TRAINING AND SCORING FOR LARGE NUMBER OF PERFORMANCE MODELS

A method is presented to facilitate the training of a very large number of machine-learning performance models used to detect anomalies in computing operations. The models are grouped together according to model type, and are allocated to different pods of a computing environment that is used to carry out the operations being monitored. Initial training of models in a group is carried out while monitoring resource usage, and a particular pod is selected for further training based on the resource usage. The pod selected for training preferably has a minimum change in resource usage before and after the initial training. A different pod can be selected for scoring the trained models. The pod selected for scoring preferably has a maximum resource usage during an initial scoring among all pods.

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention generally relates to computer systems, and more particularly to a method of training performance models to detect operational anomalies.

Description of the Related Art

As computing operations become more complicated and the underlying infrastructures becomes less centralized, such as in cloud computing, it is increasingly important to be able to monitor such operations to optimize system performance. Many approaches have been devised to automatically detect potential anomalies in the functioning of large computing systems that might be indicative of serious operational problems. Some of these approaches use various models for the system that are based on temporal key performance indicators.

This area is part of a larger technological field referred to as information technology (IT) operations analytics, which attempts to discover complex patterns in high volumes of often noisy performance data. These analytics can include artificial intelligence for IT operations, referred to as AIOPs, that rely on cognitive systems. A cognitive system (sometimes referred to as deep learning) is a form of artificial intelligence that uses machine learning and problem solving. Cognitive systems often utilize neural networks although alternative designs can be used, such as a support vector machine (SVM) or Bayesian networks. A modern implementation of artificial intelligence is the Watson™ cognitive technology marketed by International Business Machines Corp.

Models used in anomaly detection can employ such cognitive systems. The models attempt to capture the normal functioning of the computing operations. If the current operational state significantly deviates from the model then a possible anomaly has been detected, and an alert can be generated for a supervisor or other automated solution. Different model types can be used in anomaly detection such as simple statistical methods or challenges, or machine-learning based approaches such as density-based, clustering-based, SVM-based, Bayesian networks, as well as custom detection models. Each model must be appropriately trained according to its model type, i.e., given a training data set indicating normal behavior of the system. The training can be unsupervised, supervised, or semi-supervised.

SUMMARY OF THE INVENTION

The present invention in at least one embodiment is generally directed to a computer-implemented method of training a monitoring system for detection of anomalies in computing operations by receiving details regarding performance models to be used in detecting the anomalies, forming a group of the performance models, selecting a particular one of the performance models in the group, training the particular performance model, and applying this training to remaining performance models in the group. In the illustrative implementation the performance models are trained using machine learning, and each of the performance models in the group has the same model type. The performance models can be embodied in respective computing containers of computing pods which provide shared storage, shared network resources and a shared context for all containers within a given computing pod, and a particular computing pod is selected for the training, the particular computing pod containing a training service that carries out the training. Selection of this computing pod can include determining that it has a minimum change in resource usage over a first period of time before initial training compared to a second period of time after initial training among all computing pods containing performance models in the group. The invention can further be implemented with additional scoring once performance models have been trained, by beginning initial scoring of trained performance models in certain computing pods, monitoring resource usages of those computing pods during the initial scoring, selecting a specific computing pod other than the computing pod used for training to continue scoring based on the resource usages, and completing scoring of a performance model using a scoring service contained in this specific computing pod. Selection of this computing pod can include determining that it has a maximum resource usage during the initial scoring among all pods carrying out the initial scoring.

The above as well as additional objectives, features, and advantages in the various embodiments of the present invention will become apparent in the following detailed written description.

DESCRIPTION OF THE PREFERRED EMBODIMENT(S)

When monitoring computing operations in large-scale applications such as a cloud-deployed database, it is important to be able to detect any kind of operational anomaly for a lot of different metrics. A typical monitoring system will build a performance model for each metric to improve the accuracy of the anomaly detection. However, in large computing operations this can result in the need for hundreds of thousands, or even more than a million different models. For example, a database bank having 2,000 related databases and 100 metrics for each database would need 200,000 models to be able to find anomalies in real time for each metric. This presents a huge problem in creating the models because they have to be trained individually based on the different model types and relevant metric data. Training for a single anomaly detection model can be extensive, so training such a large number of models becomes prohibitive. Once trained, they also need to be scored which can additionally be computationally intensive at this scale.

It would, therefore, be desirable to devise an improved method of managing the creation and evaluation of very large numbers of performance models. It would be further advantageous if the method could allow training and scoring of very large numbers of models in a system with relatively limited resources. These and other advantages are achieved in various implementations of the present invention by training models based on the number and type of models and resource usage over time while regulating the computational infrastructure (pods) and available resources. Training can be balanced by distribution to different pods. Models can be grouped according to type, and a particular pod can be selected for training a group based on resource usage. Model scoring can also be based on the resource consumption of the model scoring after packing the model in different pods.

With reference now to the figures, and in particular with reference toFIG. 1, there is depicted one embodiment 10 of a computer system in which the present invention may be implemented to carry out the training of performance models for anomaly detection in large-scale computing operations. Computer system10is a symmetric multiprocessor (SMP) system having a plurality of processors12a,12bconnected to a system bus14. System bus14is further connected to and communicates with a combined memory controller/host bridge (MC/HB)16which provides an interface to system memory18. System memory18may be a local memory device or alternatively may include a plurality of distributed memory devices, preferably dynamic random-access memory (DRAM). There may be additional structures in the memory hierarchy which are not depicted, such as on-board (L1) and second-level (L2) or third-level (L3) caches. System memory18has loaded therein one or more applications or program modules in accordance with the present invention. In an exemplary implementation, the applications include a database application with resource management tools, and the program modules include performance models along with training and scoring services.

MC/HB16also has an interface to peripheral component interconnect (PCI) Express links20a,20b,20c. Each PCI Express (PCIe) link20a,20bis connected to a respective PCIe adaptor22a,22b, and each PCIe adaptor22a,22bis connected to a respective input/output (I/O) device24a,24b. MC/HB16may additionally have an interface to an I/O bus26which is connected to a switch (I/O fabric)28. Switch28provides a fan-out for the I/O bus to a plurality of PCI links20d,20e,20f. These PCI links are connected to more PCIe adaptors22c,22d,22ewhich in turn support more I/O devices24c,24d,24e. The I/O devices may include, without limitation, a keyboard, a graphical pointing device (mouse), a microphone, a display device, speakers, a permanent storage device (hard disk drive) or an array of such storage devices, an optical disk drive which receives an optical disk25(one example of a computer readable storage medium) such as a CD or DVD, and a network card. Each PCIe adaptor provides an interface between the PCI link and the respective I/O device. MC/HB16provides a low latency path through which processors12a,12bmay access PCI devices mapped anywhere within bus memory or I/O address spaces. MC/HB16further provides a high bandwidth path to allow the PCI devices to access memory18. Switch28may provide peer-to-peer communications between different endpoints and this data traffic does not need to be forwarded to MC/HB16if it does not involve cache-coherent memory transfers. Switch28is shown as a separate logical component but it could be integrated into MC/HB16.

In this embodiment, PCI link20cconnects MC/HB16to a service processor interface30to allow communications between I/O device24aand a service processor32. Service processor32is connected to processors12a,12bvia a JTAG interface34, and uses an attention line36which interrupts the operation of processors12a,12b. Service processor32may have its own local memory38, and is connected to read-only memory (ROM)40which stores various program instructions for system startup. Service processor32may also have access to a hardware operator panel42to provide system status and diagnostic information.

In alternative embodiments computer system10may include modifications of these hardware components or their interconnections, or additional components, so the depicted example should not be construed as implying any architectural limitations with respect to the present invention. The invention may further be implemented in an equivalent cloud computing network.

When computer system10is initially powered up, service processor32uses JTAG interface34to interrogate the system (host) processors12a,12band MC/HB16. After completing the interrogation, service processor32acquires an inventory and topology for computer system10. Service processor32then executes various tests such as built-in-self-tests (BISTs), basic assurance tests (BATs), and memory tests on the components of computer system10. Any error information for failures detected during the testing is reported by service processor32to operator panel42. If a valid configuration of system resources is still possible after taking out any components found to be faulty during the testing then computer system10is allowed to proceed. Executable code is loaded into memory18and service processor32releases host processors12a,12bfor execution of the program code, e.g., an operating system (OS) which is used to launch applications and in particular the model training and scoring programs of the present invention, results of which may be stored in a hard disk drive of the system (an I/O device24). While host processors12a,12bare executing program code, service processor32may enter a mode of monitoring and reporting any operating parameters or errors, such as the cooling fan speed and operation, thermal sensors, power supply regulators, and recoverable and non-recoverable errors reported by any of processors12a,12b, memory18, and MC/HB16. Service processor32may take further action based on the type of errors or defined thresholds.

Computer system10carries out program instructions for an operations monitoring process that uses novel computational techniques to manage the creation and evaluation of very large numbers of performance models. Accordingly, a program embodying the invention may additionally include conventional aspects of various performance modeling tools, and these details will become apparent to those skilled in the art upon reference to this disclosure. Training is critical to proper operation of performance models, particularly cognitive systems, and itself constitutes a technical field. The present invention thus represents a significant improvement to the technical field of cognitive system training.

In some embodiments, one or more aspects of the present invention may be carried out using cloud computing. It is to be understood that although this disclosure includes a detailed description on cloud computing, implementation of the teachings recited herein are not limited to a cloud computing environment. Rather, embodiments of the present invention are capable of being implemented in conjunction with any other type of computing environment now known or later developed.

Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a provider of the service. This cloud model may include various characteristics, service models, and deployment models.

Characteristics can include, without limitation, on-demand service, broad network access, resource pooling, rapid elasticity, and measured service. On-demand self-service refers to the ability of a cloud consumer to unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with the service's provider. Broad network access refers to capabilities available over a network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and personal digital assistants, etc.). Resource pooling occurs when the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to demand. There is a sense of location independence in that the consumer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Rapid elasticity means that capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time. Measured service is the ability of a cloud system to automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

Service Models can include, without limitation, software as a service, platform as a service, and infrastructure as a service. Software as a service (SaaS) refers to the capability provided to the consumer to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. Platform as a service (PaaS) refers to the capability provided to the consumer to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations. Infrastructure as a service (IaaS) refers to the capability provided to the consumer to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).

Deployment Models can include, without limitation, private cloud, community cloud, public cloud, and hybrid cloud. Private cloud refers to the cloud infrastructure being operated solely for an organization. It may be managed by the organization or a third party and may exist on-premises or off-premises. A community cloud has a cloud infrastructure that is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on-premises or off-premises. In a public cloud, the cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services. The cloud infrastructure for a hybrid cloud is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds).

A cloud computing environment is service oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes. An illustrative cloud computing environment50is depicted inFIG. 2. As shown, cloud computing environment50includes one or more cloud computing nodes52with which local computing devices used by cloud consumers, such as, for example, personal digital assistant (PDA) or cellular telephone54a, desktop computer54b, laptop computer54c, and/or automobile computer system54dmay communicate. Nodes52may communicate with one another. They may be grouped (not shown) physically or virtually, in one or more networks, such as private, community, public, or hybrid clouds as described hereinabove, or a combination thereof. This allows cloud computing environment50to offer infrastructure, platforms and/or software as services for which a cloud consumer does not need to maintain resources on a local computing device. It is understood that the types of computing devices54a-54dshown inFIG. 2are intended to be illustrative only and that computing nodes52and cloud computing environment50can communicate with any type of computerized device over any type of network and/or network addressable connection (e.g., using a web browser).

In the illustrative implementation, certain aspects of the present invention can be carried out by a cloud server or cloud computing system. The cloud computing system may for example include a node52ofFIG. 2having an architecture like computer system10ofFIG. 1or other architectures, in communication with clients via the Internet. The cloud computing system may host any number and type of applications.FIG. 3illustrates a cloud computing system60in accordance with one implementation of the present invention which is deployed on a cloud platform62such as the IBM Cloud™ platform. The IBM Cloud™ platform is a suite of cloud computing services from International Business Machines Corp. (IBM) that offers both platform as a service (PaaS) and infrastructure as a service (IaaS). Further to this example, cloud platform62hosts a database application such as a Db2 database. Db2 is a family of data management products, including database servers, developed by IBM. It was initially designed as a relational database management system but was extended to support object-relational features and non-relational structures like JSON and XML file formats.

In this implementation database application64is embodied in a Kubernetes-type computing infrastructure such as the IBM Cloud™ Kubernetes Service. This service is a managed offering built for creating a Kubernetes cluster of compute hosts to deploy and manage containerized apps on the IBM Cloud™. Kubernetes defines a set of building blocks (primitives), which collectively provide mechanisms that deploy, maintain, and scale applications based on CPU, memory, or custom metrics. The service includes a master or controller66and a plurality of pods. Pods are the smallest deployable units of computing or scheduling that can be created and managed in Kubernetes. A pod is a group of one or more containers, with shared storage and network resources, and a specification for how to run the containers. A pod's contents are always co-located and co-scheduled, and run in a shared context. For the Db2 application, pods may include storage pods67, Db2 pods68, and model pods70. Storage pods67house the actual operand data that is the subject of the particular database. Db2 pods68handle the database operations. Model pods70contain the performance models used to detect anomalies in the operations of the Db2 database. There may be other pods not shown. Controller66carries out resource management for the cluster such as increasing the number of pods as needed or deleting a pod when it is no longer being used, as well as selecting pods for model training and scoring as discussed further below. Controller66can also provide a metric collection service that measures resource utilization for different pods or containers, such as CPU, memory and I/O usage.

Model training can be understood with further reference toFIG. 4which shows a model pod70′ in accordance with the exemplary implementation. Model pod70′ has a plurality of models72therein (0 through N). This particular group of models are all of the same model type. A given model pod can be dedicated to only one group or can handle multiple model groups. Some models in a group are allocated in different pods to balance resource utilization, andFIG. 4is representational of each of those pods.

A training service74is used to train the various models72. Although training service74could be located in a different pod, it is advantageously located in the same pod whose models are being trained. There can be multiple training services for different pods or groups. Training service74carries out a training process that first conducts initial, limited training for all of the models72on different pods70′, using conventional training techniques. The initial training is limited in that it involves substantially fewer training data sets than required for reliable training. After this initial training, a single pod70′ is selected to complete the training as described further below in conjunction withFIG. 5. Once the optimum pod for training is selected, a given model in that pod undergoes complete training. This finished training is then applied to all models of that type, greatly simplifying the task of training large numbers of models. The finished training may be applied in various ways according to the nature of the particular model involved. For example, in a model using a neural network infrastructure, the finished training is embodied in the sets of weights and biases for the neural nodes, and these parameters can be easily copied from the trained model and programmed into the other models.

In the preferred embodiment, the pod used for training is selected by considering resource usage over time. As shown inFIG. 4, for a given model i at time t, the model's CPU usage is denoted as C(i,t), the model's memory usage is denoted as M(i,t), and the model's I/O usage is denoted as I(i,t). Pod metrics80can then be computed as seen inFIG. 5. CPU usage SC(t) for a given pod is computed as Σ0NC(i,t), memory usage SM(t) for a given pod is computed as Σ0NM(i,t), and I/O usage SI(t) for a given pod is computed as Σ0NI (i,t). The summary of resource usage for a given pod can then be expressed as:

where w1, w2, and w3are weights set by designer preference. The weights w1, w2, and w3are generally determined by the model types as well as any limitations on resources. For example, if most of the models need lot of memory, w2will be relatively large, and if a system lacks CPU power, w1will be relatively large. The pod selected for training is that one whose change in maximum resource usage over a first period of time before new training started compared to a second period of time after new training started is a minimum among all pods, i.e.:

where maxt1(Sn(t1)) means the maximum value at time t1if training has started and maxt2(S(t2)) means the maximum value at time t2if training has not started. Formula (1) is further subject to the constraint that SC(t), SM(t) and SI(t) must all be less than a maximum respective value according to the availability of the resource.

The training of the present invention may be further understood with reference to the chart ofFIG. 6which shows a computer-implemented training process90in accordance with one implementation. Process90begins by receiving92the details regarding the models to be used in detecting anomalies arising from operations of the particular application involved. These details include the number and types of models, and metrics used for each model. Models are then grouped94according to type, and the groups are allocated96among different pods to balance resource utilization. Limited training of all models in the pods is carried out98. Resource usages for the pods are computed100, and a pod is selected for further training102according to formula (1) above. Full training is then completed104for models in this selected pod, and this training is applied106to other models.

Once training is finished, it is necessary to score the models in order to evaluate their accuracy. Training process90can thus continue with the selection108of a single pod for scoring purposes, in order to again optimize computational efficiency in scoring what would otherwise be a very large number of performance models. This selection process is described further below in conjunction withFIG. 7. After scoring, models can be evaluated110to judge their accuracy, and process90ends. If models score poorly, more training can be instituted.

In the exemplary implementation, a particular one of the pods is again selected to optimize the process, but this time for scoring rather than training. In other words, the optimum pod for scoring may be different than the optimum pod for training. As seen inFIG. 4, a pod70′ may in some implementations have a scoring service76. Scoring service76may alternatively be in a different pod so the number of pods can be reduced after training.FIG. 7shows the scoring pod selection process108carried out by scoring service76. Scoring process108starts by allocating120the scoring requirements for the pods to balance resource utilization. Initial scoring then begins122in all pods. As scoring progresses, resource usage of the scoring services is monitored124. The pod with the maximum resource usage is selected for continued scoring126, as this pod is deemed the most extensive scoring of all of the scoring services. Scoring of the trained model can then be finished128with the selected pod. The present invention thus provides a superior approach for the training and scoring of very large numbers of performance models, in a manner that regulates system resources in an optimum manner.

Although the invention has been described with reference to specific embodiments, this description is not meant to be construed in a limiting sense. Various modifications of the disclosed embodiments, as well as alternative embodiments of the invention, will become apparent to persons skilled in the art upon reference to the description of the invention. It is therefore contemplated that such modifications can be made without departing from the spirit or scope of the present invention as defined in the appended claims.