Controller RNN for Automated Log Anomaly Detection

Solution Overview

Problem

In distributed systems, triaging system errors in real-time is challenging due to the complexity of combined logs from multiple services, requiring expert knowledge and domain-specific pattern recognition models, which are time-consuming and labor-intensive, and necessitate retraining for each microservice.

Innovation Solution

A system and method for automatically generating recurrent neural networks for log anomaly detection using a controller RNN that adjusts its hyperparameters to produce and retrain child RNNs, enabling efficient classification of anomalous logs without requiring extensive domain knowledge or manual hyperparameter tuning.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If pattern recognition algorithms and natural language processing are used to understand log context, then log classification accuracy is improved, but dependency on developers to write informative logs increases

Engineering Contradiction:

Improvelog classification accuracyVSAvoiddependency on developers

Core Design Contradiction:

Measurement precisionVSEase of operation

Solution Approach 1:

The system performs self-service by automatically generating and training neural network models without requiring developer intervention. The automated model generation system independently creates pattern recognition models, trains them on log data, and deploys them for anomaly detection, eliminating the need for developers to manually write informative logs or configure complex detection rules.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the mechanical system of manual log analysis and developer-dependent rule creation with an automated neural network-based system. Machine learning models automatically learn patterns from raw log data without requiring human-crafted rules or developer input, substituting automated computational processes for manual operational procedures.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If predictive algorithms are created that take into account timing and sequence of logs, then anomaly detection capability is improved, but domain knowledge requirements increase

Engineering Contradiction:

Improveanomaly detection capabilityVSAvoiddomain knowledge requirements

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs self-service by automatically generating and training neural network models without requiring developer intervention. The automated model generation system independently creates pattern recognition models, trains them on log data, and deploys them for anomaly detection, eliminating the need for developers to manually write informative logs or configure complex detection rules.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the mechanical system of manual log analysis and developer-dependent rule creation with an automated neural network-based system. Machine learning models automatically learn patterns from raw log data without requiring human-crafted rules or developer input, substituting automated computational processes for manual operational procedures.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If a new pattern recognition model is trained for each microservice's logs, then detection precision is improved, but time and effort required for model creation increases

Engineering Contradiction:

Improvedetection precisionVSAvoidtime and effort for model creation

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system achieves universality by creating a single automated model generation platform that can serve multiple microservices. The generated neural network models are designed to be adaptable across different services, allowing the same system to process and analyze logs from various microservices without requiring separate manual model creation for each one.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system performs preliminary action by pre-training generic anomaly detection models that can be quickly adapted to specific microservices. The automated generation system creates baseline models in advance that capture general anomaly patterns, which can then be rapidly fine-tuned for individual services without requiring extensive service-specific model development.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11669735B2System and method for automatically generating neural networks for anomaly detection in log data from distributed systems

Publication Date: 2023.06.06 VMWARE INC

AI summary

A system and method for automatically generating recurrent neural networks for log anomaly detection uses a controller recurrent neural network that generates an output set of hyperparameters when an input set of controller parameters is applied to the controller recurrent neural network. The output set of hyperparameters is applied to a target recurrent neural network to produce a child recurrent neural network with an architecture that is defined by the output set of hyperparameters. The child recurrent neural network is then trained, and a log classification accuracy of the child recurrent neural network is computed. Using the log classification accuracy, at least one of the controller parameters used to generate the child recurrent neural network is adjusted to produce a different input set of controller parameters to be applied to the controller recurrent neural network so that a different child recurrent neural network for log anomaly detection can be generated.