Context-Aware Anomaly Detection

Abstract

A computer-implemented method for context-aware anomaly detection includes receiving a signal containing real-time data, dividing the received signal into a set of training wavelets bounded by respective training contexts, and generating a predictive model for the training context by processing the set of training wavelets through a recurrent neural network to identify patterns in the data sequence for each training wavelet. The method also includes extracting current wavelets from the signal for the current context in response to execution of a current context separate from the training context, and identifying pairwise matches between the same dimensions of the current wavelets and the wavelet patterns of the predictive model by aligning the sequence of current wavelets with the sequence of wavelet patterns of the predictive model. An anomaly is identified when the sum of the cumulative distances between the two sequences is determined to exceed a predetermined threshold.

Description

[Technical field]

[0001] The present disclosure relates to a context-aware anomaly detection system and method, and in particular to a system and method for automatically determining a context for real-time data and detecting anomalies from real-time data arriving from one or more data sources based on the context determination. [Background technology]

[0002] Existing approaches in anomaly detection require users to manually identify the context of real-time data and identify anomalies present therein. It would be desirable to automate the process of context recognition and anomaly detection, thereby reducing the reliance on user-provided classifications and / or identifications. Summary of the Invention

[0003] An embodiment of the present disclosure is provided for a computer-implemented method for context-aware anomaly detection. The method includes receiving a signal including real-time data, dividing the received signal into a set of training wavelets bounded by respective training contexts, and generating a predictive model for the training context by processing the set of training wavelets through a recurrent neural network to identify patterns in a sequence of data for each training wavelet. The method also includes extracting a current wavelet from the signal of the current context in response to execution of a current context separate from the training context, and identifying pair-wise matches between the same dimensions of the current wavelet and the wavelet pattern of the predictive model by aligning the sequence of the current wavelets and the sequence of the wavelet pattern of the predictive model. The method also includes identifying the anomaly in response to determining that a sum of accumulated distances between the two sequences exceeds a predetermined threshold.

[0004] Other embodiments relate to computer program products that utilize the methods described above.

[0005] Another embodiment relates to a computer-implemented method for identifying a context, the method including receiving real-time data of the context over a time period, setting the context to a first level of granularity, partitioning the real-time data into wavelets based on the first level of granularity, and attempting to identify patterns in the wavelets based on dynamic time warping.

[0006] The above summary is not intended to describe each illustrated embodiment or every implementation of the present disclosure.

[0007] The drawings contained in this application are incorporated in and constitute a part of this specification. The drawings illustrate embodiments of the present disclosure and, together with the description, explain the principles of the present disclosure. The drawings are merely illustrative of some embodiments and are not intended to limit the present disclosure. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram of an exemplary recurrent neural network, according to an embodiment. [Diagram 2] 1 is a graph of real-time data for different phases of an example long-running database server, according to an embodiment. [Diagram 3] 1 is a graph of real-time data for different phases of an example long-running database server, according to an embodiment. [Figure 4] 1 is a flowchart illustrating a method for determining a context, according to an embodiment. [Diagram 5] 1 is a graph illustrating a comparison between a wavelet pattern learned using a recurrent neural network and an abnormal wavelet pattern, according to an embodiment. [Figure 6] 1 is a graph illustrating an example of a wavelet pattern changing from a normal state to an abnormal state, according to an embodiment. [Figure 7] FIG. 2 is a block diagram of a processing system, according to an embodiment. [Figure 8] FIG. 1 is a block diagram of an exemplary cloud computing environment having one or more computing nodes with which local computing devices used by a cloud customer communicate, according to an embodiment. [Figure 9] FIG. 1 is a block diagram of a set of functional abstraction layers provided by a cloud computing environment, according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] It should be understood that elements in the figures are illustrated for simplicity and clarity, and that well-known elements that may be useful or necessary in a commercially feasible embodiment may not be shown for simplicity and to aid in understanding the illustrated embodiment.

[0010] The present disclosure relates to methods and systems for context-aware anomaly detection. In some embodiments, a system is provided that is configured to perform real-time anomaly detection and discover these contexts automatically (i.e., without requiring user input).

[0011] Data analytics and data science are getting more and more attention. With the proliferation of Internet of Things (IOT), sensor devices, and the ever-expanding popularity of cloud computing, the quality of data collected in real time from all kinds of components is important for several reasons. One reason is to ensure that the analysis of real-time data produces useful insights and is not misleading. Another reason is that the performance of systems deployed on the cloud can be analyzed based on real-time performance data collected from cloud infrastructure. Therefore, there is an increasing interest in discovering anomalies from real-time data so that erroneous data can be filtered out before insights can be derived from the extensive data. Discovery of anomalies can also be beneficial, thus identifying malfunctioning components of the system and helping to improve the system's performance.

[0012] Some embodiments utilize algorithms based on a combination of deep learning techniques (e.g., recurrent neural networks) and signal processing techniques (dynamic time warping) to train a model for each context and then compare real-time data with predictions from existing models to discover anomalies. Some embodiments also utilize user feedback to dynamically enrich the model, thereby further reducing the false positive rate (i.e., the rate at which anomalies are falsely detected) and the false negative rate.

[0013] In general, in time series analysis, dynamic time warping (DTW) is an algorithm for measuring the similarity between two time series that may differ in speed or duration. DTW has been applied to time series of video, audio, and graphics data, for example. Examples of DTW include speech recognition and signature recognition. However, in a more general sense, DTW can be applied to any data that can be converted into a linear sequence. One of the concepts of DTW is to compare sequences of different lengths, which can be achieved by constructing one-to-many and many-to-one matches, so that the sum of the distances between them can be minimized. In general, DTW is a method of computing the optimal match between two given sequences (e.g., time series) with certain constraints and rules. It should be understood that any suitable DTW technique known to one skilled in the art can be applied to the present embodiment, particularly in the example of real-time data streams associated with software programs running on the cloud, as well as real-time sensor data collected from smart cities.

[0014] In this embodiment, neural networks and other deep learning systems may be utilized to assist in automatic context determination and anomaly detection. An artificial neural network (ANN), more commonly referred to as a neural network, is a computational system consisting of highly interconnected processing elements (nodes) that process information by dynamic state responses to a few simple, external inputs. ANNs are processing devices (algorithms and / or hardware) that loosely mimic the neuronal structure of the mammalian cerebral cortex, but on a much smaller scale. Such systems learn tasks incrementally and autonomously by example, and have been successfully applied, for example, to speech recognition, text processing, and computer vision. While large ANNs may have hundreds to thousands of processing units, mammalian brains have billions of neurons, and the overall scale of neuronal interactions and emergent behavior is correspondingly large.

[0015] Many types of neural networks are known, starting with feedforward neural networks, multi-layer perceptrons, deep learning neural networks (DNNs), and convolutional neural networks. A feedforward neural network is an artificial neural network (ANN) in which the connections between units do not form cycles. A deep learning neural network is an artificial neural network with multiple hidden layers of units between the input and output layers. Like shallow ANNs, DNNs can simulate complex nonlinear relationships. DNN architectures generate synthetic models in which objects are represented as stacks of image primitives, for example for object detection and analysis. Increasing the number of layers allows the synthesis of features from lower layers, giving the ability to simulate complex data with fewer units than a shallow network with comparable performance. DNNs are usually designed as feedforward networks.

[0016] In some embodiments described herein, systems, methods, and computer program products are provided that use big data and artificial intelligence (AI) to facilitate anomaly detection for various real-time sources of big data (e.g., parking occupancy data collected over time via multiple sensors). Machine learning, a subset of AI, utilizes algorithms to learn from data (e.g., big data) and generate predictions based on this data. AI refers to intelligence that allows a machine to make informed decisions that maximize the success rate of a given task. More specifically, AI can learn from a set of data to solve problems and make appropriate recommendations. AI is a subset of cognitive computing, which refers to systems that learn at scale, reason with purpose, and interact naturally with humans. Cognitive computing is a combination of computer science and cognitive science. Cognitive computing utilizes self-taught algorithms that use data, visual recognition, and natural language processing to solve problems and optimize processes.

[0017] As used herein, "big data" refers to data that is characterized in part by a large amount of data (e.g., terabytes, petabytes, etc. in size), a wide variety of data (e.g., including structured data, unstructured data, etc.), and a variety of sources of data. An example of structured data is transactional data in a relational database. Examples of unstructured data include images, email data, sensor data, resource monitoring data, etc. Some examples of sources of big data include banking information, travel information, medical records, geographic information, transportation system data, passenger data, parking occupancy data, resource monitoring data from various tiers of a cloud deployment, etc.

[0018] As used herein, a "smart city" generally refers to a metropolitan area that utilizes various types of big data collected from various citizens, electronic Internet of Things (IoT) sensors, and other devices. The information is processed and analyzed to monitor and manage various aspects of the metropolitan infrastructure, such as traffic and transportation systems, power plants, water networks, waste management, police and fire departments, information systems, schools, libraries, hospitals, and community services. As discussed herein, the data can be used to optimize the efficiency of city operations and services, such as efficient use of parking facilities.

[0019] As used herein, "smart home" generally refers to a building (e.g., office, residence, etc.) that utilizes a variety of data collected from IoT sensors and other devices. Similar to the smart city description above, this information is processed and analyzed to monitor and manage different aspects of the home, for example. This data can be used to monitor and optimize the efficiency of appliances, services, alarm systems, etc.

[0020] In some embodiments utilizing anomaly detection techniques, real-time data arrives from one or more data sources. In these embodiments, learning of the behavior of any event (i.e., context) occurs in real-time. An event may be, for example, a sequence of data occurring over a period of time. In one particular example, an event or context may relate to traffic data for a number of roads in a city over a period of time, which may have a pattern over this period of time. Another example of a context or event may relate to a portion of a running software application, which may track processor usage over time, which may also exhibit patterns. Once a model of a particular event is trained in real-time, the model may be used to predict the behavior of such an event in the future, and the model may be used to identify whether the behavior of the event is normal or abnormal (e.g., whether one or more anomalies exist for a given set of data).

[0021] In some embodiments, the behavior (B) of an event (context) is represented by an n-dimensional signal (captured in real time), where each dimension represents time series data collected from a generator (e.g., the time series data can be associated with different resource usage for an operational process, i.e. it can be data generated from IoT sensors in the case of a smart home or a smart city). In this embodiment, the system can represent the same dimensions of two signals, s i ands j Identify pairwise matching (m) with

[0022] To learn the behavior of each dimension of a signal, the first step is to split the signal into smaller wavelets bounded by their context (events). In general, wavelets are mathematical functions that split data into components with different durations, and then these separate components are examined with a resolution that matches their scale. The basic idea behind wavelets is scale-dependent analysis, and thus wavelet algorithms process data with different scales or resolutions. When a signal is examined with a large "window" (i.e., coarse granularity), gross features can sometimes be recognized. Similarly, when a signal is examined with a small "window" (i.e., fine granularity), small features can be noticed. Thus, the results of wavelet analysis can see not only gross features but also subtle features in a given context (or event).

[0023] In this embodiment, a context is defined depending on the use case. Various methods for discovering the context are described below. Once the context is identified and the signal is divided into smaller wavelets, this embodiment utilizes one or more deep learning techniques (e.g., recurrent neural networks) to learn the patterns of the wavelets.

[0024] Referring now to the drawings, and initially to FIG. 1, wherein like numerals represent the same or similar elements, an example of a recurrent neural network 100 is shown. As discussed above, recurrent neural networks are a technique that allows for the identification of patterns in a sequence of data. After a wavelet is formed by chopping up a real-time signal according to its context, the wavelet is provided as an input to the recurrent neural network 100. The output y for a given resource is j For the generated sequence of inputs for (i.e., n wavelets formed after context decomposition), the input is x for the j-th input. j(j=1,2,...,n). In this example, the corresponding j-th output is calculated using Equation 1 below.

[0025]

number

[0026] Weight matrix (W r ) linearly incorporates the output from the previous step into the current output. In some architectures, there is an input layer 106, a hidden layer 104, and an output layer 102. In this example, the hidden layer 104 is recursively connected to itself. Let h j The equations are expressed as Equation 2, Equation 3, and Equation 4.

[0027]

number

[0028]

number

[0029]

number

[0030] In the above equation, σ is a suitable nonlinearity / transfer function such as a sigmoid. W1 and W2 are the connection weights between the input layer 106 and the hidden layer 104, and between the hidden layer 104 and the output layer 102. W r represents the recurrent weight.

[0031] The workflow of the recurrent neural network 100 is shown in Figure 1. Running the recurrent neural network 100 on n training wavelets produces a predictive model for a given context. This model can be used to predict the behavior of that context the next time it occurs, or to detect anomalies when that context occurs in the future.

[0032] Next, we will discuss anomaly detection using wavelet matching for recurrent neural networks (RNNs). During the execution of a context / event, wavelets may be extracted from the real-time signal of that particular context. Dynamic time warping (DTW) is then used to identify a match between the current wavelet and the wavelet pattern learned from the past executions of the context. As mentioned above, DTW is a set of signal processing techniques or algorithms to measure the similarity between two time series that may differ in speed and duration. During the matching calculation between two wavelets, both wavelets will have d data points. In one example, wavelet T i and P i is composed of the following sampling values ​​represented by Equation 5 and Equation 6.

[0033]

number

[0034]

number

[0035] To align these two sequences using DTW, we first construct a d × d matrix, where the (i,j)th element of the matrix represents the vertex at point t i andp j The squared distance between the alignment, d(t i ,pj )=(t i ,p j ) 2 To find the best match between these two sequences, the matrix is ​​searched for a path that minimizes the sum of the cumulative distances between the two sequences. In particular, the best path is the path that minimizes the warping cost, which is given by Equation 7.

[0036]

number

[0037] In Equation 7, w k is the matrix element (i,j) that belongs to the k-th element of the warping path W. k where T is a successive set of matrix elements that represent the mapping between T and P. This warping path can be found using dynamic programming, which evaluates the following recurrence formula, shown in Equation 8:

[0038]

number

[0039] In Equation 8, d(i,j) is the distance found in the current cell, γ(i,j) is the cumulative distance of d(i,j), and min{γ(i-1,j-1),γ(i-1,j),γ(i,j-1)} is the minimum cumulative distance from the three neighboring cells. At the end of the DTW algorithm, we find the minimum distance dist that stretches T to P. min is determined. The smaller the distance, the more similar the signals are.

[0040] In some embodiments, there is a pre-defined threshold that is set for finding a match between two wavelets, and in some embodiments, this threshold can be continually changed based on feedback from the user.

[0041] In some embodiments, automatic context discovery is utilized for software context. In these embodiments, boundaries may be placed on the real-time data to extract wavelets from the real-time resource usage data of the running server software. Servers deployed on the cloud go through different phases. Now referring to FIG. 2, this figure shows an example of different phases of a long-running HBase database server 200. FIG. 3 shows an example of different phases of a long-running MongoDB database server 300. Both FIG. 2 and FIG. 3 show CPU usage traces of these two servers sampled at a frequency of 100 Hz, capturing stack traces of different functions that the workloads are performing. CPU traces are captured while three different workloads (see FIG. 2 elements 202, 204, 206 and FIG. 3 elements 302, 304, 306) are running on these two servers (see FIG. 2 HBase database server 200 and FIG. 3 MongoDB database server 300).

[0042] 2 and 3 show two interesting facts. First, when the workload is executed, both servers go through two major phases: an idle phase (see FIG. 2, element 208, and FIG. 3, element 308) and a busy phase (see FIG. 2, element 210, and FIG. 3, element 310). Also, within these two major phases, there are micro-phases. For example, during the idle phase of both servers, there are occasional spikes in CPU utilization, indicating that some work is being done by the servers. The work being done depending on the server may be different. Second, for the same workload, the CPU utilization of different servers is different. For example, for the same workload 1, the CPU utilization pattern of HBase database server 200 is different from that of MongoDB database server 300. The present embodiment identifies phase boundaries (contexts) from the time series data of CPU utilization so that the recurrent patterns of the phases can be learned using a recurrent neural network, as described above.

[0043] In this embodiment, automatic identification of phase boundaries may be determined by utilizing program snapshots. In some embodiments, the program snapshot(s) at a given time is defined by the following tuple, represented by Equation 9:

[0044]

number

[0045] In Equation 9, t is the thread dump, c is the CPU usage, and m is the memory usage of the program at a given time. Based on this snapshot definition, a phase p of a program can be defined by the following tuple, represented by Equation 10:

[0046]

number

[0047] The present embodiment may identify phase changes during application execution using periodically collected snapshots. In some examples, a phase change is detected when there is a significant change in two consecutively collected snapshots of a program. A sliding window based approach is utilized for program snapshot change detection. During analysis, phases of the application are identified online and thread dumps of a sliding window of size w are collected. Each window of w thread dumps has a set of w three-dimensional data points. In this example, the three dimensions are the set of functions in the thread dump, CPU usage, and memory consumption. To convert the set of functions in the thread dump of an application into real numbers so that it can be used to identify phase changes, a metric expressed by the following Equation 11 is utilized.

[0048]

number

[0049] Metric stack sim is the current state of the program (t cur ) is a set of previously observed functions (t prev ) for each of the following reasons: sim =1.0 stack sim The value indicates that there was no change, and the stack sim A value <1.0 indicates that the stack trace contents have changed.

[0050] Stack at the current time quantum simAfter computing the values, a complete representation of the program's snapshot at its quantum is generated, with all dimensions in the real domain. For phase change detection, the present embodiment mathematically determines whether the current snapshot is an outlier in a window of w last collected snapshots. In some embodiments, a technique based on Principal Component Analysis (PCA) is used to determine whether the current snapshot is an outlier. The outlier identifies the phase change and provides a boundary within which the real-time signal must be confined to identify the context.

[0051] In some of the above embodiments, automatic context discovery and anomaly detection is used for software context. However, in other embodiments, automatic context discovery and anomaly detection is used for real-time sensor data in a smart city use case. In one example of real-time data from a smart city, the data is vehicle occupancy collected via sensors from parking lots at various locations throughout the smart city. However, it should be understood that parking lot data is only one example of smart city data and other sources of data may be used. In this example, the parking data for each garage (i) consists of (m) months of data and is represented by the following Equation 12:

[0052]

number

[0053] Each set of monthly parking data mon i j has (d) sets of data points depending on the number of days that month has. The format of the monthly data is given by Equation 13.

[0054]

number

[0055] Finally, in this example, if the data is collected in real time at 5-minute intervals, then each aggregate day k has w<=288 data points. To discover the context of real-time sensor data, context discovery starts with a coarse granularity and then a search is performed at a finer granularity for repeating patterns of wavelets.

[0056] 4, an exemplary method 400 for determining patterns in real-time data is shown. In operation 402, the context is set to the coarsest granularity (e.g., months in this particular use case), and then in operation 404, the signal is split into wavelets according to that context. Then, in operation 406, a dynamic time warping method is used to check whether there are patterns in those wavelets. If there are patterns (operation 406: YES), the context discovery system stops in operation 412. If no patterns are found, the system determines whether there is a finer level of granularity that can be applied to split the wavelets in operation 408. If there is a finer level of granularity available (operation 408: YES), the process increases the level of granularity (sets the granularity finer) in operation 410, and then returns to operation 404 to continue its search at the next level of finer granularity (e.g., weeks). At this stage, method 400 again searches for patterns repeatedly for the same time range of data, for example, for all combinations of series of weeks (i.e., not months). Since this search is highly parallelizable, searches (i.e., different searches of different granularity) can be performed in parallel, significantly reducing the overall processing time. For example, to find repeating patterns in a weekly context, given a week index w={1,2,3,4}, the signal can be divided into the following wavelets: In the example of analyzing data from 4 months of real-time data, the indices forming the wavelets for pattern discovery can be represented by Equation 14 and Equation 15.

[0057]

number

[0058]

number

[0059] In some embodiments, all such combinations are searched for lengths up to (n-1) if there are n finer contexts. Thus, in this case, the search is done for {w1,w2,w3}, {w2,w3,w4}, {w1,w3,w4} for the full four months (i.e., in this case n=4). The search then continues for finer contexts (day, hour) in a similar manner. Once the search is completed for all patterns in all contexts (i.e., until the finest level of granularity is reached, e.g., hourly in this use case), the process ends at operation 412 and the match values ​​are ranked. The top match values ​​are then designated as the discovered recurring patterns. In some embodiments, the system may be retrained from time to time to discover new patterns as new real-time data arrives.

[0060] By using context information on top of real-time data, the present embodiment may successfully identify anomalies in both software application workload data and smart city data. Although examples of software data and smart city data are described above, the present embodiment may be applied to other suitable sources of real-time data. Experiments were conducted to analyze several popular software programs used in the cloud (e.g., Cassandra®, MongoDB®, Spark®, etc.) and identify context within them. These experiments showed that context-aware anomaly detection is capable of identifying significant anomalies with 100% accuracy and less than 10% false positives.

[0061] Referring now to FIG. 5, this figure shows an example of such wavelets learned from the context during the execution of a workload on a Cassandra® database server. The predicted wavelets (i.e., the darkest black line) show the pattern learned using a recurrent neural network, while the abnormal execution state (i.e., the lightest gray line) shows the abnormal execution state caused by a failed disk. As a result, FIG. 5 shows a visible difference between the learned pattern and the abnormal execution state. The significant difference in the DTW values ​​confirms the agreement between the visual inspection and the anomalies automatically detected by the method of the present embodiment.

[0062] Detected anomalies may be automatically removed from the data, advantageously removing their impact from automated or human-determined insights from the data. In some embodiments, after detecting an anomaly, the system may alert a user to the anomaly. This may be in addition to or instead of deleting the anomalous data. The user may then decide what to do (e.g., delete the anomalous data, determine if it is due to a failed component, etc.).

[0063] Now referring to FIG. 6, this figure shows an example of real-time parking data collected from a garage where the context was found as a weekday. The gray part of the figure shows 2.5 days of abnormal wavelets in real time. Visual inspection confirms the presence of anomalies, as these two days of data show an upward trend of local minima compared to historical data. Using the context-sensitive anomaly detection method of the present embodiment, results of up to 40% (or more) improvement in prediction accuracy and up to 50% (or more) reduction in the amount of false positives detected can be achieved compared to existing anomaly detection methods. In some embodiments, the sensitivity to anomaly detection can be adjusted to be either more aggressive or more lenient based on user feedback.

[0064] In the present embodiment, details of automatically identifying context in real-time data have been described in two scenarios: a method for discovering context in the case of a software program running on a cloud, and a method for discovering context in the case of real-time sensor data collected from a smart city. Adding the discovered context contributes to improving prediction accuracy and also reduces the amount of false positives detected (i.e., compared to existing methods that do not consider context). Furthermore, adding the discovered context may contribute to reducing resource usage of the anomaly detection system (e.g., by increasing accuracy, the amount of unnecessary confirmation or correction is reduced). It should be understood that the present embodiment is not limited to the example of software running in a cloud environment or data collection in a smart city, and the present embodiment may be applied to any suitable example of real-time data supply.

[0065] 7, an exemplary processing system 500 to which the present embodiments may be applied is shown according to one embodiment. The processing system 500 includes at least one processor (CPU) 504 operably coupled to other components via a system bus 502. Operatively coupled to the system bus 502 are a cache 506, a read only memory (ROM) 508, a random access memory (RAM) 510, an input / output (I / O) adapter 520, a sound adapter 530, a network adapter 540, a user interface adapter 550, and a display adapter 560.

[0066] A first storage device 522 and a second storage device 524 are operably coupled to the system bus 502 by an I / O adapter 520. The storage devices 522 and 524 may be disk storage devices (e.g., magnetic disk storage devices, optical disk storage devices), solid-state magnetic devices, etc. The storage devices 522 and 524 may be the same type of storage device or different types of storage devices.

[0067] The speakers 532 are operably coupled to the system bus 502 by a sound adapter 530. The transceiver 542 is operably coupled to the system bus 502 by a network adapter 540. The display device 562 is operably coupled to the system bus 502 by a display adapter 560.

[0068] A first user input device 552, a second user input device 554, and a third user input device 556 are operably coupled to the system bus 502 by a user interface adapter 550. The user input devices 552, 554, and 556 may be a keyboard, a mouse, a keypad, an image capture device, a motion sensing device, a microphone, a device incorporating the functionality of at least two of the foregoing devices, or any other suitable type of input device. The user input devices 552, 554, and 556 may be the same type of user input device or may be different types of user input devices. The user input devices 552, 554, and 556 are used to input and output information to and from the system 500. In some embodiments, a neural network component 590 with context and anomaly detection modes is operably coupled to the system bus 502.

[0069] Processing system 500 may include other elements (not shown), as well as omit some elements, as would be readily contemplated by one of ordinary skill in the art. For example, various other input and / or output devices may be included in processing system 500, depending on the particular implementation of processing system 500, as would be readily understood by one of ordinary skill in the art. For example, various types of wireless and / or wired input and / or output devices may be used. Additionally, various configurations of additional processors, controllers, memory, etc. may be utilized, as would be readily understood by one of ordinary skill in the art. These and other variations of processing system 500 are readily contemplated by one of ordinary skill in the art given the teachings of the disclosure provided herein.

[0070] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment. Rather, embodiments of the invention may be implemented in conjunction with any other type of computing environment now known or developed in the future.

[0071] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or collaboration with the provider of the service. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0072] Its features are as follows.

[0073] On-Demand Self-Service: Cloud consumers can automatically and unilaterally provision computing capacity, such as server time or network storage, as they need it, without requiring human interaction with the provider of the service.

[0074] Pervasive Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin- or thick-client platforms (e.g., cell phones, laptops, and PDAs).

[0075] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with various physical and virtual resources dynamically allocated and reallocated according to demand. Consumers are generally said to be location independent in the sense that they have no control or knowledge of the exact location of the resources provided to them, although they may be able to specify location at a higher level of abstraction (e.g., country, state, or data center).

[0076] Rapid Elasticity: Capacity can be rapidly and elastically provisioned, sometimes automatically, rapidly scaled out, and rapidly released to rapidly scale in. To the consumer, the capacity available for provisioning often appears unlimited, and any quantity can be purchased at any time.

[0077] Measured Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being utilized.

[0078] The service model is as follows:

[0079] Software as a Service (SaaS): The capability offered to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or individual application features, with the expected exception of limited user-specific application configuration settings.

[0080] Platform as a Service (PaaS): The ability provided to a consumer is to deploy applications that the consumer has created or acquired, generated using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration.

[0081] Infrastructure as a Service (IaaS): The ability provided to a consumer is to provision processing, storage, network, and other basic computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over the operating systems, storage, deployed applications, and possibly limited control over the selection of networking components (e.g., host firewalls).

[0082] The deployment model is as follows:

[0083] Private Cloud: The cloud infrastructure is operated solely for one organization and may be managed by that organization or a third party and may reside on-premise or off-premise.

[0084] Community Cloud: Cloud infrastructure is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). It may be managed by the organizations or a third party and may reside on-premise or off-premise.

[0085] Public Cloud: Cloud infrastructure is made available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0086] Hybrid Cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique entities but are joined by standard or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0087] Cloud computing environments are service-oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0088] Referring now to FIG. 8, an exemplary cloud computing environment 650 is depicted. As shown, the cloud computing environment 650 includes one or more cloud computing nodes 610 with which local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or cell phone 654A, a desktop computer 654B, a laptop computer 654C, or an automobile computer system 654N, or combinations thereof, may communicate. The nodes 610 may communicate with each other. They may be physically or virtually grouped in one or more networks (not shown), such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as described herein above. This enables the cloud computing environment 650 to provide infrastructure, platform, and / or software as a service without the cloud consumer having to maintain resources on a local computing device. It should be understood that the types of computing devices 654A-654N shown in FIG. 6 are intended to be illustrative only, and that the computing node 610 and cloud computing environment 650 can communicate with any type of computerized device via any type of network and / or network-addressable connections (e.g., using a web browser).

[0089] 9, a set of functional abstraction layers provided by cloud computing environment 650 (FIG. 8) is shown. It should be understood that the components, layers, and functions shown in FIG. 9 are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0090] Hardware and software layer 760 includes hardware and software components. Examples of hardware components include mainframe 761, RISC (Reduced Instruction Set Computer) architecture based servers 762, servers 763, blade servers 764, storage devices 765, and networks and networking components 766. In some embodiments, software components include network application server software 767 and database software 768.

[0091] The virtualization layer 770 provides an abstraction layer over which the following examples of virtual entities may be provided: virtual servers 771, virtual storage 772, virtual networks including virtual private networks 773, virtual applications and operating systems 774, and virtual clients 775.

[0092] In one example, the management layer 780 may provide the functionality described below. Resource provisioning 781 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 782 provides cost tracking as resources are utilized within the cloud computing environment and charging or billing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal 783 provides access to the cloud computing environment for consumers and system administrators. Service level management 784 provides allocation and management of cloud computing resources such that requested service levels are met. Service level agreement (SLA) planning and fulfillment 785 provides pre-arrangement and procurement of cloud computing resources in anticipation of future demand in accordance with SLAs.

[0093] The workload layer 790 provides examples of functionality for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this layer include mapping and navigation 791, software development and lifecycle management 792, virtual classroom instructional delivery 793, data analytics processing 794, transaction processing 795, and neural network anomaly detection training processing 796.

[0094] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail integration. The computer program product may include a computer readable storage medium having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.

[0095] A computer readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer readable storage media is not to be construed as being, in itself, a transient signal, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through electrical wires.

[0096] The computer readable program instructions described herein may be downloaded from a computer readable storage medium into each computing / processing device or to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may comprise copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0097] The computer readable program instructions for carrying out the operations of the present invention may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine language instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or procedural programming languages, such as object oriented programming languages, such as Smalltalk®, C++®, and the like, and procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a standalone software package, partly on the user's computer and partly on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, such as a local area network (LAN) or wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to perform aspects of the invention.

[0098] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0099] These computer readable program instructions may be provided to a processor of a computer, or other programmable data processing device, to manufacture a machine such that the instructions, executing via the processor of the computer or other programmable data processing device, generate means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions, which may direct a computer, programmable data processing device, or other device, or combination thereof, to function in a particular manner, may also be stored on a computer readable storage medium, such that a computer readable storage medium having instructions stored therein includes an article of manufacture including instructions for performing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0100] The computer readable program instructions also include The instructions, which execute on a computer, other programmable apparatus, or other device, perform the functions / acts specified in one or more blocks in the flowcharts and / or block diagrams. loaded onto a computer, other programmable data processing equipment, or other device, causing a series of operational steps to be performed on a computer, other programmable equipment, or other device; A computer-implemented process may be generated.

[0101] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur in a different order than that noted in the figures. For example, two blocks shown in succession may in fact be executed simultaneously, substantially simultaneously, partially or fully overlapping in time as one step, or the blocks may sometimes be executed in reverse order depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a special purpose hardware-based system that performs the specified functions.

[0102] The description of various embodiments is presented for illustrative purposes and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications or technical improvements to the technology found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A computer-implemented method for context aware anomaly detection, comprising: Receiving a signal including real-time data; partitioning the received signal into a set of training wavelets bounded by their respective training contexts; generating a predictive model for the training context by processing the set of training wavelets through a recurrent neural network to identify patterns in a sequence of data for each training wavelet; extracting a current wavelet from a signal of a current context in response to execution of the current context separate from the training context; aligning the sequence of the current wavelets with a sequence of wavelet patterns of the predictive model to identify pairwise matches between the same dimensions of the current wavelets and the wavelet patterns of the predictive model; identifying an anomaly in response to determining that a sum of cumulative distances between the two sequences exceeds a predetermined threshold; A method comprising:

2. 2. The method of claim 1, wherein the real-time data is received from a plurality of data sources represented by signals captured in real time having n dimensions, where each dimension represents collected time series data.

3. The n-th dimension is The set of functions in the thread dump, CPU usage rate, Memory consumption and The method of claim 2 , comprising:

4. The method of claim 1 , wherein the training context is identified by phase changes during application execution using periodically collected snapshots.

5. 5. The method of claim 4, wherein the phase change is detected when there is a change between two successively acquired snapshots of the program that exceeds a threshold change.

6. The method of claim 4 , wherein a sliding window approach is utilized to detect the phase change.

7. identifying said pairwise matches, constructing a d×d matrix using d data points from each of the current wavelets, where each element of the matrix is ​​a squared distance, d(t i , p j )=(t i , p j ) ２ constructing said d×d matrix representing the alignment between points ti and pj corresponding to identifying an optimal match between the two sequences by searching an optimal path through the d×d matrix that minimizes the sum of cumulative distances between the two sequences; The method of claim 1 , comprising:

8. W ｋ Let us denote by matrix element (i, j) that also belongs to the k-th element of warping pass W, which is a consecutive set of matrix elements that represent the mapping between T and P. ｋ and the optimal route is [0010] The method of claim 7, wherein the search is performed by the matrix that minimizes a warping cost represented by:

9. Let d(i,j) be the distance found in the current cell, γ(i,j) be the cumulative distance of d(i,j), and min{γ(i-1,j-1), γ(i-1,j), γ(i,j-1)} be the minimum cumulative distance from the three adjacent cells, and the warping pass is [0025] The method of claim 8 , wherein the vectors are determined using dynamic programming that evaluates a recurrence formula represented by:

10. The method of claim 1 , wherein the predetermined threshold is configurable based on user input.

11. 1. A computer program for context aware anomaly detection, comprising: The computer program includes: Receiving a signal including real-time data; partitioning the received signal into a set of training wavelets bounded by their respective training contexts; generating a predictive model for the training context by processing the set of training wavelets through a recurrent neural network to identify patterns in a sequence of data for each training wavelet; extracting a current wavelet from a signal of a current context in response to execution of the current context separate from the training context; aligning the sequence of the current wavelets with a sequence of wavelet patterns of the predictive model to identify pairwise matches between the same dimensions of the current wavelets and the wavelet patterns of the predictive model; identifying an anomaly in response to determining that a sum of the cumulative distances between the two sequences exceeds a predetermined threshold; A computer program that executes the following:

12. 12. The computer program product of claim 11, wherein the real-time data is received from a plurality of data sources represented by signals captured in real-time having n dimensions, where each dimension represents collected time series data.

13. The n-th dimension is The set of functions in the thread dump, CPU usage rate, Memory consumption and 13. The computer program product of claim 12, comprising:

14. 12. The computer program product of claim 11, wherein the training context is identified by phase changes during application execution using periodically collected snapshots.

15. 15. The computer program product of claim 14, wherein the phase change is detected when there is a change between two successively collected snapshots of the program that exceeds a threshold change.

16. The computer program product of claim 14 , wherein a sliding window approach is utilized to detect the phase change.

17. identifying said pairwise matches, constructing a d×d matrix using d data points from each of the current wavelets, where each element of the matrix is ​​a squared distance, d(t i , p j )=(t i , p j ) ２ constructing said d×d matrix representing the alignment between points ti and pj corresponding to identifying an optimal match between the two sequences by searching an optimal path through the d×d matrix that minimizes the sum of cumulative distances between the two sequences; 12. The computer program product of claim 11 , comprising:

18. The computer program product of claim 11 , wherein the predetermined threshold is configurable based on user input.

19. 1. A computer-implemented method for identifying a context, comprising: receiving real-time data of the context over a period of time; setting the context to a first level of granularity; partitioning the real-time data into wavelets based on the first level of granularity; Attempting to identify patterns in the wavelets based on dynamic time warping; A method comprising:

20. Upon determining that a pattern in the wavelet has not been identified, setting the context to a second level of granularity that is finer than the first level of granularity; splitting the real-time data into wavelets based on the second level of granularity; attempting to identify the pattern in the wavelets based on the dynamic time warping method; 20. The computer-implemented method of claim 19, further comprising:

21. one or more processors; a computer readable memory coupled to said processor, said computer readable memory containing instructions which, when executed by said processor, perform operations of the method of any of claims 1 to 10 and 19 to 20; A computer system comprising:

Images