Computer-implemented method, computer program, and computer system

Abstract

To provide a computer implementation method for stochastic event triage, a computer program, and a computer system.SOLUTION: A program causes a computer to execute: receiving an event log including timestamps and event types; determining a sparse impact matrix representing causal relationships between the event types, via a cardinality regularization; determining triggering probabilities representing causal association probabilities between individual event instances, by leveraging a variational bound of a likelihood function; providing a user with the triggering probabilities for event triage; and learning model parameters by iterating type-level causal analysis and instance-level causal analysis.SELECTED DRAWING: Figure 4

Description

[Background technology]

[0001] The present invention relates generally to probabilistic event triage for artificial intelligence for information technology operations (AIOps), and more specifically to a framework for determining the probability of causal associations between event instances as well as learning causal relationships between event types.

[0002] Event triage refers to the task of prioritizing many events to produce a short list of important events, often with respect to "alarm" events. A critical subtask toward this goal is the subtask of identifying and prioritizing temporal event instances that are causally related to the event of interest.

[0003] Modeling time-stamped events using point processing is an emerging research topic in machine learning (ML) that has received considerable recent attention. Unlike mainstream ML problems involving independent and identically distributed (iid) vector data, these require treating individual events as probabilistic objects without aggregation. In particular, Hawkes processes are a popular point processing model used in this context (Hawkes, "A Spectrum of Some Self-Exciting and Mutually Exciting Point Processes," Biometrika, Vol. 58, 1971). In the ML literature, research on Hawkes processes has had two major milestones to date: the minerization-maximization (MM) algorithm (Hunter et al., "A Tutorial on the MM Algorithm," The American Statistician, 58(1), 2004), and Granger causality discovery with Hawkes processes (Granger, "Investigating Causality by Econometric and Cross-Spectral Methods," Econometrica, 37(3), 1969).

[0004] The first milestone was marked by Veen and Schoenberg (Estimating Space-Time Branching Process Models in Seismology Using EM-Type Algorithms, Journal of the American Statistical Association, 103(482), 2008). Based on intuition about the branching process of earthquake aftershocks, they introduced the first MM-based maximum likelihood algorithm, which is often loosely referred to as EM (Expectation Maximization) due to its similarity (Neal et al., An Overview of EM Algorithms Justifying Incremental, Sparse, and Other Variants, Learning in Graphical Models, 1998). Standard gradient-based maximum likelihood estimation (MLE) methods for multivariate Hawkes processes suffer from numerical stability issues, which limit their applicability in practice. The second milestone was achieved by some pioneering work in Hawkes-based Granger causality modeling. Kim et al. (Granger causality measures for point-processing models of population neural spiking behavior, PLoS Comput Biol, 7(3), 2011) propose Hawkes-based causal learning. Zhou et al. (Learning social contagion in sparse low-rank networks using multidimensional Hawkes processes, Proceedings of the 16th International Conference on Artificial Intelligence and Statistics, 2013) introduce l1 regularization in the MLE of multivariate Hawkes processes. Eichler et al. (Graphical modeling of multivariate Hawkes processes with non-parametric link functions, arXiv:1605.06759v1, 2016) theoretically establish equivalence between Hawkes-based causality and Granger causality.

[0005] Given these achievements and the well-known importance of sparsity in Granger causality learning (Arnold et al., Temporal Causality Modeling with Graphical Granger Methods, Proceedings of ACM SIGKDD, 2007; Lozano et al., Grouped Graphical Granger Modeling for Gene Expression Regulatory Network Discovery, Bioinformatics, 2009), the MM algorithm combined with sparsity-enforcing regularization seems a promising path for robust solutions. Interestingly, however, the likelihood function of the MM algorithm has a peculiarity that actually prohibits any sparse solutions. Despite its significance, to date, this problem has received little attention in the ML community. Summary of the Invention [Problem to be solved by the invention]

[0006] The likelihood function of the MM algorithm has a peculiarity that in fact prohibits any sparse solutions. Despite its significance, to date, this problem has received little attention in the ML community. [Means for solving the problem]

[0007] In one embodiment, a computer-implemented method for probabilistic event triage is provided. The computer-implemented method includes receiving an event log, the event log including a timestamp and an event type. The computer-implemented method further includes determining a sparse impact matrix representing the causal relationships between the event types by cardinality normalization. The computer-implemented method further includes determining triggering probabilities representing the causal association probabilities between individual event instances by utilizing variational bounds on the likelihood function. The computer-implemented method further includes providing the triggering probabilities for event triage to a user.

[0008] The computer-implemented method for probabilistic event triage further includes determining a baseline intensity for each one of the event types, the baseline intensity providing information regarding how each of the event types has a tendency to occur on its own without any triggering event. The computer-implemented method further includes determining a decay rate for each one of the event types, the decay rate providing information regarding a time scale for each one of the event types.

[0009] The computer-implemented method for probabilistic event triage further includes learning model parameters by iterating type-level causal analysis and instance-level causal analysis. The type-level causal analysis includes determining a sparse impact matrix, a baseline intensity for each of the event types, and a decay rate for each of the event types. The instance-level causal analysis includes determining a triggering probability.

[0010] The computer-implemented method for probabilistic event triage further includes generating an initial triggering probability. The computer-implemented method further includes calculating a baseline intensity, a decay rate, and a sparse impact matrix based on the initial triggering probability.

[0011] The computer-implemented method for probabilistic event triage further includes updating the triggering probability in a current round of calculation based on the baseline intensity, decay rate, and sparse impact matrix calculated in a previous round of calculation. The computer-implemented method further includes updating the baseline intensity, decay rate, and sparse impact matrix based on the updated triggering probability. The computer-implemented method further includes outputting the updated triggering probability in the current round of calculation in response to determining that the baseline intensity, decay rate, and sparse impact matrix converge. The computer-implemented method further includes iterating the updating of the triggering probability, baseline intensity, decay rate, and sparse impact matrix in response to determining that the baseline intensity, decay rate, and sparse impact matrix do not converge.

[0012] In another aspect, a computer program product for probabilistic event triage is provided. The computer program product includes a computer-readable storage medium having program instructions embodied therein, the program instructions being executable by one or more processors. The program instructions are executable to receive an event log including timestamps and event types, determine a sparse impact matrix representing causal relationships between event types by cardinality normalization, determine triggering probabilities representing probabilities of causal association between individual event instances by utilizing variational bounds on likelihood functions, and provide the triggering probabilities for event triage to a user.

[0013] In the computer program product for probabilistic event triage, the program instructions are further executable to determine a baseline intensity of each one of the event types, the baseline intensity providing information regarding how each of the event types has a tendency to occur on its own without any triggering event, and to determine a decay rate of each one of the event types, the decay rate providing information regarding a time scale of each one of the event types.

[0014] In the computer program product for probabilistic event triage, the program instructions are further executable to learn model parameters by iterating type-level causal analysis and instance-level causal analysis, where the type-level causal analysis includes determining a sparse impact matrix, a baseline intensity for each of the event types, and a decay rate for each of the event types, and the instance-level causal analysis includes determining a triggering probability.

[0015] In the computer program product for probabilistic event triage, the program instructions are further executable to generate an initial triggering probability, and to calculate a baseline intensity, a decay rate, and a sparse impact matrix based on the initial triggering probability.

[0016] In the computer program product for probabilistic event triage, the program instructions are further executable to: update, in a current round of calculations, a triggering probability based on the baseline intensity, decay rate, and sparse impact matrix calculated in a previous round of calculations; update the baseline intensity, decay rate, and sparse impact matrix based on the updated triggering probability; output the updated triggering probability in the current round of calculations in response to determining that the baseline intensity, decay rate, and sparse impact matrix converge; and iteratively update the triggering probability, baseline intensity, decay rate, and sparse impact matrix in response to determining that the baseline intensity, decay rate, and sparse impact matrix do not converge.

[0017] In yet another aspect, a computer system for probabilistic event triage is provided. The computer system includes one or more processors, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more computer-readable tangible storage devices for execution by at least one of the one or more processors. The program instructions are executable to receive an event log including a timestamp and an event type. The program instructions are further executable to determine a sparse impact matrix representing a causal relationship between event types through cardinality normalization. The program instructions are further executable to determine triggering probabilities representing the probability of causal association between individual event instances by utilizing variational bounds on the likelihood function. The program instructions are further executable to provide the triggering probabilities for event triage to a user.

[0018] In the computer system for probabilistic event triage, the program instructions can further be executed to determine a baseline intensity of each one of the event types, the baseline intensity providing information about how each of the event types tends to occur on its own without any triggering event, and to determine a decay rate of each one of the event types, the decay rate providing information about the time scale of each one of the event types.

[0019] In the computer system for probabilistic event triage, the program instructions are further executable to learn model parameters by iterating type-level causal analysis and instance-level causal analysis, where the type-level causal analysis includes determining a sparse impact matrix, a baseline intensity for each of the event types, and a decay rate for each of the event types, and the instance-level causal analysis includes determining a triggering probability.

[0020] In the computer system for probabilistic event triage, the program instructions are further executable to generate an initial triggering probability and calculate a baseline intensity, a decay rate, and a sparse impact matrix based on the initial triggering probability.

[0021] In a computer system for probabilistic event triage, the program instructions are further executable to update, in a current round of calculations, a triggering probability based on the baseline intensity, decay rate, and sparse impact matrix calculated in a previous round of calculations. The program instructions are further executable to update the baseline intensity, decay rate, and sparse impact matrix based on the updated triggering probability. The program instructions are further executable to output the updated triggering probability in the current round of calculations in response to determining that the baseline intensity, decay rate, and sparse impact matrix converge. The program instructions are further executable to iterate the updating of the triggering probability, baseline intensity, decay rate, and sparse impact matrix in response to determining that the baseline intensity, decay rate, and sparse impact matrix do not converge.

[0022] In yet another aspect, a computer-implemented method for learning model parameters in probabilistic event triage is provided. The computer-implemented method includes updating a baseline intensity for each of the event types based on a triggering probability, where the baseline intensity provides information about how each of the event types tends to occur on its own without any triggering event, and the triggering probability represents a causal association probability between individual event instances. The computer-implemented method further includes updating a decay rate for each of the event types based on the triggering probability, where the decay rate provides information about a time scale for each of the event types. The computer-implemented method further includes updating a sparse impact matrix based on the triggering probability, where the sparse impact matrix represents a causal relationship between the event types. The computer-implemented method further includes updating the triggering probability based on the baseline intensity, the decay rate, and the sparse impact matrix. The computer-implemented method further includes providing a triggering probability for event triage to a user in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have converged.

[0023] The computer-implemented method for learning model parameters in probabilistic event triage further includes receiving a predetermined constant for the normalized intensity. The computer-implemented method further includes generating an initial triggering probability. The computer-implemented method further includes calculating a baseline intensity, a decay rate, and a sparse impact matrix based on the initial triggering probability.

[0024] The computer-implemented method for learning model parameters in probabilistic event triage further includes iterating convergence of the baseline intensity, decay rate, sparse impact matrix, and updating the triggering probability in response to determining that the baseline intensity, decay rate, and sparse impact matrix do not converge.

[0025] In yet another aspect, a computer program product for training model parameters in probabilistic event triage is provided, the computer program product including a computer-readable storage medium having program instructions embodied thereon, the program instructions being executable by one or more processors. The program instructions are executable to: update a baseline intensity of each one of the event types based on a triggering probability, where the baseline intensity provides information about how each of the event types has a tendency to occur on its own without any triggering event, and the triggering probability represents a causal association probability between individual event instances; update a decay rate of each one of the event types based on the triggering probability, where the decay rate provides information about a time scale of each one of the event types; update a sparse impact matrix based on the triggering probability, where the sparse impact matrix represents a causal relationship between the event types; update the triggering probability based on the baseline intensity, the decay rate, and the sparse impact matrix; and provide a triggering probability to a user for event triage in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have converged.

[0026] In the computer program product for learning model parameters in probabilistic event triage, the program instructions are further executable to receive a predetermined constant for normalized intensity, generate an initial triggering probability, and calculate a baseline intensity, a decay rate, and a sparse impact matrix based on the initial triggering probability.

[0027] In the computer program product for learning model parameters in probabilistic event triage, the program instructions are further executable to iteratively update the baseline intensity, decay rate, convergence of the sparse impact matrix, and triggering probability in response to determining that the baseline intensity, decay rate, and sparse impact matrix do not converge. [Brief explanation of the drawings]

[0028] [Figure 1] Figure 1 shows two main results of the proposed framework in accordance with one embodiment of the present invention: (A) triggering probability and (B) impact matrix. [Figure 2] 10 illustrates intensity and decay functions for different event types in accordance with one embodiment of the present invention.

[0029] [Figure 3] 1 illustrates the overall calculation procedure of the framework proposed in this invention, according to one embodiment of the present invention.

[0030] [Figure 4] 1 presents a flowchart illustrating the operational steps for learning model parameters and determining triggering probabilities based on the model parameters in accordance with one embodiment of the present invention.

[0031] [Figure 5](A), (B) and (C) present a comparison of the sparsity patterns of the influence matrix A estimated by the framework proposed in this invention and conventional methods in the art.

[0032] [Figure 6A] 1 presents the non-zero components of the triggering probability according to one embodiment of the present invention.

[0033] [Figure 6B] 10 presents the triggering probability for the 150th instance according to one embodiment of the present invention.

[0034] [Figure 7] FIG. 2 illustrates components of a computing device or server according to one embodiment of the present invention.

[0035] [Figure 8] 1 illustrates a cloud computing environment in accordance with one embodiment of the present invention.

[0036] [Figure 9] 1 illustrates abstraction model layers in a cloud computing environment according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0037] Embodiments of the present invention propose a unified approach to the problem, where not only the causal relationships among various learned event types but also the causal association probabilities among individual event instances are determined. Regarding the former, embodiments of the present invention develop a cardinality normalization technique tailored to the multivariate Hawkes process, which helps achieve accurate and sparse causal estimation and thus enables efficient event integration. Regarding the latter, the framework proposed in this invention leverages variational bounds on the likelihood function to discover causal association probabilities, thereby achieving simultaneous instance-level and type-level causal analysis.

[0038] Embodiments of the present invention provide a mathematically well-defined solution to sparse causal learning on event data, particularly in the context of event triage. For concreteness, consider the use case of cloud data center management. Various computing devices continuously generate numerous event logs. Due to device interconnectivity, a single warning event from one device, such as "response time too long," can trigger many related events in downstream services. The more severe the original error, the more redundant the resulting set of events tends to be. The operation of event triage, or shortlisting of high-priority events, requires as a prerequisite the task of correlating and integrating causally related event instances. Note that this requires instance-specific causality for accurate determination. For example, even if the ith event type has an average probability of being causally related to the jth type, one specific instance of the ith event type may have occurred naturally. A practical solution for event triage must therefore simultaneously perform type-level and instance-level causal analysis while properly handling the probabilistic nature of events. Despite the widespread problem of "alert fatigue" across many industries (Elshoush et al., Alert correlation in collaborative and intelligent intrusion detection systems - A survey, Applied Soft Computing, 2011; Moyne et al., Big data analytics for smart manufacturing: A semiconductor manufacturing case study, Processes, 2017; Dominiak et al., Prioritizing alarms from sensor-based detection models in livestock production - A review of model performance and alarm mitigation methods, Computers and Electronics in Agriculture, 2017), to date, there has been limited work done utilizing probabilistic event-causal modeling in this context.

[0039] The present invention proposes a novel framework for event triage based on a new cardinality-normalized MM algorithm. 2,1 Unlike regularization methods (Zhou et al., 2013; Xu et al., Learning Granger Causality for Hawkes Processes, Proceedings of the International Conference on Machine Learning, 2016), our method is free from pathological problems due to its logarithmic singularity at zero and achieves mathematically well-defined sparsity. The proposed framework leverages variational bounds of the MM algorithm to discover instance-level causal associations, thereby simultaneously achieving instance-level and type-level causal learning, as shown in Figures 1A and 1B. Figures 1A and 1B respectively illustrate two key results of the proposed framework: (1) the triggering probability quantifies instance-related causality for event triage, and (2) the impact matrix represents Granger causality between event types / classes.

[0040] The following paragraphs provide a problem statement for probabilistic point processing and summarize the basics.

[0041] Problem setting

[0042] An event sequence consisting of N+1 event instances is given.

number

[0043] The main goal of event triage is to calculate the triggering probabilities {q n,i} of the instances, where q n,i is the probability of the nth event instance (n = 1,..., N) to be triggered by the ith event (i = 0,..., n). By definition, n ≥ i, and

Number

[0044] Actual event triage is mainly an unsupervised learning task. One typical use case is event filtering as an enhancement of existing monitoring systems. For example, the end user could be a system administrator managing a computer system. From external information sources (such as customer complaint calls), the system administrator notices that something is wrong in the system. Next, the system administrator checks the triggering probabilities for events of interest.

[0045] Likelihood of correlated events

[0046] Since all events are assumed to be correlated, the most common probabilistic model is the joint distribution of N events. By the chain rule of probability density functions (PDFs), the joint distribution can be expressed as:

number

number

number

number

number

number

[0047] For the task of event triage, the first term of the summation in equation (5) plays a central role.

number

[0048] Intensity Function

[0049]

number

number

number

number

number

number

number

[0050] One will notice the dependence of the event interval on n in the second term. If D>1, then summation over n cannot be performed in the second term due to the dependence of dn on n. This is sometimes erroneously ignored in the literature.

[0051] The following paragraphs provide a specific model for the intensity function, which gives the triggering probability of an instance, q n,i} is introduced.

[0052] Intensity functions and Granger causality:

[0053] Equations (6) and (9) hold for any point process. We now introduce a specific parameterization of the Hawkes process.

number

number

number

number

number

number

[0054] Figure 2 illustrates equation (10),

number

number

number

number

[0055] Introducing triggering probability:

[0056] As shown in Figure 2, achieving sparsity in the impact matrix A is of critical importance in event triage. It directly leads to reducing the number of event candidates to be merged. To guarantee sparsity, we propose the following cardinality-normalized maximum likelihood:

number

number

number

number

number

number

number

number

number

[0057] Numerical solutions for maximum likelihood estimation (MLE) are known to be challenging even for τ = 0, mainly due to the nonlinear logarithmic term in equation (9). The Minerization-Maximization (MM) algorithm exploits the additional structure of the Hawkes process in equation (10) to apply Jensen's inequality in a manner similar to the expectation-maximization (EM) algorithm for mixture models (Neal et al., 1998). Specifically, equation (10) is first rewritten as

number

number

number

number

number

[0058] q n,i was introduced as a mathematical artifact in Jensen's inequality, but it opens a new door to instance-level causal analysis. n,iWe interpret as the triggering probability of an instance, the nth instance triggered by the ith instance. The ith instance is triggered when (1) it is closer to the nth instance, and (2) its event type d i If is more causally related to the event type of the nth instance, then it has a higher probability of triggering.

[0059] Note that equation (19) achieves soft and adaptive windowing in event integration. One standard approach to instance-level causality discovery in the literature is "hard windowing" (e.g., Lin et al., "Microscopy: Identifying Performance Problems with Causal Graphs in Microservice Environments," International Conference on Service-Oriented Computing, 2018), which means that event instances are causally related if they occur within the same time window of a given size. In real-world applications, it is common that different event types have different timescales of impact, and manually adjusting the window size can be a difficult task.

[0060] Learning the model parameters

[0061] For parameter estimation, we exploit inequality (18), where the likelihood function has a lower bound as follows:

number

number

number

number

number

number

number

[0062] The next paragraph is about baseline intensity.

number

number

[0063] Baseline Intensity

number

[0064] where {q n,i Assuming we have numerical estimates for

number

number

number

number

number

number

number

number

[0065] Decay rate

number

[0066] next,

number

number

number

number

number

number

number

number

[0067] Estimation of influence matrix A by concentration normalization

[0068] Now let us explain how to find A. In equation (24), the objective function L for A is rewritten as follows:

number

number

number

number

number

number

number

[0069] Before going into the details, let us first consider the known l1 or l 2,1 Let's use normalization instead and see what happens. The MM procedure is iterative. To make all instances eligible for event merging, we initialize q m ≥ 0. In this case, x m =0 is lnx m There is no solution possible due to the term , and therefore sparsity will not be achieved. In other words, the MM algorithm is not compatible with standard sparse regularization.

[0070] This is reminiscent of the mixture model problem described by Phan et al. (l0-regularized sparsity for probabilistic mixture models, Proceedings of SIAM Intl. Conf. Data Mining, SIAM, 2019). Here, we leverage their concept of "ε-sparsity." To determine sparsity, we introduce a small constant ε>0, which can be intuitively understood as the threshold below which elements are "turned off." Here, our problem is

number

number

number

number

number

number

[0071] Lagrange multiplier ξ m gives the Karush-Kuhn-Tucker (KKT) conditions as follows:

number

number

number

[0072]

number

number

number

[0073]

number

number

[0074] The last question is about gathering

number

number

number

[0075] The algorithm for estimating the influence matrix A by concentration normalization is used as part of the iterative MM procedure in equation (24). The overall complexity is

number

number

number

number

[0076] 3 shows a computational procedure of the proposed framework in accordance with an embodiment of the present invention. The computational procedure of the proposed framework is implemented by a computing device or server, which will be described in more detail in the following paragraphs with reference to FIG. 7. In some embodiments, the operational steps may be implemented in a cloud computing environment, which will be described in the following paragraphs with reference to FIGS. 8 and 9.

[0077] Referring to Figure 3, a computing device or server receives as input an event log, which contains N+1 event instances.

number

[0078] 3, the computing device or server performs macro (type-level) causal analysis. The computing device or server determines the causal relationships between various event types through the macro (type-level) causal analysis. The impact matrix A provides the causal relationships between the event types. Achieving sparsity in the impact matrix is ​​of critical importance in event triage, and therefore the computing device or server determines a sparse impact matrix (A) through cardinality normalization.

[0079] Further referring to Figure 3, in a macro (type-level) causal analysis, the computing device or server has a decay rate (

number

number

[0080] Further referring to FIG. 3, in a macro (type-level) causal analysis, a computing device or server may generate a baseline intensity (

number

number

number

[0081] 3, the computing device or server performs micro (instance-level) causal analysis. The computing device or server determines the causal association probability between individual event instances. The triggering probability quantifies the instance-related causal relationships for event triage. The computing device or server utilizes variational bounds on the likelihood function to determine the triggering probability {q n,i Two main results of the proposed framework are that the triggering probability of an instance {q n,i} and impact matrix A. Simultaneous instance-level causal analysis and type-level causal analysis are achieved as the actual solution for event triage. The computing device or server outputs triggering probabilities {q n,i}. The triggering probability {q n,i} is provided to end users for event triage. A typical use case is an event filter to improve an existing monitoring system. In one example of managing a computer system, an end user notices that something is wrong in the system and then checks the triggering probability for an event of interest.

[0082] Further referring to FIG. 3, the computing device or server may derive a baseline intensity by iterating macro (type-level) causal analysis and micro (instance-level) causal analysis.

number

number

number

number

[0083] 4 presents a flowchart illustrating the operational steps of learning model parameters and determining triggering probabilities based on the model parameters, according to one embodiment of the present invention. The operational steps illustrated in FIG. 4 are implemented by a computing device or server, which is described in more detail in subsequent paragraphs with reference to FIG. 7. In some embodiments, the operational steps may be implemented in a cloud computing environment, which is described in subsequent paragraphs with reference to FIG. 8 and FIG. 9.

[0084] In step 401, a computing device or server calculates predetermined constants (τ, v β ,v μ ,v A ,ε) are received. β ,v μ ,v A ,ε,is explained in the previous paragraph and example values ​​for it are presented in the following paragraphs with reference to a real-world use case.

[0085] In step 402, the computing device or server determines the initial triggering probabilities {q n,i For example, a lower-order triangular matrix is ​​randomly generated with chi-squared distribution (for positivity), and then the lower-order triangular matrix is ​​normalized so that the sum across each column is 1.

[0086] In step 403, the computing device or server determines the initial triggering probabilities {q n,i} to maximize the likelihood function,

number

number

number

[0087] In step 404, the computing device or server determines the initial triggering probabilities {q n,i}, the decay rate (

number

number

number

[0088] In step 405, the computing device or server determines the initial triggering probabilities {q n,i} to calculate the sparse influence matrix A by density normalization. The initial triggering probability {q n,i Based on}, the sparse influence matrix A is calculated by using the algorithm presented in Table 1.

[0089] It will be understood that steps 403-405 need not be performed in the sequential order described above. Steps 403-405 may be performed in a different order than that mentioned above, or may be performed simultaneously.

number

number

number

number

[0090] In step 406, the computing device or server generates a baseline intensity

number

number

number

number

[0091] In step 407, the computing device or server uses the triggering probabilities updated in step 406 to calculate the baseline intensity.

number

number

number

number

[0092] In step 408, the computing device or server calculates the baseline intensity.

number

number

number

number

number

number

[0093] Baseline Intensity

number

number

number

number

[0094] We validated the proposed framework with two real-world use cases, one from a power grid and the other from a cloud data center. Our focus was to demonstrate how the proposed framework (L0Hawkes) advances MM algorithms compared to traditional approaches and to show its practicality in real-world use cases. We demonstrate L0Hawkes by comparing it with the L1-regularization (Zhou et al., 2013)-based and the L2-regularization (Zhou et al., 2013)-based MM algorithms. 2,1 -Regularization (Xu et al., 2016) is based on this method, but it is compared with two known MM-based sparse inference methods.

[0095] In the first real-world use case, we collaborated with public and private entities to obtain fault event data from the US power grid. Fault events represent sudden changes in voltage or current signals, or a combination thereof, measured by phase measurement units (PMUs), which unfolded at geographically distributed locations in the power grid. We were interested in discovering hidden causal relationships in a data-driven manner solely from the temporal event data.

[0096] The dataset records N=3811 failure events labeled as "line outages" from D=22 PMUs over a 10-month period in 2016. μ ,v β ,μ A ) about 5 × (10 -3 ,10 -4 ,10 -4 ), and (τ,ε) were obtained as (1,1) and the model parameters were grid searched based on AIC. The value of ε was max k,l A k,l corresponded to about 3% of the l1 normalization and l 2,1 The same τ was used for normalization. A power decay of η=2 was used to capture long-tail behavior.

[0097] Figure 5(A) shows the sparsity pattern of the impact matrix A estimated by L0Hawkes, Figure 5(B) shows the sparsity pattern of the impact matrix A estimated by l1-normalization, and Figure 5(C) shows the sparsity pattern of the impact matrix A estimated by l1-normalization. 2,1 -The figures show the sparsity pattern of the influence matrix A estimated by normalization. These figures compare the calculated A and show non-zero matrix elements in black. 2,1 -By normalization, the zero items are k,l can only appear if happens to be numerically zero. In contrast, L0Hawkes enjoys guaranteed sparsity. From the computed A, we successfully discovered the hidden causal structure between PMUs.

[0098] In the second real-world use case, we applied L0Hawkes to a real-world event triage task. We obtained N=718 alarm events from a real cloud datacenter management system. These events, obtained from filter logs, were emitted by network devices, each with its own type: there were D=14 unique event types in our dataset. In these real-world use cases, we focused on demonstrating an example of instance-level causal analysis.

[0099] Figure 6A shows the triggering probability of an instance, q n,i} and visualize the non-zero entries of q n,i Those <0.01 are omitted. As expected, n,i} is fairly sparse, and therefore event integration can be performed directly by picking non-zero triggering probabilities. 150,i The rightmost slot (ETH_INIT) has a self-probability q 150,150 For each i, its event type d iis shown below the bar. The event type in question, ETH_INIT, relates to the process of initializing an Ethernet interface. Note in Figure 6B that although several previous instances of the same type have positive triggering probabilities leading to successful duplicate suppression, the self-probability of this instance was calculated as 0.

[0100] Many instances had zero triggering probability, thanks to the sparsity of A, despite their temporal proximity (the six events with positive probability were within 27 seconds of the 150th event). For example, this dataset contained 416 instances of the event type UPDOWN, which added significant noise, but were appropriately ignored by the proposed platform L0Hawkes. Unlike naive hard-windowing approaches, our framework was able to screen for pure causal relationships.

[0101] 7 is a diagram illustrating components of a computing device or server 700 in accordance with one embodiment of the present invention. It should be appreciated that FIG. 7 is intended as an illustration of one implementation only and is not intended to suggest any limitation with regard to the environments in which different embodiments may be implemented.

[0102] Referring to Figure 7, a computing device or server 700 includes a processor 720, a memory 710, and a tangible storage device 730. In Figure 7, communication between the above components of the computing device or server 700 is indicated by the numeral 790. The memory 710 includes a ROM (read only memory) 711, a RAM (random access memory) 713, and a cache 715. One or more operating systems 731 and one or more computer programs 733 reside on the one or more computer-readable tangible storage devices 730.

[0103] The computing device or server 700 further includes an I / O interface 750. The I / O interface 750 allows for the input and output of data with external devices 760 that may be connected to the computing device or server 700. The computing device or server 700 further includes a network interface 740 for communication between the computing device or server 700 and a computer network.

[0104] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail of integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to perform aspects of the present invention.

[0105] A computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer-readable storage media may also include the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disks (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or raised structures in grooves on which instructions are recorded, and any suitable combination of the above. As used herein, a computer-readable storage medium is not to be construed as a transitory signal itself, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or an electrical signal transmitted over a wire.

[0106] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a respective computing / processing device or to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing / processing device.

[0107] The computer-readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk® or C++, and procedural programming languages ​​such as the C programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, as a stand-alone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, to carry out aspects of the present invention, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry.

[0108] Aspects of the present invention are described herein with reference to flowchart illustrations or block diagrams, or combinations thereof, of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations or block diagrams, or combinations thereof, and combinations of blocks in the flowchart illustrations or block diagrams, or combinations thereof, can be implemented by computer-readable program instructions.

[0109] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to create a machine, whereby the instructions executing via the processor of the computer or other programmable data processing apparatus create means for implementing the functions / acts specified in a block or blocks of the flowcharts or block diagrams, or a combination thereof. These computer-readable program instructions may be stored on a computer-readable storage medium that can instruct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, whereby a computer-readable storage medium having instructions stored therein includes an article of manufacture containing instructions that implement aspects of the functions / acts specified in a block or blocks of the flowcharts or block diagrams, or a combination thereof.

[0110] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to create a computer-implemented process, whereby the instructions executing on the computer, other programmable apparatus, or other device implement the function / act specified in a block or blocks of a flowchart or block diagram, or a combination thereof.

[0111] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of executable implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions, that implement the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be realized as a single step, executed concurrently or substantially concurrently in a partially or fully time-overlapping manner, or may even be executed in the reverse order depending on the functionality involved in the blocks. It should also be noted that each block of a block diagram or flowchart diagram, or combination thereof, and combinations of blocks in a block diagram or flowchart diagram, or combination thereof, may be implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0112] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0113] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processes, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0114] The features are as follows:

[0115] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed without requiring human interaction with the provider of the service.

[0116] Broad Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (eg, cell phones, laptops, and PDAs).

[0117] Resource Pooling: Pooling a provider's computing resources to serve multiple consumers using a multi-tenant model, dynamically allocating and reallocating different physical and virtual resources according to demand. Generally, the consumer has no control or knowledge of the exact location of the resources provided, although there is a sense of location independence in that they may be able to specify location (e.g., country, state, or data center) at a higher level of abstraction.

[0118] Rapid Elasticity: Capabilities can be rapidly and elastically provisioned, sometimes automatically, scaled out quickly, released quickly, and scaled in quickly. To the consumer, each capacity available for provisioning often appears unlimited, and they can purchase as much as they need at any time.

[0119] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processes, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of utilized services.

[0120] The service model is as follows:

[0121] Software as a Service (SaaS): The functionality offered to the consumer is the use of a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings.

[0122] Platform as a Service (PaaS): The capability offered to consumers is the deployment of consumer-created or acquired applications, written using provider-supported programming languages ​​and tools, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the configuration of the environment that hosts the applications.

[0123] Infrastructure as a Service (IaaS): The functionality offered to consumers is the provision of processing, storage, networking, and other underlying computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating system, storage, deployed applications, and possibly limited control over selecting networking components (e.g., host firewalls).

[0124] The deployment model is as follows:

[0125] Private Cloud: Cloud infrastructure operates solely for an organization. A private cloud may be managed by the organization or a third party and may exist on-premise or off-premise.

[0126] Community Cloud: Cloud infrastructure is shared by several organizations to support a specific community with shared interests (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organization or a third party, or it may reside on- or off-premises.

[0127] Public Cloud: Cloud infrastructure is made available to the general public or large industry organizations and is owned by an organization that sells cloud services.

[0128] Hybrid Cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique entities but are tied together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting for load balancing between clouds).

[0129] Cloud computing environments are service-oriented with an emphasis on statelessness, loose coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0130] Referring now to FIG. 8, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10, which are local computing devices used by cloud users that can communicate with the cloud users, such as a mobile device 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or a combination thereof. The nodes 10 may communicate with each other. They may be physically or virtually grouped in one or more networks (not shown), such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or a combination thereof, as described herein above. This enables the cloud computing environment 50 to provide infrastructure, platform, or software, or a combination thereof, as a service without the cloud user having to maintain resources on the local computing device. The types of computing devices 54A-N are intended for illustrative purposes only, and it will be understood that the computing nodes 10 and the cloud computing environment 50 can communicate with any type of computer device (e.g., using a web browser) over any type of network or network-addressable connection, or a combination thereof.

[0131] Referring now to Figure 9, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 8) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 9 are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0132] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe 61, RISC (reduced instruction set computer) architecture-based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0133] The virtualization layer 70 provides an abstraction layer over which the following examples of virtual entities can be provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0134] In one example, management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of those resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud users and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides allocation and management of cloud computing resources so that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides proactive coordination and procurement of cloud computing resources where future requirements are forecasted according to SLAs.

[0135] Workload tier 90 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instruction delivery 93, data analytics processing 94, transaction processing 95, and function 96. In accordance with the present invention, function 96 is probabilistic event triage for artificial intelligence for information technology operations (AIOps) in a cloud computing environment.

Claims

1. 1. A computer-implemented method for probabilistic event triage, the computer-implemented method comprising: receiving, by one or more computing devices, an event log including a timestamp and an event type; determining, by the one or more computing devices, a sparse impact matrix representing causal relationships between the event types through cardinality normalization; determining, by the one or more computing devices, triggering probabilities that represent causal association probabilities between distinct event instances by maximizing a variational lower bound on a likelihood function; the one or more computing devices providing the triggering probabilities to a user for event triage; A computer-implemented method comprising:

2. The one or more computing devices determining a baseline intensity for each of the event types, the baseline intensity providing information about how each of the event types has a tendency to occur on its own without any triggering event; determining, by the one or more computing devices, a decay rate for each one of the event types, the decay rate providing information regarding a time scale for each one of the event types; The computer-implemented method of claim 1 , further comprising:

3. The one or more computing devices learn model parameters by iterating type-level causal analysis and instance-level causal analysis, determining that the type-level causal analysis includes the sparse impact matrix, a baseline intensity for each of the event types, and a decay rate for each of the event types, the baseline intensity providing information about how each of the event types has a tendency to occur on its own without any triggering event, and the decay rate providing information about a time scale for each of the event types; the instance-level causal analysis includes determining the triggering probability. The computer-implemented method of claim 1 , further comprising: learning.

4. A step in which the one or more computing devices generate initial triggering probabilities; the one or more computing devices calculating the baseline intensity, the decay rate, and the sparse impact matrix based on the initial triggering probability; The computer-implemented method of claim 3 further comprising:

5. The one or more computing devices updating the triggering probability in a current round of calculation based on the baseline intensity, the decay rate, and the sparse impact matrix calculated in a previous round of calculation; the one or more computing devices updating the baseline intensity, the decay rate, and the sparse impact matrix based on the updated triggering probability; the one or more computing devices outputting updated triggering probabilities for the current round of calculations in response to determining that the baseline intensities, the decay rates, and the sparse impact matrix have converged; the one or more computing devices iteratively updating the triggering probability, the baseline intensity, the decay rate, and the sparse impact matrix in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have not converged; The computer-implemented method of claim 4 further comprising:

6. 1. A computer program for probabilistic event triage, the computer program including program instructions embodied thereby, the program instructions executable by one or more processors, the program instructions comprising: receiving an event log including a timestamp and an event type; determining a sparse impact matrix representing causal relationships between the event types by cardinality normalization; determining triggering probabilities that represent the probability of causal association between distinct event instances by maximizing a variational lower bound on the likelihood function; providing the triggering probabilities to a user for event triage. Computer program.

7. determining a baseline intensity of each one of the event types, the baseline intensity providing information about how each of the event types tends to occur on its own without any triggering event; determining a decay rate of said respective one of said event types, said decay rate providing information regarding a time scale of said respective one of said event types; 7. The computer program product of claim 6, further comprising the program instructions being executable to:

8. learning model parameters by iterating type-level causal analysis and instance-level causal analysis; determining that the type-level causal analysis includes the sparse impact matrix, a baseline intensity for each of the event types, and a decay rate for each of the event types, the baseline intensity providing information about how each of the event types has a tendency to occur on its own without any triggering event, and the decay rate providing information about a time scale for each of the event types; the instance-level causal analysis includes determining the triggering probability.

7. The computer program of claim 6, further comprising the program instructions executable to learn.

9. generating initial triggering probabilities; calculating the baseline intensity, the decay rate, and the sparse impact matrix based on the initial triggering probability; 9. The computer program product of claim 8, further comprising the program instructions being executable to:

10. updating the triggering probability in a current round of calculation based on the baseline intensity, the decay rate, and the sparse impact matrix calculated in a previous round of calculation; updating the baseline intensity, the decay rate, and the sparse impact matrix based on the updated triggering probability; outputting updated triggering probabilities for the current round of calculations in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have converged; iteratively updating the triggering probability, the baseline intensity, the decay rate, and the sparse impact matrix in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have not converged; 10. The computer program product of claim 9, further comprising the program instructions being executable to:

11. 1. A computer system for probabilistic event triage, the computer system comprising: one or more processors, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more computer-readable tangible storage devices for execution by at least one of the one or more processors, the program instructions comprising: receiving an event log including a timestamp and an event type; determining a sparse impact matrix representing causal relationships between the event types by cardinality normalization; determining triggering probabilities that represent the probability of causal association between distinct event instances by maximizing a variational lower bound on the likelihood function; providing the triggering probabilities to a user for event triage. Computer system.

12. determining a baseline intensity of each one of the event types, the baseline intensity providing information about how each of the event types tends to occur on its own without any triggering event; determining a decay rate of said respective one of said event types, said decay rate providing information regarding a time scale of said respective one of said event types; 12. The computer system of claim 11, further comprising the program instructions executable by:

13. learning model parameters by iterating type-level causal analysis and instance-level causal analysis; determining that the type-level causal analysis includes the sparse impact matrix, a baseline intensity for each of the event types, and a decay rate for each of the event types, the baseline intensity providing information about how each of the event types has a tendency to occur on its own without any triggering event, and the decay rate providing information about a time scale for each of the event types; the instance-level causal analysis includes determining the triggering probability.

12. The computer system of claim 11, further comprising the program instructions executable to learn.

14. generating initial triggering probabilities; calculating the baseline intensity, the decay rate, and the sparse impact matrix based on the initial triggering probability; 14. The computer system of claim 13, further comprising the program instructions executable by:

15. updating the triggering probability in a current round of calculation based on the baseline intensity, the decay rate, and the sparse impact matrix calculated in a previous round of calculation; updating the baseline intensity, the decay rate, and the sparse impact matrix based on the updated triggering probability; outputting updated triggering probabilities for the current round of calculations in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have converged; iteratively updating the triggering probability, the baseline intensity, the decay rate, and the sparse impact matrix in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have not converged; 15. The computer system of claim 14, further comprising the program instructions executable by:

16. 1. A computer-implemented method for learning model parameters in probabilistic event triage, comprising: updating, by one or more computing devices, a baseline intensity of each one of the event types based on a triggering probability, the baseline intensity providing information about how each of the event types has a tendency to occur on its own without any triggering event, and the triggering probability representing a causal association probability between individual event instances; updating, by the one or more computing devices, a decay rate of the respective one of the event types based on the triggering probability, the decay rate providing information regarding a time scale of the respective one of the event types; updating, by the one or more computing devices, a sparse impact matrix based on the triggering probabilities, the sparse impact matrix representing causal relationships between the event types; the one or more computing devices updating the triggering probability based on the baseline intensity, the decay rate, and the sparse impact matrix; the one or more computing devices providing the triggering probabilities to a user for event triage in response to determining that the baseline intensities, the decay rates, and the sparse impact matrix converge; A computer-implemented method comprising:

17. The method of claim 16, further comprising: receiving, by the one or more computing devices, a predetermined constant for normalized intensity; the one or more computing devices generating initial triggering probabilities; the one or more computing devices calculating the baseline intensity, the decay rate, and the sparse impact matrix based on the initial triggering probability; The computer-implemented method of claim 16 further comprising:

18. The method of claim 17, wherein the one or more computing devices iteratively update the baseline intensity, the decay rate, the sparse impact matrix, and the triggering probability in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have not converged. The computer-implemented method of claim 16 further comprising:

19. 17. The computer-implemented method of claim 16, wherein the baseline intensity and the decay rate are updated by the one or more computing devices maximizing a likelihood function, and the convergence of the sparse impact matrix is ​​updated by the one or more computing devices calculating the sparse impact matrix by cardinality normalization.

20. 20. The computer-implemented method of claim 16, wherein the triggering probability is updated by the one or more computing devices by maximizing a variational lower bound on a likelihood function.

21. 1. A computer program for learning model parameters in probabilistic event triage, the computer program comprising program instructions embodied thereby, the program instructions executable by one or more processors, the program instructions comprising: updating a baseline intensity of each one of the event types based on a triggering probability, the baseline intensity providing information about how each of the event types has a tendency to occur on its own without any triggering event, and the triggering probability representing a causal association probability between individual event instances; updating a decay rate of the respective one of the event types based on the triggering probability, the decay rate providing information about a time scale of the respective one of the event types; updating a sparse impact matrix based on the triggering probabilities, the sparse impact matrix representing causal relationships between the event types; and updating the triggering probability based on the baseline intensity, the decay rate, and the sparse impact matrix; and in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix converge, providing the triggering probability to a user for event triage. Computer program.

22. receiving a predetermined constant for normalized intensity; generating initial triggering probabilities; calculating the baseline intensity, the decay rate, and the sparse impact matrix based on the initial triggering probability; 22. The computer program of claim 21, further comprising the program instructions executable by:

23. iterating convergence of the baseline intensity, the decay rate, the sparse impact matrix, and updating the triggering probability in response to determining that the baseline intensity, the decay rate, and the sparse impact matrix have not converged.

22. The computer program of claim 21, further comprising the program instructions executable by:

24. 22. The computer program of claim 21, wherein the baseline intensity and the decay rate are updated by maximizing a likelihood function, and the convergence of the sparse influence matrix is ​​updated by concentration normalization.

25. 25. The computer program of claim 21, wherein the triggering probability is updated by maximizing a variational lower bound on a likelihood function.

Images