Method and system for implementing a cloud machine learning environment

An embodiment of the present invention is directed to leveraging GPU farms for machine learning where the selection of data is self-service. The data may be cleansed based on a classification and automatically transferred to a cloud services platform. This allows an entity to leverage the commoditization of the GPU farms in the public cloud without exposing data into that cloud. Also, an entire creation of a ML instance may be fully managed by a business analyst, data scientist and/or other users and teams.

FIELD OF THE INVENTION

The invention relates generally to a system and method for implementing a cloud machine learning environment.

BACKGROUND OF THE INVENTION

Currently, entities are required to leverage Graphics Processing Unit (GPU) farms or clusters to properly perform machine learning (ML) activities. These are non-commodity devices whose sole purpose is to perform ML. Accordingly, to create any ML activities, a significant amount of effort including IT resources are required to setup and plan.

These and other drawbacks exist.

SUMMARY OF THE INVENTION

According to one embodiment, the invention relates to a system for implementing a self-service, auto prep and cleanse cloud machine learning environment. The system comprises: a data source interface that communicates with a plurality of data sources; an interactive interface that communicates with a user via a network communication; and a processor coupled to the memory component and the interactive interface, the processor configured to perform the steps of: receiving, via a discovery portal, a user request that identifies a data set; performing data provisioning that accesses the data set from one or more internal data sources; creating a machine learning instance in a cloud services platform; transferring the data set from the one or more internal data sources to a cloud data storage associated with the cloud services platform; cleansing the data set during the transferring step; and applying machine learning analytics to the transferred dataset in the cloud data storage.

The computer implemented system and method described herein provide unique advantages to entities, organizations and other users, according to various embodiments of the invention. An embodiment of the present invention is directed to enhancing data integrity and preserving confidentiality of data in a manner that is useable for machine learning and other applications. The innovative system and method facilitates machine learning activities and tasks by enabling users to make requests via a self-service portal. Accordingly, a system and method of an embodiment of the present invention provides improved utilization, resource efficiencies and substantial cost savings. These and other advantages will be described more fully in the following detailed description.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT(S)

The following description is intended to convey an understanding of the present invention by providing specific embodiments and details. It is understood, however, that the present invention is not limited to these specific embodiments and details, which are exemplary only. It is further understood that one possessing ordinary skill in the art, in light of known systems and methods, would appreciate the use of the invention for its intended purposes and benefits in any number of alternative embodiments, depending upon specific design and other needs.

Large scale cloud companies have created machine learning (ML) GPU farms on a per-use basis. An embodiment of the present invention is directed to leveraging these farms for machine learning with the additional requirement that the selection of data is self-service. With an embodiment of the present invention, data may be classified to properly protect sensitive and confidential data and also pre-cleansed based on the classification. The data may then be auto-transmitted to a cloud services platform. This allows an entity to leverage the commoditization of the GPU farms in the public cloud without exposing and compromising the data to the cloud. Also, an entire creation of a ML instance may be fully managed by a business analyst, data scientist and/or other user.

An embodiment of the present invention is directed to implementing discovery zones in a big data platform that support deep analytics and machine learning techniques. For example, customer data may be evaluated to provide better experiences for a specific customer. This process may involve analyzing sensitive customer data that needs to be protected, according to regulations and other standards. An embodiment of the present invention leverages a cloud services platform in a manner that preserves confidentiality of sensitive customer personally identifiable information (PII). An embodiment of the present invention may apply rules based on categorizations that define how to treat and/or protect the data.

For example, a user may select data to be moved into a discovery zone. By initiating this transfer, an embodiment of the present invention may create and/or apply rules on how to treat the data. This may involve how to maintain confidentiality and data integrity where highly confidential data (e.g., social security number) may be encrypted, tokenized and/or otherwise protected. In this example, when machine learning techniques are applied to the data, the confidentiality of the data may be preserved, e.g., social security number is not discoverable. And, in many instances, the actual social security number is not essential to the analysis, action or task.

FIG. 1is an exemplary flowchart for implementing a cloud machine learning environment, according to an embodiment of the present invention. At step110, a set of data lakes may be identified. At step112, data may be selected from a catalog. At step114, a user may create a Machine Learning (ML) instance in a public cloud. At step116, the selected data may be accessed within internal data lakes. At step118, the data may be moved from the internal lakes to a cloud data storage. At step120, once data is moved, the user may be given access to the public cloud space. At step122, an auto update may be performed. The order illustrated inFIG. 1is merely exemplary. While the process ofFIG. 1illustrates certain steps performed in a particular order, it should be understood that the embodiments of the present invention may be practiced by adding one or more steps to the processes, omitting steps within the processes and/or altering the order in which one or more steps are performed. The steps will be described in more detail below.

At step110, a set of data lakes may be identified. For example, a large set of data lakes with a data catalog that understands the data types, classification (e.g., security level, etc.) and where the data is located may be provided.

At step112, data may be selected from a catalog. Data may be selected from other sources of data as well.

At step114, a user may create a ML instance in a public cloud. The public cloud may include components, services and functionality related to machine learning, sandboxes, data transformation, consumption, logging, monitoring, etc. Machine learning services may provide building, training and deployment of machine learning models. Sandboxes may include storage services, e.g., object storage services, block storage, file systems, etc. Data transformation may include big data processing and analysis, such as processing unstructured data in parallel across distributed clusters of processors or computers. Data consumption may include interactive queries services, data warehouse services, NoSQL database services, and business analytics services. Logging and monitoring may include monitoring and management services.

At step116, the selected data may be accessed within internal data lakes. Other internal sources may be accessed.

At step118, the data may be moved from the internal lakes to a cloud data storage. While moving the data, the data may be cleansed for protection based on classification rules. For example, cleansing may be in the form of: one way hash encryption, two way keyed encryption, data conversion and/or left in clear text. Other security features may be applied. In addition, before cleansing, an embodiment of the present invention may run or execute an analysis on a portion of the data to avoid misclassifications and/or other errors.

At step120, once data is moved, the user may be given access to the public cloud space for performing actions, such as analytics and other tasks.

At step122, an auto update may be performed. This may be performed to maintain current and relevant data. For example, on a regular cadence (e.g., real-time, hourly, nightly, weekly, etc.), an auto-update on the cloud data may be performed with new data from the internal data lakes. The auto-update may involve performing the auto-cleansing.

FIG. 2is an exemplary system diagram of sandbox creation, according to an embodiment of the present invention. An embodiment of the present invention enables data scientists (and other users) to merge data from multiple sources for analysis and machine learning in cloud services platform in a secure way. Data may be provisioned to a cloud services platform from Unified Data Services (UDS), other Consumer and Community Banking (CCB) data sources, user provided data (UPD), etc. An embodiment of the present invention further facilitates use of machine learning applications and frameworks, including SageMaker, TensorFlow, MxNet, Athena, EMR, QuickSight, Redshift, Glue, etc. Moreover, the data is secure in a public cloud platform.

As shown inFIG. 2, User202may submit a request at210, which may include discovery portal access, discovery personal and/or shared sandbox roles, Hadoop access roles, object storage access roles, etc., as shown by212. System Access Manager may facilitate the request, approval, fulfillment (e.g., automated and manual) and processes of access to resources, such as database, active-directory groups, LDAP groups, server access, etc. A user may also request a personal sandbox (at214) or a shared sandbox and further create Hadoop Distributed File System (HDFS), Hive/Impala Schemas, Hive/Impala Tables, Ranger or Cloud-platform specific access Policies, etc., as represented by222and224. As shown inFIG. 2, User202may access Discovery Portal216to request a personal sandbox. Discovery Portal216may access Sandbox Application Program Interface (API)218and Sandbox Orchestration220. MS represents a messaging service or it may be an API. From Sandbox Orchestration220, API for cloud services may be initiated at222(e.g., Hadoop API) and/or at226(e.g., Cloud Services API). Hadoop API222may access a set of tools represented by Distributed Data Platform224. Hadoop API222may create HDFS, Hive Schema, Ranger Policies, etc. Cloud Services API226may enable a user to create a bucket folder and perform other actions in a cloud services platform. Through Channel228and Active Directory230, Cloud Services Platform240may be accessed. Cloud Services Platform240may include Connection/Gateway, Storage and Identify and Access Management (IAM) components and services. Active Directory may represent a directory service that authenticates and authorizes users and computers in a domain type network by assigning and enforcing security policies. Other directory services may be supported.

Access Control may include user authentication and authorization as well as controlled access to data. User authentication and authorization may involve leveraging Single Sign-On (SSO) and Active Directory, integration with an entity's directory, audit availability via cloud services. With controlled access to data, each sandbox may have active directory groups and corresponding cloud services user groups. A user may request membership with approvals workflow. Further, each sandbox and/or object may have permission policies associated with an active directory groups or End User's Unique Identifier or SID (Standard Identifier). Depending on the use case, data and collaboration, personal sandbox and/or shared sandbox may be used. Audit features are also available via cloud services.

FIG. 3is an exemplary system diagram of a discovery application access, according to an embodiment of the present invention.FIG. 3illustrates the interaction between an Entity302and a Cloud Services Platform304. Entity302may include Data Sources310, Unified Data Services (UDS) Discovery Application312, Active Directory Federation Services (ADFS)314and Active Directory316. Other signal sign-on and directory services solutions and tools may be supported. Cloud Services Platform304may include Identify and Access Management (IAM)320, Key Management Services (KMS)322, Sandbox324, Sandbox326and Data and Access Monitoring328. Data Sources310may include UDS Data, user provided data, etc.

As shown byFIG. 3, UDS Discovery Application312may request a token from ADFS314via340. ADFS314may request Federated Identity (FID) Authentication from Active Directory316via342. Other authentications may be performed. ADFS314may then forward Security Assertion Markup Language (SAML) token to UDS Discovery Application312, via344. SAML is one example; other languages and security standards may be applied. As shown by346, UDS Discovery Application312may post the SAML token to a Sign-in Service via IAM320. IAM320may forward Access Keys via348. UDS Discovery Application312may then forward Access KMS to Key Management Service322via350. Key management service322may get encryption keys from UDS Discovery Application312via352. UDS Discovery Application312may provision data to Sandbox324via354.

IAM320may support IAM User Groups, IAM Users, IAM User Policies, IAM Resources Policies. IAM may be linked with Active Directory.

Sandbox324,326may include Buckets or Base Folders, User Groups and Encryption Keys. For example, each Sandbox may have an associated User groups which may be linked with Corporate AD Groups. Each Sandbox may have corresponding policies and permissions which give access to a single sandbox only. Each Sandbox and Objects may have corresponding encryption keys. Data and Access Monitoring functions and features may be provided by328.

FIG. 4is an exemplary system diagram of data provisioning to a cloud service, according to an embodiment of the present invention.FIG. 4illustrates the interaction between an Entity402and a Cloud Services Platform404. As shown inFIG. 4, the process may include Discovery Provisioning412, On-Premise Hadoop Sandbox414, Data Preparation416, Controls and Tollgates418, Data Obfuscation (at rest)420, Publisher422, Channel424, Receiver426, Data Decryption (at rest)428and On-Premise Hadoop Sandbox430.

FIG. 4further illustrates moving machine learning models back to Unified Data Services (UDS). As shown inFIG. 4, data sources410are represented as UDS data, data warehouses and user provided data (UPD). Discovery provisioning412may be requested via a Discovery Portal432accessed by User406. During discovery provisioning, a user may specify data or sets of data. Through Discovery Portal432, users may select data set(s) or a load user provided data (UPD) function. Users may also define data selection criteria; identify Protection Group (PG) Classification for UPD as well as select target platform (e.g., Hadoop, AWS, other cloud platforms, etc.). Hadoop sandboxes may be created. The data is then prepped which may involve categorization and applying a level of protection at416. Controls and Tollgates may be applied at418. Data Obfuscation may be applied to protect the data at420.

On-Premise Hadoop Sandbox414may access data relating to Firm Classification, Protection Group Classification and Data. For example, Firm Classification may include level of confidentiality, e.g., Highly Confidential, Confidential, Internal, etc. Protection Group Classification for Highly Confidential may include High Confidential PI, High Confidential, Government Identifiers, Authenticators, Confidential PI, etc. Protection Group Classification for Confidential may include Confidential, PI Direct Identifiers, Risk Scores, etc. Data may be role based access control (RBAC).

Data Obfuscation (at rest)420may access data relating to Firm Classification, Protection Group Classification, Encryption/Decryption Required, Decryption NOT Required. Encryption/Decryption Required may indicate whether encryption or decryption is required and what type. For example, this may include Format Preserving Encryption. Decryption NOT Required may indicate whether decryption is required or not and what type. This may include Hash, Mask, Tokens, RBAC Based, etc.

Publisher422may publish data through Channel424. For example, data from Cloud Services Platform404may be received by Entity402, via440. In addition, Entity402may exchange data, ML models and results with Cloud Services Platform404, via440. Receiver426may use cloud platform SDK/APIs. Receiver426may also receive model, results back from Cloud Platform.

On-Premise Hadoop Sandbox430may provide staging before promoting to cloud platform, on-premise analysis, build and train ML models, save ML models, receive results from cloud platform, etc.

Entity402may communicate with Cloud Services Platform404through channel424where data, ML models and results may be exchanged. Cloud Services Platform404may include Sandbox450. Sandbox450may communicate with Monitoring Services for cloud resources, Data Protection Services, Monitoring Services for user activities and Key Management Service. Monitoring Services for cloud resources may collect and track metrics; collect and monitor log files and set alarms. Monitoring Services for user activities may monitor user activities and API usage. Data Protection Services may automatically discover, classify and protect sensitive data and further provide data visibility and alerting.

Sandbox450may access data relating to Firm Classification, Protection Group Classification and Data. For example, Firm Classification may include level of confidentiality, e.g., Highly Confidential, Confidential, Internal, etc. Protection Group Classification for Highly Confidential may include High Confidential PI, High Confidential, Government Identifiers, Authenticators, Confidential PI, etc. Protection Group Classification for Confidential may include Confidential, PI Direct Identifiers, Risk Scores, etc. Data may include data encrypted with Keys.

FIG. 5is an exemplary system diagram of cloud services and consumption, according to an embodiment of the present invention. Cloud Services Platform500may include components and services represented by Machine Learning528, Sandboxes526, Transformation530, Consumption524and Logging Monitoring532. Machine Learning528may represent services that enable users to build, train and deploy machine learning models. Sandboxes526may represent storage services including object storage services. Transformation530may represent big data processing and analysis tools that process massive amounts of unstructured data in parallel across distributed clusters of processors or computers. Consumption524may represent services to perform interactive queries as well as manage data warehouse services, NoSQL database services, and business analytics services. Logging Monitoring532may represent monitoring and management services as well as governance, compliance, operational auditing and risk auditing services. Other services may include enterprise security platforms and services including capturing, indexing and correlating real-time data.

As shown inFIG. 5, data may be loaded to Sandboxes at502. Data may be aggregated and transformed at530via504. Data may be loaded to databases via506. Queries may be read from Sandboxes via508. Other data consumption functions may be supported at524. Logging and Monitoring functions532may be performed via interfaces at510, which may be forwarded to Logging as a Service (LaaS)534. Business Intelligence Delivery Center (BIDC) or Business Intelligence Tools represented by522may be used to access data via512by User520.

The Figures refer to a particular cloud services platform for illustration purposes. Other cloud services platforms may be implemented in accordance with the various embodiments of the present invention.

FIGS. 6-10represent exemplary user interfaces, according to an embodiment of the present invention.FIGS. 6-10may represent exemplary interfaces for a Discovery Portal.

FIG. 6illustrates Sandbox details, according to an embodiment of the present invention. A user may navigate to actions available for each Sandbox, such as Attest, Manage Objects and Drop.FIG. 6illustrates a Manage Sandboxes interface610. Users may create sandboxes and view and manage existing sandboxes. Information may include Name, Sandbox Identifier, Schema Name, RBAC Profile, AD Role, PG Role, Owners, Members, Created By, Created Time, Expiration Period, Status, Shared Type, and Action. Status may include Created, Creation in Progress, Failed, etc.

FIG. 7illustrates Objects interface, according to an embodiment of the present invention.FIG. 7illustrates details for objects in a current Sandbox. A user may navigate to actions available for a given object, such as Drop, Protection Group (PG) Classify and Share.FIG. 7illustrates a Manage Objects interface710. The Interface may provide summary information as shown by Sandbox Name, Schema Name, Sandbox Type at710; Objects Count, Sandbox Status and Sandbox Members Count at712; and Created by, Sandbox Owner(s) and Sandbox Owners Count at714. Users may create Hive tables and view and manage existing objects at716. Object information may include Object Name, Object Type, Schema Name, Created On, Created By, Owner, Object Status, PG Status, Share Mode, Expiration (Days), Action.

Through the interface ofFIG. 7, a user may share objects. After a Hive/Impala table has been PG Classified, the Object's status may be listed as PG-CLASSIFIED. Under Actions, a user may choose Share, e.g., Share Read Only, Share Read/Write, etc.

FIG. 8illustrates a Create New Sandbox interface, according to an embodiment of the present invention.FIG. 8illustrates a Create Sandbox interface810. As shown byFIG. 8, a user may identify Platform Type812, Sandbox Type814, Sandbox Name816, Purpose818, Profile data820, Protection Group Roles822, Profile Members824and Approvers826.

FIG. 9illustrates a Create a New Hive/Impala Table interface, according to an embodiment of the present invention.FIG. 9illustrates a Create Hive Table interface910. Other types of tables and data structures may be created. As shown byFIG. 9, a user may identify Schema Name912, Table Name914and Description916. Column data may include position, field name, data type, length, precision, scale, and action, as shown by918. Data type may include Date, Float, etc. Other options may include File Format, which may include Sequence File, Text File, RC File, ORC, Parquet, Avro, JSON file and Input Format, as shown by920.

FIG. 10illustrates a PG Classification interface, according to an embodiment of the present invention.FIG. 10illustrates a Protection Group Classification interface1010. Users may identify what protection groups are allowed in a sandbox.FIG. 10indicates that protection groups CNFD and INTL are allowed as shown by1012. Details may include Attribute, Data Type, PG Code and PG Name. Notifications may be provided, including warning. For example, a PG Code that is not within the allowed protection groups may be highlighted. If there are any warnings, they may be displayed in red, for example. This indicates that a PG Classification is out-of-bounds for the PG Codes defined for this Sandbox.

The various features of an embodiment of the present invention may be applied to other applications, uses and scenarios. For example, an embodiment of the present invention may be applied to procurement decisions and other hardware, configuration and infrastructure decisions. An embodiment of the present invention may be applied to identify underlying trends and patterns to address various automation incompatibilities and other issues.

The foregoing examples show the various embodiments of the invention in one physical configuration; however, it is to be appreciated that the various components may be located at distant portions of a distributed network, such as a local area network, a wide area network, a telecommunications network, an intranet and/or the Internet. Thus, it should be appreciated that the components of the various embodiments may be combined into one or more devices, collocated on a particular node of a distributed network, or distributed at various locations in a network, for example. As will be appreciated by those skilled in the art, the components of the various embodiments may be arranged at any location or locations within a distributed network without affecting the operation of the respective system.

As described above, the various embodiments of the present invention support a number of communication devices and components, each of which may include at least one programmed processor and at least one memory or storage device. The memory may store a set of instructions. The instructions may be either permanently or temporarily stored in the memory or memories of the processor. The set of instructions may include various instructions that perform a particular task or tasks, such as those tasks described above. Such a set of instructions for performing a particular task may be characterized as a program, software program, software application, app, or software.

Data and information maintained by the servers may be stored and cataloged in one or more databases, which may comprise or interface with a searchable database and/or a cloud database. The databases may comprise, include or interface to a relational database. Other databases, such as a query format database, a Standard Query Language (SQL) format database, a storage area network (SAN), or another similar data storage device, query format, platform or resource may be used. The databases may comprise a single database or a collection of databases. In some embodiments, the databases may comprise a file management system, program or application for storing and maintaining data and information used or generated by the various features and functions of the systems and methods described herein.

As described above, a set of instructions is used in the processing of various embodiments of the invention.FIGS. 2-5may include software or computer programs stored in the memory (e.g., non-transitory computer readable medium containing program code instructions executed by the processor) for executing the methods described herein. The set of instructions may be in the form of a program or software or app. The software may be in the form of system software or application software, for example. The software might also be in the form of a collection of separate programs, a program module within a larger program, or a portion of a program module, for example. The software used might also include modular programming in the form of object oriented programming. The software tells the processor what to do with the data being processed.

Further, it is appreciated that the instructions or set of instructions used in the implementation and operation of the invention may be in a suitable form such that the processor may read the instructions. For example, the instructions that form a program may be in the form of a suitable programming language, which is converted to machine language or object code to allow the processor or processors to read the instructions. That is, written lines of programming code or source code, in a particular programming language, are converted to machine language using a compiler, assembler or interpreter. The machine language is binary coded machine instructions that are specific to a particular type of processor, i.e., to a particular type of computer, for example. Any suitable programming language may be used in accordance with the various embodiments of the invention. For example, the programming language used may include assembly language, Ada, APL, Basic, C, C++, COBOL, dBase, Forth, Fortran, Java, Modula-2, Pascal, Prolog, REXX, Visual Basic, and/or JavaScript. Further, it is not necessary that a single type of instructions or single programming language be utilized in conjunction with the operation of the system and method of the invention. Rather, any number of different programming languages may be utilized as is necessary or desirable.

Also, the instructions and/or data used in the practice of various embodiments of the invention may utilize any compression or encryption technique or algorithm, as may be desired. An encryption module might be used to encrypt data. Further, files or other data may be decrypted using a suitable decryption module, for example.

In the system and method of exemplary embodiments of the invention, a variety of “user interfaces” may be utilized to allow a user to interface with the mobile devices or other personal computing device. As used herein, a user interface may include any hardware, software, or combination of hardware and software used by the processor that allows a user to interact with the processor of the communication device. A user interface may be in the form of a dialogue screen provided by an app, for example. A user interface may also include any of touch screen, keyboard, voice reader, voice recognizer, dialogue screen, menu box, list, checkbox, toggle switch, a pushbutton, a virtual environment (e.g., Virtual Machine (VM)/cloud), or any other device that allows a user to receive information regarding the operation of the processor as it processes a set of instructions and/or provide the processor with information. Accordingly, the user interface may be any system that provides communication between a user and a processor. The information provided by the user to the processor through the user interface may be in the form of a command, a selection of data, or some other input, for example.

The software, hardware and services described herein may be provided utilizing one or more cloud service models, such as Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS), and/or using one or more deployment models such as public cloud, private cloud, hybrid cloud, and/or community cloud models.

Although the embodiments of the present invention have been described herein in the context of a particular implementation in a particular environment for a particular purpose, those skilled in the art will recognize that its usefulness is not limited thereto and that the embodiments of the present invention can be beneficially implemented in other related environments for similar purposes.