed-size representation of a given dataset, and the second stage being a clustering stage; and executing the unsupervised cognitive model based on the accessed input dataset, in which the first stage learns a fixed-size representation of the input dataset, and in which the second stage clusters the learned representation to obtain clusters of anomalies; A computer-implemented method comprising:

2. the unsupervised cognitive model is implemented using a composite loss function that combines a first loss function and a second loss function; The computer-implemented method of claim 1 , wherein the first loss function and the second loss function are designed to optimize the representation and the clusters, respectively.

3. 3. The computer-implemented method of claim 2, wherein the first loss function is designed as a triplet loss function that ensures that the representations learned for a reference portion of each of the input datasets are, on average, closer to the representations learned for distinct portions of the respective input datasets than to the representations learned for other portions of other of the input datasets, each of the reference portion, the distinct portions, and the other portions corresponding to a respective time segment.

4. 3. The computer-implemented method of claim 2, wherein the unsupervised cognitive model is performed by alternately and iteratively executing the first stage and the second stage with the aim of reducing the composite loss function, whereby the learned representations and the obtained clusters are alternately optimized over several iterations.

5. The computer-implemented method of claim 4 , wherein the unsupervised cognitive model is executed to achieve predefined structural properties of the clusters.

6. The computer-implemented method of claim 5 , wherein the predefined structural properties are realized based on silhouette scores of the clusters.

7. Each of the iterations In the first stage obtaining a representation of the input dataset; and calculating a first loss using the first loss function based on the obtained representation; In the second stage running a k-means algorithm based on said previously obtained representation; optimizing the number of clusters based on the silhouette scores obtained for the clusters; calculating a second loss according to the second loss function; and calculating a current composite loss based on the first loss and the second loss; and determining whether to stop training by comparing the current composite loss with a previous composite loss obtained during a previous one of the iterations; The computer-implemented method of claim 6, comprising:

8. The computer-implemented method of claim 1 , wherein the encoder is configured as an exponentially expanding causal convolutional neural network.

9. The unsupervised cognitive model is designed as a single network; 9. The computer-implemented method of claim 8, wherein the second stage is implemented by an outer neural layer of the cognitive model, the outer neural layer connected at the output of the first stage.

10. the first stage includes at least two convolution blocks; The computer-implemented method of claim 9 , wherein each of the at least two convolutional blocks includes one or more dilated causal convolutional layers.

11. The computer-implemented method of claim 10 , wherein the first stage further comprises a hierarchy of neural layers disposed at the output of each of the dilated causal convolutional layers.

12. The computer-implemented method of claim 11 , wherein the hierarchy of neural layers includes a weight normalization layer and an activation layer.

13. The computer-implemented method of claim 12 , wherein the activation layer is a leaky rectified linear unit.

14. 13. The computer-implemented method of claim 12, wherein the first stage further comprises a global max pooling layer disposed at the outputs of the at least two convolution blocks.

15. 15. The computer-implemented method of claim 14, wherein the first stage further comprises a linear transformation layer at the output of the global max pooling layer.

16. The computer-implemented method comprises: identifying the type of anomaly corresponding to each of the obtained clusters; The computer-implemented method of claim 1 further comprising:

17. The computer-implemented method comprises:

2. The computer-implemented method of claim 1, further comprising monitoring the computerized system to detect the anomaly prior to accessing the input data set and executing the unsupervised cognitive model.

18. A computer program for clustering detected anomalies in a computerized system, the computer program comprising: One or more computer-readable tangible storage media and program instructions stored on at least one of the one or more tangible storage media, the program instructions being executable by a processor capable of performing a method, the method comprising: accessing input data sets corresponding to detected anomalies of the computerized system, the anomalies spanning respective time windows, each of the corresponding input data sets having a set of time series of key performance indicators spanning a respective one of the time windows; loading an unsupervised cognitive model, the unsupervised cognitive model having a first stage and a second stage, the first stage including an encoder designed to learn a fixed-size representation of a given dataset, and the second stage being a clustering stage; and executing the unsupervised cognitive model based on the accessed input dataset, in which the first stage learns a fixed-size representation of the input dataset, and in which the second stage clusters the learned representation to obtain clusters of anomalies; 1. A computer program comprising:

19. The unsupervised cognitive model includes a composite loss function that combines a first loss function and a second loss function, the first loss function and the second loss function being designed to optimize the representation and the cluster, respectively; and 20. The computer program product of claim 18, which, in operation, performs the first stage and the second stage iteratively to reduce the composite loss function.

20. 20. The computer program product of claim 18, wherein the first loss function is designed as a triplet loss function that ensures that the representations learned for a reference portion of each of the input datasets are, on average, closer to the representations learned for distinct portions of the respective input datasets than to the representations learned for other portions of other of the input datasets, each of the reference portion, the distinct portions, and the other portions corresponding to a respective time segment.

Images