Cross-environment event correlation using domain space exploration and machine learning techniques

Abstract

A computer-implemented method for cross-environment event correlation includes determining one or more correlated events for issues across multiple domains. Extracting knowledge data from the issues determined from the one or more correlated events is performed. A correlation graph is generated from the extracted knowledge to trace the issues, and the correlated events are grouped into one or more event groups to represent their relationship to the issues. Based on the generated correlation graph, a logical inference description is constructed for domain space exploration related to how an issue in one domain affects another domain among the multiple domains. For one or more event groups of correlated events, an explanation for the cause of the issue is provided based on the logical inference description.

Description

[Technical field]

[0001] The present disclosure relates generally to event correlation in multi-domain operations, and more particularly to systems and methods for cross-environment event correlation for multi-domain operations. [Background technology]

[0002] As information technology (IT) environments become more complex, there is increasing interaction between different domains in a multi-domain computing environment. As a result of such interactions, problems in one domain can affect the operation of other domains. Events or changes originating in one of the domains are often made and reviewed independently, even though other domains may be affected by the events or changes.

[0003] For example, a rule or policy change made in one domain can cause problems, glitches, or incidents in the operation of network equipment in other domains that are not easily discovered. An issue in a storage server can adversely affect applications running in other domains when cross-domain communication is required. Events in different domains may be seemingly unrelated, which can prolong debugging an issue. It is also difficult to understand the risk posed to other domains when a change or problem occurs. Summary of the Invention

[0004] According to one embodiment, a computer-implemented method for cross-environment event correlation includes an operation of determining one or more correlated events for issues across multiple domains. An operation is performed in which knowledge data of the determined issues is extracted from the one or more correlated events. A correlation graph is issued from the extracted knowledge data to trace the issues, and correlated events are grouped into one or more event groups to represent relationships with the issues. Based on the generated correlation graph, a logical inference statement is constructed for a domain space exploration relating to how an issue in one domain affects another of the multiple domains. Based on the logical inference statement, an explanation is provided for the one or more correlated events regarding the cause of the issue. Identifying and explaining the cause of the issue facilitates diagnosis and corrective measures to address the issue.

[0005] In one embodiment, extracting knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data, and machine learning is utilized to determine correlated events for issues across multiple domains based on historical or synthetic data. Machine learning can be used to discover event correlations that may otherwise be overlooked, and can reduce the time to diagnose and explain the causes of issues, especially across multiple domains.

[0006] In one embodiment, the use of machine learning includes learning through unsupervised learning techniques using association rule learning algorithms or clustering algorithms. Unsupervised learning techniques are particularly useful for discovering correlations that may not have been detected otherwise.

[0007] In one embodiment, the use of machine learning includes learning by supervised learning techniques using labeled data related to data correlations. The use of supervised learning techniques can be used to direct the determination of correlated events to obtain more efficient results.

[0008] In one embodiment, the use of machine learning includes supervised learning techniques using Support Vector Machines (SVM), Convolutional Neural Networks (CNN), or Long Short-Term Memory (LSTM) based on the size of the correlation data. Using SVM, CNN, and LSTM can increase the correlation of events.

[0009] In one embodiment, the most probable event group among the correlated events of one or more event groups is recommended to the user based on the logical reasoning description, together with an explanation of the cause of the problem. The recommended probable event group is efficient.

[0010] In one embodiment, the recommendation of the most probable event group of correlated events along with the explanation of the cause of the issue is based on a logical inference description that includes run-time create, read, update, and delete (CRUD) operations on data, allowing for a more dynamic recommendation of the most probable event group than collecting data from logs.

[0011] In one embodiment, the use of machine learning includes receiving training operations based on the feedback to train for determining one or more correlated events.

[0012] In one embodiment, feedback is received to determine one or more correlated events via an active learning methodology, interactively querying a user or another information source, and labeling new data points with the desired output. Feedback provides an advantage in machine learning training operations.

[0013] In one embodiment, one or more semantic relationships are established between multiple domains, which has advantages in determining correlated events.

[0014] In one embodiment, determining one or more correlated events for an issue includes collecting one or more events, logs, or change records from at least a portion of a plurality of domains. The one or more correlated events for an issue are determined by using machine learning techniques. A normalized format of the collected one or more events, logs, or change records is created. The normalized format enhances cross-domain event correlation.

[0015] In one embodiment, the collection of events, logs, metrics, or change records is performed offline by using synthetic simulation.

[0016] In one embodiment, the collection of events, logs, metrics, or change records is performed offline by using historical data.

[0017] A non-transitory computer readable storage medium tangibly embodying computer readable program code having computer readable instructions that, when executed, cause a computing device to perform a method of cross-environment event correlation, the method including determining one or more correlated events for a problem across multiple domains. Knowledge data of the problem is extracted from the one or more correlated events. A correlation graph of the extracted knowledge data is generated to trace the problem and group the correlated events into one or more event groups. Based on the generated correlation graph, a logical inference statement is constructed for a domain space exploration relating to how a problem in one domain affects another of the multiple domains. Based on the logical inference statement, an explanation regarding the cause of the problem is provided to the one or more correlated event groups. Identifying and explaining the cause of the problem facilitates diagnosis and corrective measures to address the problem.

[0018] In one embodiment, a computing device for cross-environment event correlation using spatial exploration includes a processor and a memory coupled to the processor. The memory stores instructions for causing the processor to perform operations including: determining one or more correlated events for an issue across multiple domains; extracting knowledge data of the issue determined from the one or more correlated events; constructing a logical inference description for a domain spatial exploration on how an issue in one domain affects another domain of the multiple domains; generating one or more correlation graphs, tracing the issue, and grouping the correlated events into one or more groups based on the domain spatial exploration; constructing semantic relationships between the different domains; and recommending a most probable event group of the correlated events with an explanation for the cause of the issue based on the logical inference description. Monitoring of events from different domains can be performed to understand the risk associated with changes or mutations in one domain and the impact on other domains.

[0019] In one embodiment, extracting the knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data, and the processor is configured to perform machine learning of cross-environment event correlation for the challenge.

[0020] These and other features will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings.

[0021] The drawings are of exemplary embodiments. Not all embodiments are illustrated. Other embodiments may be used in addition or instead. To save space or for a more effective explanation, details that may be obvious or unnecessary may be omitted. Some embodiments may be practiced with additional components or steps, or without all components or steps shown, or both. When the same numeral appears in different drawings, it refers to the same or similar components or steps. [Brief description of the drawings]

[0022] [Figure 1] 1 is an architectural overview of a system for cross-environment event correlation, consistent with an illustrative embodiment. [Diagram 2] FIG. 1 is a system flow diagram for cross-environment event correlation using domain space searching, consistent with an illustrative embodiment. [Diagram 3] FIG. 1 illustrates a problem scenario in a cloud-native environment that is addressed in this disclosure. [Figure 4] FIG. 2 illustrates another problem scenario in a hybrid cloud environment that is addressed in the present disclosure. [Diagram 5] FIG. 13 is a diagram illustrating domain space operations, consistent with an illustrative embodiment. [Figure 6] 1 is a diagram illustrating construction of a correlation graph, consistent with an illustrative embodiment. [Figure 7] 11 is a screenshot used in constructing a logical inference statement, consistent with an illustrative embodiment; [Figure 8] 1 is a flowchart of a computer-implemented method for cross-environment event correlation, consistent with an illustrative embodiment. [Figure 9] FIG. 1 is a functional block diagram of a specially configured computer hardware platform capable of communicating with various networked components consistent with an exemplary embodiment. [Figure 10]FIG. 1 illustrates an exemplary cloud computing environment that utilizes cloud computing. [Figure 11] FIG. 1 illustrates a series of functional abstraction layers provided by a cloud computing environment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] In the following detailed description, numerous specific details are set forth by way of example in order to provide a thorough understanding of the relevant teachings. It should be understood, however, that the present teachings may be practiced without such details. In other instances, well-known methods, procedures, components, or circuits, or combinations thereof, have been described at a relatively high level, without detail, in order to avoid unnecessarily obscuring aspects of the present teachings.

[0024] The present disclosure provides a computer-implemented method and system for cross-environment correlation. In a multi-domain environment, events or changes originating from different domains are typically reviewed independently without correlation with upstream or downstream relevance. The term "issue" as used herein includes a problem or incident in a multi-domain environment. Thus, a network device issue (e.g., down or rule / policy change) in the communication path between two applications can significantly impact performance and even disable communication. Also, as an example, an issue (scalability change, bandwidth change, authentication change, etc.) with a storage server attached as a Kubernetes persistent volume can significantly impact the execution of applications and / or the scalability of the Kubernetes persistent volume of the cluster to grow while maintaining service level goals. Debugging an issue based on an event in one domain can vary greatly in both time and complexity when the issue impacts other domains, as the events may not be co-related and / or the expertise in the other domains may not be at the level of expertise in the domain where the event occurred. The computer-implemented methods and systems of the present disclosure can enable monitoring of events from different domains and provide an understanding of the risks associated with changes or mutations in one domain and their impact on other domains.

[0025] In this specification, we use the terms "semantic knowledge" and "meta-knowledge." Although there is overlap between the two terms, semantic knowledge includes knowledge about words or phrases and can include concepts, facts, and ideas. Meta-knowledge is preselected knowledge or knowledge about content, including tagging, planning, modeling, and learning modifications of the domain language.

[0026] Additionally, computer-implemented systems and methods according to the present disclosure provide improvements in at least the area of ​​operational monitoring and risk assessment of multi-domain computing environments and the interrelated impacts that different domains have on one another. Additionally, computer-implemented methods and systems according to the present disclosure provide improved efficiency of computer operations, for example, by using machine learning to monitor and assess cross-environment correlations, thereby increasing reliability and reducing or eliminating operational degradation in one or more domains due to issues in another domain.

[0027] <Architecture example> FIG. 1 is an overview of an architecture 100 of a system for cross-environment event correlation, consistent with an exemplary embodiment. As indicated in brackets offline 105, some of the operations may be performed with the system offline, which may include data mining by collecting events, logs, metrics, or change records from various domains, for example, using synthetic simulations or historical data. Non-limiting examples of domains 107 are shown from which historical data may be obtained. A normalized format may be generated from the obtained data. There may be machine learning of correlated events 108 across domains and explanations for the cause of issues, for example, based on analysis of the issues.

[0028] Continuing with reference to FIG. 1, semantic or meta-knowledge 110 is extracted from the acquired data and a correlation graph (e.g., knowledge graph) is generated to trace correlated issues to aid in event grouping. A domain space exploration 115 is performed to build logical inference statements for the domain space exploration. Correlated issues are traced to aid in event grouping.

[0029] Under the brackets labeled "Online" 120 are several runtime features. For example, at runtime there may be create / read / update / delete (CRUD) operations for cross-domain correlation of events, or returning events grouped with explanations regarding the cause of the issue. In one embodiment, there are physical servers 125 coupled with persistent storage (e.g., Kubernetes layer) coupled with pods. Optionally, a system reliability engineer 130 can provide feedback on the training operations.

[0030] 2 is a system flow diagram 200 for cross-environment event correlation using domain space searching, consistent with an example embodiment. In operation 205, data from various domains is collected, for example, in the form of events, logs, metrics, change records, etc. This data can be used to generate a normalized format.

[0031] In operation 210, there is learning of correlated events occurring across the domain using machine learning techniques. As discussed herein, machine learning may be based on supervised or unsupervised training. For example, correlated events can be identified for grouping into one or more correlated groups with confidence. In unsupervised learning, there may be frequency-based approaches such as association rule learning algorithms. Additionally, similarity-based approaches such as clustering algorithms can be used with association rule learning algorithms. In supervised learning techniques, labels may be created with the use of labeled data associated with data correlations or data correlations. As an example, problem incidents may be identified with tickets that contain multiple events that are closed together. Also, if the size of the data is relatively small, traditional machine learning algorithms such as support vector machines (SVN) can be used for classification. For big data, deep learning algorithms such as convolutional neural networks (CNN), long short-term memory (LSTM), etc. can be used.

[0032] In operation 215, meta-knowledge (or semantic knowledge) extraction is performed to generate a correlation graph (e.g., knowledge graph 217) that is used to trace correlated issues for event groupings. Meta-knowledge can be extracted in many ways, for example, by reading tags, extracting quantitative data sets, using information extraction (IE) systems, or event-based information extraction software. In operation 220, logical inference statements are constructed from domain space exploration. For example, domain space exploration can involve operations such as analyzing historical data to explore attributes that occur in each domain, linking relationships between entities (e.g., entity linking), extracting knowledge bases, and constructing knowledge graphs. Correlation of events of similar cluster types can also be based on temporal and spatial information.

[0033] At operation 225, during runtime, event correlation is performed to identify groups of events and return grouped events with an explanation of the cause of the issue. The operations used to identify and return grouped events with an explanation of the cause of the issue include performing operations such as create / read / update / delete (known in the art as "CRUD"). Then, at operation 230, feedback to capture knowledge of correlated events can be provided to correlated event machine learning 210 based on capturing and analyzing real-time data. The feedback can be generated by an active learning approach that interactively queries a user or another source of information and labels new data points with the desired output to determine one or more correlated events. Optionally, a site reliability engineer (SRE) or subject matter expert (SME) can supplement the feedback.

[0034] Figure 3 illustrates an example of a problem scenario 300 in a cloud-native environment that is addressed in this disclosure. Figure 3 lists the environment's state today 305, state tomorrow 310, symptoms 315, and cross-environment correlations. A schematic diagram 325 of the environment is also shown.

[0035] In the “Today” 305 state, application “172.1.1.1” running on VM 10.1.2.1 is hosted on physical server 9.1.1.1. Application 172.1.1.1 is able to communicate with another application “postgres172.1.2.1” hosted by another physical server 9.1.2.1. However, in the “Tomorrow” 310 state, a router 327 between the two physical servers has changed its rules to “Deny” and now application 172.1.1.1 cannot communicate with the postgres172.1.2.1 application. The current event management system is unaware of the rule change on router 327 and does not know why application 172.1.1.1 cannot communicate with the postgres172.1.2.1 application. Cross-environment correlation can be performed to correlate information about the router policy change with symptoms as a group to diagnose the issue.

[0036] FIG. 4 illustrates an example of a problem scenario 400 in a hybrid cloud environment addressed in this disclosure. In this diagram, the environment is a hybrid cloud, and the symptom 405 is intermittent application connectivity interruptions to application program interfaces (APIs) running behind machines running NSX® software. The NSX® edge message 410 describes a neighbor being notified due to an unexpected event, followed by a message about the connection deteriorating, entering, and leaving an established state. The messages from the unexpected state indication to the message about leaving an established state are a series of application interruptions to the API. The explanation at 420 shows that such message notifications are not usually converted into events since no action may be required, and that false positive messages can occur, especially when related to the standardized Exterior Gateway Protocol (BGP) designed to exchange routing and reachability information between autonomous systems on the Internet. In accordance with the disclosed method, at 430, these types of messages and symptoms are correlated as a group and provided to an SRE or an automated remediation action file of similar messages that may be searchable in order to diagnose the issue. At 435, it is shown that by correlating the group events related to application connectivity interruptions (called "NSX BGP flap") with upstream events and providing that information to an automated remediation action file of similar messages or an SRE, the ability to diagnose and take remediation action for applications that cannot communicate with endpoints behind the NSX Edge is rapidly achieved.

[0037] FIG. 5 illustrates the operation of domain space exploration 500 consistent with an example embodiment. According to FIG. 5, in domain space exploration, attributes of events that may occur in each domain are explored from historical data. One such example may be a connectivity interruption across an NSX-BGP flap, as described above with respect to FIG. 4. At operation 510, there is entity and relationship binding (e.g., entity linking). With respect to the scenario discussed in FIG. 4, entity binding may include link information regarding similar nodes that connect across an NSX-BGP flap.

[0038] In operation 515, the knowledge base is extracted and a knowledge graph is constructed, for example, by dependency analysis and graph construction. For example, graphing events can help determine if there are patterns or commonalities in any given problem.

[0039] In operation 520, clustering is performed on correlated events based on similar event types and temporal and spatial (e.g., topological) information (e.g., grouping). Clustering algorithms can be used to correlate common issues and / or issues with entities that share similar connections to specific applications. Domain space exploration 540 is illustrated with relationships between container permissions, container analysis, and hosts.

[0040] FIG. 6 illustrates the construction of a correlation graph 600, consistent with an exemplary embodiment. A domain space search 605, meta extraction 610, and knowledge graph 615 are shown. A semantic correlation graph is constructed using learned information, and meta information is extracted from the domain space search and converted into a knowledge graph. The domain space search 605 depicts the relationship between container permissions, container analysis, and hosts. The meta extraction 610 can be extracted in many ways, for example, by reading tags, extracting quantitative data sets, using an information extraction (IE) system, or event-based information extraction software. The knowledge graph 615 is a programmatic way of modeling domain information to show links between various domains. There are various applications in which knowledge graphs can be generated, and their use can be applied to problem determination by providing links of events that may be generated by various domains. FIG. 7 illustrates an example screenshot 700 used in the construction of a logical inference statement, consistent with an exemplary embodiment. The screenshot 700 is an example of a space search logic used to find localization and blast radius inferences. With data from the domain space exploration, the deep design space exploration logic is updated with logic that has iterative learning and any SRE feedback (or automatic feedback). At runtime, correlated events and inferences can be found.

[0041] <Processing example> With the foregoing overview of the exemplary architecture, it may be useful to next consider a high-level discussion of an exemplary process. To that end, in conjunction with FIGS. 1 and 2, FIG. 8 is a flow chart illustrating a computer-implemented method for cross-environment event correlation consistent with an exemplary embodiment. Process 800 is illustrated in a logical flow chart as a collection of blocks that represent sequences of operations that may be implemented in hardware, software, or a combination thereof. In the context of software, the blocks represent computer-executable instructions that, when executed by one or more processors, perform the noted operations. In general, computer-executable instructions may include routines, programs, objects, components, data structures, etc. that perform functions or implement abstract data types. In each process, the order in which the operations are described is not intended to be construed as a limitation, and any number of the described blocks may be combined in any order and / or executed in parallel to accomplish the process. For purposes of discussion, process 800 is described with reference to the architecture of FIG. 1.

[0042] At operation 810, one or more correlated events are determined for issues occurring across multiple domains. Issues can range from hard failures to service degradation, for example. Correlated events can have some commonality as a basis for grouping.

[0043] At operation 820, semantic knowledge data or meta-knowledge data of the issues determined from the correlated events is extracted. Meta-knowledge can be extracted, for example, from domain space exploration. A variety of methods can be used to extract meta-knowledge, including tag reading, quantitative data set extraction, information extraction (IE) systems, and event-based information extraction software.

[0044] At operation 830, a correlation graph of the extracted semantic or meta-knowledge data is generated to trace the issues.

[0045] At operation 840, the correlated events are grouped into one or more event groups. The events can be based on similar types of errors (e.g., network flapping as discussed with respect to FIG. 4), or errors occurring at a particular gateway, or errors occurring during a similar time period.

[0046] A logical inference statement is constructed based on the generated correlation graph in operation 850. The correlation graph for domain space exploration relates to how an issue in one domain affects another domain of the multiple domains.

[0047] An explanation regarding the cause of the issue is provided to the event group of the correlated event at operation 860. The explanation provides a better understanding of the issue.

[0048] Processing in this exemplary embodiment ends after operation 860 .

[0049] <Examples of Specially Configured Computing Devices> Figure 9 provides a functional block diagram of a computer hardware platform 900. In particular, Figure 9 illustrates a particularly configured network or host computer platform 900 that may be used to implement the methods as described herein above.

[0050] The computer platform 900 may include a central processing unit (CPU) 904, a hard disk drive (HDD) 906, a random access memory (RAM) or read-only memory (ROM) 908 or a combination thereof, a keyboard 910, a mouse 912, a display 914, and a communication interface 916, which are connected to a system bus 902. The HDD 906 may include a data store.

[0051] In one embodiment, the HDD 906 has functionality including storing programs capable of performing various processes, such as for performing cross-environment event correlation 950 in the manner described herein. The cross-environment event correlation module 950 includes a domain space exploration module 938 and an event grouping module 940. The inference descriptor 942 generates logical inferences for the domain space exploration. The graph generator module 944 is configured to generate a correlation graph from the extracted semantic or meta-knowledge to trace correlated issues to aid in event grouping. There may be various modules configured to perform different functions that may vary quantitatively. For example, the machine learning module 946 may be configured to learn cross-domain correlation and inferences about issues. Given data (historical or synthetic), correlated events are identified as correlated groups along with confidence levels.

[0052] In one embodiment, it may store programs such as Apache™ for operating the system as a web server. In one embodiment, HDD 906 may store running applications including one or more library software modules, such as for a Java™ Runtime Environment program for implementing a JVM (Java™ Virtual Machine).

[0053] <Example of cloud platform> As mentioned above, functionality related to cross-environment event correlation according to the present disclosure may include cloud. Although the present disclosure includes detailed descriptions of cloud computing, implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the present invention may be practiced in conjunction with any other type of computing environment now known or developed in the future.

[0054] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. The cloud model may include at least five characteristics, at least three service models, and at least four implementation models.

[0055] The characteristics are as follows:

[0056] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time or network storage, automatically as needed, without the need for human interaction with the service provider.

[0057] Broad network access: Computing power is available over the network and can be accessed through standard mechanisms, facilitating use by heterogeneous thin- and thick-client platforms (e.g., cell phones, laptops, PDAs).

[0058] Resource Pooling: Computing resources from a provider are pooled and offered to multiple consumers using a multi-tenant model. Different physical and virtual resources are dynamically allocated and reallocated depending on demand. Consumers generally have no control or knowledge of the exact location of the resources provided to them, so there is a sense of location independence, although consumers may be able to determine location at a higher level of abstraction (e.g. country, state, data center).

[0059] Rapid elasticity: Computing capacity can be provisioned quickly and elastically, in some cases automatically, to scale out immediately and to be released quickly to scale in immediately. To the consumer, the computing capacity available for provisioning often appears unlimited and can be purchased at any time and in any quantity.

[0060] Metered Services: Cloud systems leverage metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, active user accounts) to automatically control and optimize resource usage. Resource usage can be monitored, controlled, and reported to provide transparency to both providers and consumers of the services utilized.

[0061] The service model is as follows:

[0062] Software as a Service (SaaS): The functionality offered to the consumer is the availability of a provider's applications running on a cloud infrastructure that can be accessed from a variety of client devices through a thin-client interface such as a web browser (e.g., webmail). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even the individual application functions, except for limited user-specific application configuration settings.

[0063] Platform as a Service (PaaS): The capability offered to the consumer is to deploy applications that the consumer creates or acquires using programming languages ​​and tools supported by the provider onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the configuration of the hosting environment.

[0064] Infrastructure as a Service (IaaS): The facility offered to the consumer is the provision of processors, storage, networking, and other basic computing resources on which the consumer can deploy and run any software, including operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over the operating systems, storage, and deployed applications, and in some cases has partial control over some network components (e.g., the host firewall).

[0065] The deployment model is as follows:

[0066] Private Cloud: The cloud infrastructure is dedicated to a specific organization. It can be managed by that organization or a third party and can exist on-premise or off-premise.

[0067] Community Cloud: The cloud infrastructure is shared by multiple organizations to support a specific community with common concerns (e.g., mission, security requirements, policies, and compliance). The cloud infrastructure can be managed by the organizations or a third party and can exist on-premise or off-premise.

[0068] Public cloud: The cloud infrastructure is available to the general public or large industry organizations and is owned by an organization that sells cloud services.

[0069] Hybrid Cloud: This cloud infrastructure combines two or more cloud models (private, community or public), each of which retains its inherent semantics but is bound together by standards or specific technologies that enable data and application portability (e.g. cloud bursting for load balancing between clouds).

[0070] A cloud computing environment is a service-oriented environment with an emphasis on statelessness, low coupling, modularity and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0071] 10 illustrates an exemplary cloud computing environment 1000. As illustrated, the cloud computing environment 1000 includes a cloud 1050 having one or more cloud computing nodes 1010, to which local computing devices used by cloud consumers (e.g., PDAs or cell phones 1054A, desktop computers 1054B, laptop computers 1054C, or automobile computer systems 1054N, or combinations thereof, etc.) can communicate. The nodes 1010 can communicate with each other. The nodes 1010 can be physically or virtually grouped (not shown) in one or more networks, such as, for example, a private, community, public, or hybrid cloud, or combinations thereof, as described above. This allows the cloud computing environment 1000 to provide infrastructure, platform, or software, or combinations thereof, as a service, for which the cloud consumers do not need to maintain resources on their local computing devices. It should be understood that the types of computing devices 1054A-N shown in FIG. 10 are merely exemplary, and that the computing node 1010 and cloud computing environment 1050 can communicate with any type of electronic device via any type of network or network-addressable connection (e.g., using a web browser) or both.

[0072] Here, a set of functional abstraction layers 1100 provided by the cloud computing environment 1000 (FIG. 10) is shown in FIG. 11. It should be understood in advance that the components, layers, and functions shown in FIG. 11 are merely exemplary, and the embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0073] Hardware and software layer 1160 includes hardware and software components. Examples of hardware components include mainframe 1161, reduced instruction set computer (RISC) architecture based servers 1162, servers 1163, blade servers 1164, storage devices 1165, and networks and network components 1166. In some embodiments, software components include network application server software 1167 and database software 1168.

[0074] The virtualization layer 1170 provides an abstraction layer from which the following virtual entities can be provided, for example: virtual servers 1171, virtual storage 1172, virtual networks including virtual private networks 1173, virtual applications and operating systems 1174, and virtual clients 1175.

[0075] As an example, management layer 1180 may provide the following functionality: Resource provisioning 1181 enables dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 1182 enables cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. As an example, these resources may include application software licenses. Security enables identification and verification of cloud consumers and tasks, as well as protection for data and other resources. User portal 1183 provides consumers and system administrators with access to the cloud computing environment. Service level management 1184 enables allocation and management of cloud computing resources such that requested service levels are met. Service level agreement (SLA) planning and fulfillment 1185 enables advance arrangement and procurement of cloud computing resources anticipated to be needed in the future according to SLAs.

[0076] The workload layer 1190 provides examples of functionality available to a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include mapping and navigation 1191, software development and lifecycle management 1192, virtual classroom instruction delivery 1193, data analytics processing 1194, transaction processing 1195, and an event correlation module 1196.

[0077] <Conclusion> The description of various embodiments of the present teachings has been presented for illustrative purposes, but is not intended to be exhaustive or limiting of the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used in this specification are selected to best describe the principles of the embodiments, practical applications or technical improvements to the technology found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

[0078] While the foregoing has set forth what is believed to be the best mode and / or alternative embodiments, it is understood that various modifications may be made thereto and that the subject matter disclosed herein can be embodied in various forms and examples, and that the present teachings are susceptible to numerous applications, only some of which are described herein. It is intended by the following claims to claim all such applications, modifications and variations that fall within the true scope of the present teachings.

[0079] The components, steps, features, objects, benefits, and advantages that have been discussed herein are merely exemplary. None of them, nor the discussions related thereto, are intended to limit the scope of protection. Although various advantages have been discussed herein, it will be understood that not all embodiments necessarily include all advantages. Unless otherwise specified, all measurements, values, ratings, positions, sizes, and other specifications described herein, including the following claims, are approximate rather than precise. They are intended to have a reasonable range consistent with the functions to which they relate and with those customary in the technical field to which they relate.

[0080] Numerous other embodiments are contemplated, including embodiments that have fewer, additional, and / or different components, steps, features, objects, benefits, and advantages, including embodiments in which the components and / or steps are arranged and / or ordered differently.

[0081] The flowcharts and diagrams in the figures herein illustrate the architecture, functionality, and operation of possible implementations of various embodiments of the present disclosure.

[0082] Although the foregoing has been described in connection with exemplary embodiments, it is understood that the term "exemplary" is meant merely as an example, not as best or optimal. Except as noted immediately above, nothing described or illustrated is intended to, and should be construed as, dedicating to the public any component, step, feature, object, benefit, advantage, or equivalent, whether or not claimed.

[0083] Terms and expressions used herein shall be understood to have the ordinary meaning given to such terms and expressions with respect to their respective corresponding fields of inquiry and study, unless a specific meaning is indicated herein. Relative terms such as first and second are used only to distinguish one entity or action from another and do not necessarily require or imply an actual relationship or sequence between such entities or actions. The term "comprises" or "comprising", or other variations, are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus consisting of a list of elements does not include only those elements, but may include other elements not expressly listed or elements inherent to such process, method, product, or apparatus. An element preceded by "a" or "an" does not, without further constraints, exclude the presence of additional identical elements in the process, method, product, or apparatus that comprises the element.

[0084] The Summary of the Disclosure is provided to enable the reader to quickly grasp the contents of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. Moreover, in the foregoing detailed description, it will be seen that various features have been grouped together in various embodiments for the purpose of streamlining the disclosure. This method of disclosure should not be interpreted as reflecting an intention that the claimed embodiments have more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Accordingly, the following claims are hereby incorporated into this specification with each claim standing as separately claimed subject matter in its own right.

Claims

1. 1. A computer-implemented method for cross-environment event correlation, the method comprising: determining one or more correlated events for issues occurring across multiple domains; extracting knowledge data for the subject determined from the one or more correlated events; generating a correlation graph of the extracted knowledge data and tracing the problem; grouping the correlated events into one or more event groups to indicate a relationship to the issue; Based on the generated correlation graph, constructing a logical inference statement for a domain space exploration related to how an issue in one domain affects another domain of the plurality of domains; and providing an explanation for a cause of the issue of the one or more correlated events to the one or more event groups based on the logical inference description.

2. 2. The computer-implemented method of claim 1, further comprising using machine learning to determine the correlated events for the issue occurring across multiple domains based on historical or synthetic data, and wherein the extraction of knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data.

3. The computer-implemented method of claim 2 , wherein using machine learning comprises learning by unsupervised learning techniques using association rule learning algorithms or clustering algorithms.

4. 4. A computer-implemented method having the features of claim 2 or 3, wherein using machine learning comprises learning by supervised learning techniques using labeled data associated with data correlations.

5. A computer-implemented method having the features of any of claims 2 to 4, further comprising configuring the machine learning by a supervised learning technique using a support vector machine (SVM), a convolutional neural network (CNN), or a long short-term memory (LSTM) based on the size of the correlation data.

6. 6. A computer-implemented method having the features of any one of claims 2 to 5, further comprising: recommending to a user a most probable group of correlated events from the one or more event groups together with an explanation as to a cause of the issue.

7. 7. The computer-implemented method of claim 6, wherein the recommendation of a most probable event group of the correlated events along with the explanation of the cause of the issue is based on run-time execution of create, read, update, and delete (CRUD) data.

8. 8. A computer-implemented method having the features of any one of claims 2 to 7, wherein using machine learning includes a training operation based on receiving feedback to train for the determination of the one or more correlated events.

9. A computer-implemented method having the features of any one of claims 1 to 8, further comprising receiving feedback on said determination of said one or more correlated events by an active learning methodology that interactively queries a user or information source to label new data points with a desired output.

10. The computer-implemented method of any of claims 1 to 9, further comprising establishing one or more semantic relations between the multiple domains.

11. Determining one or more correlated events related to the issue includes: collecting one or more of events, logs, metrics, or change records from at least a portion of the plurality of domains; determining one or more correlated events related to the challenge using one or more machine learning techniques; and generating a normalized format of the collected one or more events, logs, metrics, or change records.

12. The computer-implemented method of claim 11 , wherein at least the gathering of the events, the logs, the metrics, or the change records is performed offline using synthetic simulation.

13. 13. A computer-implemented method having the features of claim 11 or 12, wherein at least the collection of the events, the logs, the metrics, or the change records is performed offline using historical data.

14. A non-transitory computer readable storage medium tangibly embodying computer readable program code having computer readable instructions that, when executed, cause a computing device to perform a method of cross-environment event correlation, the method comprising: Determining one or more correlated events for issues across multiple domains; extracting knowledge data for the issue determined from the one or more correlated events; generating a correlation graph of the extracted knowledge data and tracing the problem; grouping the correlated events into one or more event groups to indicate a relationship to the issue; Based on the generated correlation graph, constructing a logical inference statement for a domain space exploration related to how an issue in one domain affects another domain of the plurality of domains; and providing an explanation for a cause of the issue of the one or more correlated events to the one or more event groups based on the logical inference description.

15. said extracting said knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data; the determining of the one or more correlated events is performed by machine learning; 15. The computer-readable storage medium of claim 14, wherein the method further comprises: recommending to a user a most probable group of correlated events from the one or more groups of events along with an explainability for the issue.

16. 16. The computer-readable storage medium of claim 15, wherein the recommending a most probable group of correlated events having explainability is based on run-time execution of create, read, update, and delete (CRUD) data.

17. The method further includes building one or more semantic relations between the plurality of domains, wherein the determining one or more correlated events related to the challenge includes: collecting one or more events, one or more logs, one or more metrics, or one or more change records from at least a portion of the plurality of domains; determining one or more correlated events related to said challenge using machine learning techniques; and generating a normalized format of the one or more collected events, one or more logs, one or more metrics, or one or more change records.

18. 20. The computer-readable storage medium of claim 17, wherein the collection of events, logs, metrics, or change records is performed offline using synthetic simulations or historical data.

19. 1. A computing device for performing cross-environment event correlation using spatial searching, comprising: A processor; and a memory coupled to the processor, the memory storing instructions for causing the processor to perform operations, the operations including: Determining one or more correlated events for issues across multiple domains; extracting knowledge data for the subject determined from the one or more correlated events; constructing logical inference statements for domain space exploration related to how the issues in one domain affect other domains of the plurality of domains; generating one or more correlation graphs based on the domain space exploration to trace the issues; grouping the correlated events into one or more event groups; Building semantic relationships between different domains; and recommending a most probable event group of the correlated events along with an explanation for a cause of the issue of the one or more correlated events based on the logical inference description.

20. said extracting said knowledge data includes extracting one or more of semantic knowledge data or meta-knowledge data; 20. The computing device of claim 19, wherein the processor is configured to perform machine learning of the cross-environment event correlation for the challenge.

Images