Cognitive balancing IT ecosystems

An approach is provided in which an information handling system loads a set of event data corresponding to an information technology (IT) ecosystem into a blockchain framework. The blockchain framework, in turn, generates a set of anomaly data based on the set of event data. The information handling system identifies a set of parameter values to adjust corresponding to the IT ecosystem based on the set of anomaly data, and the information handling system then optimizes the IT ecosystem by adjusting the identified set of parameter values in the IT ecosystem.

BACKGROUND

New technologies are making business more intelligent, fast and scalable. As the world becomes more connected, organizations encounter increasingly difficulty competing as solo entities. In today's era of exponentially increasing data and information, and ubiquitous digitization, a new economic equation favors transparency and collaboration between businesses.

In search of innovation, businesses are opening up their enterprises and removing barriers to extend collaboration both inside and outside their organizations. As a result, the focus of innovation is shifting from organization-centric to one that is ecosystem-centric. An ecosystem can be thought of as a complex web of interdependent enterprises and relationships that creates and allocates business value. Ecosystems are broad by nature, potentially spanning multiple geographies and industries, including public and private institutions and consumers.

Along those lines, information technology (IT) ecosystems encompass a network of organizations that drive the creation and delivery of information technology products and services. One type of an IT ecosystem includes a product platform defined by a platform owner's core components and complemented by peripheral applications made by autonomous companies. These IT ecosystems offer solutions comprising a larger system of use than the platform owner's original platform to solve important technical problems within an industry. In successful IT ecosystems, connecting to or building upon the core solution expands the system of use and allows new and even unanticipated end uses.

Existing approaches of balancing IT ecosystems are largely driven by human endeavors that are supported by IT systems management processes, IT service management processes, spreadsheets, and staff/consultants. Challenges found with this approach include slow and cumbersome adaptation to change in the IT ecosystem when recoding/reconfiguring the existing management systems. Another challenge found is that the operational quality and success of evolving the IT ecosystem is closely aligned to the skills and experience of the staff/consultants owning/running the balancing & optimization processes. As a result, as the skilled staff/consultants move onto different jobs, the capability often moves with them. In short, the more complex an IT ecosystem, the less likely the IT ecosystem is successfully managed to achieve an optimal balance of desired business outcomes.

BRIEF SUMMARY

According to one embodiment of the present disclosure, an approach is provided in which an information handling system loads a set of event data corresponding to an information technology (IT) ecosystem into a blockchain framework. The blockchain framework, in turn, generates a set of anomaly data based on the set of event data. The information handling system identifies a set of parameter values to adjust corresponding to the IT ecosystem based on the set of anomaly data, and the information handling system then optimizes the IT ecosystem by adjusting the identified set of parameter values in the IT ecosystem.

According to an aspect of the present invention there is a method, system and/or computer program product that performs the following operations (not necessarily in the following order): (i) loading a set of event data corresponding to an information technology (IT) ecosystem into a blockchain framework; (ii) generating, by the block chain framework, a set of anomaly data based on the set of event data; (iii) identifying a set of parameter values to adjust corresponding to the IT ecosystem based on the set of anomaly data; and (iv) optimizing the IT ecosystem by adjusting the identified set of parameter values in the IT ecosystem.

DETAILED DESCRIPTION

ExpressCard155is a slot that connects hot-pluggable devices to the information handling system. ExpressCard155supports both PCI Express and Universal Serial Bus (USB) connectivity as it connects to Southbridge135using both the USB and the PCI Express bus. Southbridge135includes USB Controller140that provides USB connectivity to devices that connect to the USB. These devices include webcam (camera)150, infrared (IR) receiver148, keyboard and trackpad144, and Bluetooth device146, which provides for wireless personal area networks (PANs). USB Controller140also provides USB connectivity to other miscellaneous USB connected devices142, such as a mouse, removable nonvolatile storage device145, modems, network cards, Integrated Services Digital Network (ISDN) connectors, fax, printers, USB hubs, and many other types of USB connected devices. While removable nonvolatile storage device145is shown as a USB-connected device, removable nonvolatile storage device145could be connected using a different interface, such as a Firewire interface, etcetera.

As discussed above, managing IT ecosystems presents many challenges because the IT ecosystems are largely managed by human endeavors supported by IT systems management processes, IT service management processes, spreadsheets, and staff/consultants. In addition, a lack of an overall orchestration or coordinated mechanism exists to identify root causes for systemic outages or performance issues within an IT ecosystem.

FIGS. 3 through 10depict an approach that can be executed on an information handling system. The information handling system includes a cognitive IT ecosystem balancer that cognitively learns how to maintain an optimum balance of an IT ecosystem by continuously identifying key combinations of IT components and their applicable parameter levers that influence the optimization of the IT ecosystem's objectives, such as total cost of ownership, productivity, performance, throughput, capacity, integrity and security, resilience and vulnerability, etc. The information handling system uses a blockchain framework that tracks provenance, ownership, relationships & lineage of instrumented data, and generates anomaly data (true logs) that a cognitive balancer platform analyzes and adjusts parameter levers accordingly to maintain a balance within the IT ecosystem.

In one embodiment, the cognitive IT ecosystem balancer cognitively learns which levers are significant in achieving a desired IT ecosystem's goals and learns how to adjust the significant parameter levers to balance the constraints within the IT ecosystem. As defined herein, a parameter lever is an adjustable parameter adjusted by the cognitive IT ecosystem balancer such as a cost lever, a performance and duration lever, a capacity lever, a security and vulnerability lever, a resource skills/experience lever, a quality lever, a process maturity lever, a resilience lever, a service-level agreement (SLA) lever, a currency lever, an automation/savings lever, a deployment agility lever, a conformity to standards lever, and technology configuration and tuning levers. (seeFIG. 6and corresponding text for further details).

In another embodiment, the cognitive IT ecosystem balancer continuously learns to maintain a threshold of significant parameter levers and constraints by adding and removing parameter levers and constraints as they are discovered and/or removed. The cognitive IT ecosystem balancer learns which parameter lever changes impact other parameters. For example, when the cognitive IT ecosystem applies security patches to increase security, the performance of the IT ecosystem decreases and is noted by the cognitive IT ecosystem balancer.

In another embodiment, the cognitive IT ecosystem balancer manages malicious activity by detecting when the cognitive IT ecosystem's behavior is being impacted by malicious activity and automatically quarantines the source of the malicious activity to allow continued business processing. In this embodiment, the cognitive IT ecosystem balancer's learning is real time and identifies extremely sensitive changes in an IT ecosystem's behavior without predefined “security scanning images.” For example, the cognitive IT ecosystem balancer uses a security image scanning mechanism and quarantines an image when the image is found to be deviation from standard images, has root access compromised, or lacks certain mandatory specifications. Other examples include potential denial of service activity that has not yet been picked up by dedicated DOS prevention appliances. The cognitive IT ecosystem balancer observes increasing resource constraints resulting in fine grained performance impacts within a component in the system. The rate of increase of the impacts may trigger learned balancing action including quarantining the source network paths including IP addresses and ports via appropriate network administration commands.

In another embodiment, the cognitive IT ecosystem balancer manages security compliance. In this embodiment, during real time monitoring of a security patching activity, the cognitive IT ecosystem balancer cognitively identifies security compliance violations against an IT ecosystem policy and applies the required corrective/isolation action accordingly.

In another embodiment, the cognitive IT ecosystem balancer autonomously detects out of bound anomalies, dynamically performs cost-benefit analysis of various actions taken by the cognitive IT balancer's workflow engine, and autonomously adapts to the least impacting action.

In another embodiment, the cognitive IT ecosystem balancer learns the basis of an IT ecosystem including multiple lever rules engines, design thresholds, policies, base-line considerations, lever configurations, design decisions, and result-sets from cost-benefit analysis. The cognitive IT ecosystem balancer accepts end user feedback on new pathways, thus allowing external factors into the cognitive process.

In another embodiment, the cognitive IT ecosystem balancer provides a path-breaking alternative to multiple performance engineering systems, monitoring systems, complex event processing systems, continuous compliance systems, and robotic automation with the additional capabilities for setting and watching the cognitive apparatus system tune the enterprise itself to achieve the desired business objectives.

In another embodiment, the cognitive IT ecosystem balancer replaces discrete tuning mechanisms and systems that operate on one part of an enterprise with a system that observes, learns and provides tuning parameter levers for the whole enterprise that has been included in the desired business objectives.

FIG. 3is an exemplary diagram depicting a cognitive IT ecosystem balancer adjusting parameter levers as required to maintain a balance in an IT ecosystem. As discussed above, cognitive IT ecosystem balancer300maintains a balance of IT ecosystem310by continuously identifying key combinations of IT components and their applicable parameters to adjust. In one embodiment, the IT components being adjusted include storage elements, network elements, compute elements, system elements, multiple data providers, discovery systems, data lakes, data warehouses, security databases, logger components, aggregator and consolidator component, event generator, IT operations analytic engine, and etcetera.

IT enterprise315generates event data320based on the states of the IT components in IT enterprise315. Consolidator330collects event data320and consolidates (aggregates) the event data into consolidated event data340, which includes security and performance logs.

Blockchain framework350loads consolidated event data340into “transaction shards” to utilize simplified correlation rules to detect out of bounds conditions. A shard is a horizontal portion of a database and each shard is stored in separate instances. Using shards spreads the load and allows blockchain framework350to be more efficient in analyzing the database.

Blockchain framework350generates anomaly data360(true logs) when consolidated event data340creates out of bounds conditions according to chain rules (seeFIG. 9and corresponding text for further details). In one embodiment, anomaly data360provides the measurements and thresholds of each of the balancing lever components and provides transactional integrity. For example, anomaly data360for security patches would keep track of the various security patch update time-stamps of the servers, whereas anomaly data360for performance measures the equivalent performance breaches on a same set of servers.

Cognitive balancer platform370analyzes anomaly data360against policy rules and business rules, and identifies parameter levers to adjust to balance IT ecosystem310. For example, if anomaly data360indicates a decrease in performance, cognitive balancer platform370decreases the security and vulnerability parameter lever if applicable to increase the performance (seeFIGS. 5, 6, 10, and corresponding text for further details). In one embodiment, cognitive balancer platform370displays proposed lever adjustment recommendations to an administrator via dashboard380for feedback (seeFIG. 7and corresponding text for further details). The administrator provides administrator changes as needed, and cognitive balancer platform370learns from the administrator's modifications and balances IT ecosystem310via configuration settings390accordingly (seeFIGS. 3, 10, and corresponding text for further details).

FIG. 4is an exemplary diagram depicting a blockchain framework that provides anomaly data corresponding to behavior of an IT ecosystem to a cognitive balancer platform for analysis. As discussed earlier, blockchain framework350loads consolidated event data340into transaction shards440, each storing horizontal portions of consolidated event data340. Blockchain framework350provides the integrity, authenticity and validation of the transactions, component measures, and instrumentation data.

Blockchain framework350also enables the tracking of provenance, ownership, relationships & lineage of instrumented data, while also settling conflicting disputes. In one embodiment blockchain framework350, in conjunction with cognitive balancer platform370, undertakes key decisions in case of multiple conflicting criteria of multiple parameter levers such as cost-resilience-quality levers. For example, recommendations are identified to increase cost considerations or cost of transactions when cognitive balancer platform370detects disputes that the resilience of the system is intact but the quality of the component build is compromised. In this example, cognitive balancer platform370provides a dispute resolution via dashboard380by providing a recommendation of ideal parameter lever adjustments to be compromised versus which parameter levers to adjust.

Cognitive balancer platform370includes cognitive engine400, which continuously learns from interactions and feedback of IT ecosystem310and dashboard380. Cognitive engine400generates recommendations for design thresholds, policies, base-line considerations, lever configurations, design decisions, cost-benefit analysis, etc. based on anomaly data360. In one embodiment, cognitive engine400is initially boot-strapped with human knowledge of various security and tuning configurations and then commences run-time learning and adaptation.

Policy engine410and business rules430include IT ecosystem310's policies and rules, including those related to business, design, tuning, security and compliance considerations. Policy engine410also includes information pertaining to an outlier detection algorithm and design thresholds. In one embodiment, the outlier detection algorithm detects any out-of-bounds conditions for designated thresholds of the parameter levers. In this embodiment, blockchain framework350detects any out of bounds conditions (anomalies), sends anomaly data360(true logs) to cognitive balancer platform370, and cognitive balancer platform370uses the outlier algorithm to determine whether the anomaly data exceeds any of the designated thresholds for the parameter levers. In this embodiment, the thresholds for each of the parameter levers are specified in policy engine410and are dynamically adjustable based on trend analysis of the various parameter lever values for a given specified duration.

Business rules430include information pertaining to business contextual information such as system revenue, support models, and contractual details. Cognitive balancer platform370uses policy engine410and business rules430to detect various anomalies in the IT ecosystem310with respect to configured parameters versus baseline parameters.

In one embodiment, anomaly detection is based on various trend measurements of the various lever parameters and flagging of various outlier based conditions. In this embodiment, cognitive balancer platform370produces anomaly detection flags across multiple competitive parameter levers. Some examples of out of bound criteria are 1) deviation is greater than three standard deviations on a twenty week average; 2) two out of three deviations are on the same side of the average line and more than two standard deviations from it on a twenty week average; 3) four out of five deviations are on the same side of the average line and more than one standard deviations from it on a twenty week average.

Cognitive balancer platform370interfaces to visual dashboard380to provide parameter lever adjustment recommendations to an administrator. Dashboard380displays various parameter lever adjustment recommendations, design considerations, and recent transactions taken by cognitive balancer platform370to harmonize and balance IT ecosystem310(seeFIG. 7and corresponding text for further details).

FIG. 5is an exemplary diagram depicting a list of parameter levers that are adjusted by cognitive balancer platform370to maintain a balance in IT ecosystem310. Parameter levers500includes a list of parameter levers that cognitive balancer platform370adjusts based on anomaly data360. Each parameter lever corresponds to a threshold and, as shown inFIG. 6, adjusting one of the parameter levers typically affects a different parameter.

Cost lever510corresponds to the operating cost of IT ecosystem310, such as license of servers, operating personnel costs, maintenance costs, etc. Performance and duration lever520corresponds to the performance/duration of IT ecosystem310such as network performance, storage performance, server performance, etc. Capacity lever525corresponds to the capacity of IT ecosystem310such as its storage capacity.

Security and vulnerability lever530corresponds to how much security to apply to IT ecosystem310, such as intrusion detection, vulnerability management, penetration testing, anti-virus detection, security patching, etc. Resource skills/experience lever540corresponds to enablement times for building skills, lead time for enablement skills approval, resource staffing, lead time index, etc. Quality lever550corresponds to the quality of service of IT ecosystem310, such as service agreement levels, IT availability & business continuity parameters, etc.

Process maturity lever560corresponds to operational processes as incident, problem, change management, asset management, SLA management, etc. Resilience lever570corresponds to middleware resilience, server resilience, network resilience, database resilience, etc. SLA lever575corresponds to service level agreements maintained by IT ecosystem310.

Currency lever580corresponds to server currency, storage currency, application currency, etc. Automation/savings lever585corresponds to savings derived from, for example, runbook automation, provisioning automation, cloud enabled automation, incidents savings due to automation of monitoring, etc. Deployment agility lever590corresponds to deployment of new business, new technical components, new architectures, greenfield deployments, cloud migration, etc.

Conformity to standards lever595corresponds to conformity to maintain various environment specifications, deployment standards, component specifications, adherence to enterprise frameworks, architectural decision alignments, etc. And, technology configuration and tuning levers598represents the collection of identified and learned configuration and/or tuning levers associated with the technologies involved in IT ecosystem310in the scope of cognitive IT ecosystem balancer300.

FIG. 6is an exemplary diagram depicting a relationship between adjusting parameter levers versus other parameters impacted. In one embodiment, cognitive IT ecosystem balancer300cognitively learns which other parameters are impacted from adjusting a particular parameter. For example, cognitive IT ecosystem balancer300may adjust smart eyewear system300may increase a performance parameter lever.

Table600includes column610and column620. Column610includes various lever adjustments and column620includes parameters impacted other than the parameter corresponding to the adjusted lever. Row625shows that by increasing/decreasing security patches, performance is inversely impacted. Row630shows that decreasing/increasing performance increases/decreases throughput, cost, and configuration and tuning. Row640shows that increasing/decreasing resilience has an inverse effect on cost and increases/decreases configuration and tuning. Row650shows that increasing/decreasing capacity also has an inverse effect on cost and increases/decreases configuration and tuning. Row660shows that increasing/decreasing quality decreases/increases costs, increases/decreases performance, and increases/decreases SLA.

FIG. 7is an exemplary diagram of a visual dashboard that displays configuration information to an administrator. Matrix700displays parameter levers and adjustments recommended by cognitive balancer platform370. Column710includes the name of the parameter lever and column720includes the current value of the corresponding parameter lever. Column730includes a recommended adjustment value and column740allows the administrator to change the recommended adjustment value. When the administrator is finished changing the recommended adjustments, the administrator selects submit button750.

Table760includes design considerations of cognitive IT ecosystem balancer300. In one embodiment, the administrator selects one of the design considerations and dashboard380displays details behind the selected design consideration.

Table770shows recent transactions of cognitive IT ecosystem balancer300, such as increasing/decreasing various parameter lever values. In one embodiment, dashboard380displays more, less, or different information than what is shown inFIG. 7.

FIG. 8is an exemplary diagram showing interaction between an IT ecosystem and various components in cognitive IT ecosystem balancer300. During operation, IT enterprise310generates system logs, network logs, storage logs, etc. (800), which feed into consolidator330. Consolidator330aggregates and consolidates the logs (810) and feeds consolidated event data340into blockchain framework350.

Blockchain framework350stores (loads) the consolidated data into transaction shards (820). In one embodiment, the consolidated data is separated into domain type data sets associated with source logs that represent the source component type within IT Ecosystem310. Each transaction shard is configured to be sensitive to a domain type. Blockchain framework350then applies business correlation engine rules to the transaction shards (830) and detects whether out of bounds anomalies are present (840, such as breaches of various performance and capacity thresholds, investment targets breaches, achievements of automation savings targets, etc. When out of bounds conditions exist, blockchain framework350generates anomaly data360that feeds into cognitive balancer platform370(850). In one embodiment, the blockchain correlation rules are initially similar to business runes430and, over time, standard correlation analysis are applied to the domain data to determine course grain correlations. These would then be fed in the cognitive engine to learn how to balance the system based on the policies and business rules provided. The outcome provides feedback to the block change framework in terms of “chain rules” on the significant correlations relative to the balance. The blockchain framework then searches for correlation anomalies as it processes incoming logs. These represent a shift from correlations that enable the desired balance and thus may require lever adjustment to bring the observed log data back into line.

Cognitive balancer platform370analyzes the anomaly data and determines lever adjustment recommendations required to equilibrate IT ecosystem310(860). For example, a breached investment target threshold may require equilibration of an equivalent lever of quality of service or resource investment costs, whereas an increased vulnerability score may need to be equilibrated with an additional costs lever to support additional security patching of servers.

Cognitive balancer platform370displays the lever adjustment recommendations on dashboard380(870) and receives administrator changes from an administrator that accepts or changes the proposed adjustments (880). Cognitive balancer platform370applies the administrator changes to the business rules, allowing cognitive balancer platform370to learn from the administrator changes. In turn, cognitive balancer platform370sends configuration changes corresponding to the parameter lever adjustments to IT enterprise315(890). IT enterprise315receives the changes and reconfigures its various IT components accordingly (895).

FIG. 9is an exemplary flowchart showing steps taken by a blockchain platform to load event data into transaction shards and generate anomaly data based on the event data.FIG. 9processing commences at900whereupon, at step910, the process receives consolidated event data from consolidator330. At step920, the process loads the consolidated event data into transaction shards as discussed above.

At step940, the process evaluates the transaction shards for out of bounds anomalies based on chain rules as discussed above. The process determines as to whether an out of bounds condition is detected (decision950). If an out of bounds condition is detected, then decision950branches to the ‘yes’ branch whereupon, at step960, the process generates anomaly data (true logs) and sends the anomaly data to cognitive balancer platform370(seeFIG. 10and corresponding text for further details).

On the other hand, if an out of bounds condition is not detected, indicating that IT ecosystem310is optimized, then decision950branches to the ‘no’ branch bypassing step960.

The process determines as to whether to continue (decision970). If the process should continue, then decision970branches to the ‘yes’ branch which loops back to receive and process more consolidated event data. This looping continues until the process should terminate, at which point decision970branches to the ‘no’ branch exiting the loop.FIG. 9processing thereafter ends at995.

FIG. 10is an exemplary flowchart showing steps taken by a cognitive balancer platform to balance an IT ecosystem.FIG. 10processing commences at1000whereupon, at step1010, the process receives anomaly data from blockchain framework350. At step1020, the process evaluates the anomaly data against business rules to determine adjustment recommendations required to maintain business contextual information (system revenue, support model, contractual details, etc.).

At step1030, the process evaluates the anomaly data against design thresholds using the policy engine to determine adjustment recommendations required to maintain the design thresholds (security compliance, malicious activity, tuning, etc.). In one embodiment, as discussed earlier, policy engine410uses an outlier detection algorithm to analyze the anomaly data against parameter lever thresholds to determine whether the anomaly data exceeds any of the designated thresholds for the parameter levers.

At step1040, the process determines lever additions, deletions, and adjustment recommendations based on the anomaly data evaluations from steps1020and1030. In one embodiment, a new lever is incorporated for a specific enterprise, such as a new personnel safety lever based on a new criteria of hazardous work conditions of a new chemical plant. As another example, a new lever is introduced to measure business leadership via various response times for hiring, cost-overrun approvals, profit measurements, etc.

At step1050, the process displays the parameter lever adjustment recommendations, design considerations, and recent transactions on dashboard380for an administrator to view and change. At step1060, the process receives administrator changes from the administrator via dashboard380and modifies the parameter lever values based on the feedback. For example, the administrator wishes to increase performance by means other than decreasing security.

At step1070, the process learns from the modified parameter lever values by adjusting business rules430accordingly. For example, a profitability lever can be fine-tuned based on multiple project cost-overruns, delays of business decisions and approvals, detection of reduced go-to-market avenues of the channel products, etc.

The process determines as to whether to continue (decision1090). If the process should continue, then decision1090branches to the ‘yes’ branch which loops back to receive more anomaly data from blockchain platform350and process the anomaly data. This looping continues until the process should terminate, at which point decision1090branches to the ‘no’ branch exiting the loop.FIG. 10processing thereafter ends at1095.