CHARACTERIZING A COMPUTERIZED SYSTEM WITH AN AUTOENCODER HAVING MULTIPLE INGESTION CHANNELS

The invention is directed to characterizing a computerized system. Access key performance indicators (KPIs), for the computerized system. Each of the KPIs is a timeseries of KPI values and is categorized into one of n types. KPI values are channeled through n buffer channels. Each buffer channel buffers KPI values of one of n types. Finally, reconstructions errors are obtained by feeding initial KPI values to n respective input channels of a cognitive model, implemented as an autoencoder by a trained neural network including an encoder and a decoder. Encoder has temporal convolutional layer blocks connected by each input channel. Decoder has deconvolution layer blocks connected by encoder. Initial KPI values are independently processed in n input channels, then compressed by encoder, prior to being reconstructed by decoder. Reconstruction errors are obtained by comparing reconstructed KPI values with initial KPI values. Computerized system is characterized based on reconstruction errors obtained.

The document “Cloud Causality Analyzer for Anomaly Detection”, Swiss Federal Institute of Technology Zurich, Master Thesis, was authored by Lili L. Georgieva, co-inventor of the present invention, and published on Apr. 14, 2021. This document was prepared under advisement of Mircea R. Gusat (also known as Mitch Gusat), co-inventor of the present invention.

BACKGROUND

The invention relates in general to the field of computer-implemented methods, characterization systems, and computer program products for characterizing computerized systems. In particular, it is directed to methods that process key performance indicators (KPIs) for the computerized system through a cognitive model implemented as an autoencoder by a trained neural network, to characterize the computerized system.

In recent years, explainability and causality have been the subject of increasing interest in the machine learning community. Given the proliferation of complex, black-box neural network models, many called for the need to explain model predictions and deepen the causal discovery of true causes of predicted outcomes. In particular, one important area in the cybersecurity and cloud computing domain is anomaly detection (AD), which relates to the identification of rare or unexpected events or data patterns in computerized systems. Beyond anomaly detection, it is often necessary to be able to aptly characterize such computerized systems.

Various application—and data-specific statistical and deep learning models have been proposed for characterizing computerized systems, in particular for anomaly detection. Explainability methods generally fail to drill in deeper from causal inference of symptoms to root cause analysis (RCA)—inferring the faults that generated the observed symptoms—while baseline causality methods suffer from inefficiency and scalability issues when run on large datasets.

SUMMARY

According to a first aspect, the present invention is embodied as a computer-implemented method of characterizing a computerized system. The method first comprises accessing key performance indicators, or KPIs, for the computerized system. Each of the KPIs is a timeseries of KPI values and is categorized into one of n types of KPIs, where n≥2. The KPI values of the KPIs are then channeled through n buffer channels, in accordance with the n types. That is, each of the n buffer channels buffers KPI values of KPIs of a respective one of the n types. Finally, reconstructions errors are obtained by feeding initial KPI values, as buffered in the n buffer channels, to n respective input channels of a cognitive model. The cognitive model is implemented as an autoencoder by a trained neural network. The autoencoder includes an encoder and a decoder. The encoder has temporal convolutional layer blocks connected by each of the n input channels. The decoder has deconvolution layer blocks connected by the encoder. The initial KPI values are independently processed in the n input channels, then compressed via the temporal convolutional layer blocks of the encoder, prior to being reconstructed via the deconvolution layer blocks of the decoder. The reconstruction errors are obtained by comparing the reconstructed KPI values with the initial KPI values. Eventually, the computerized system is characterized based on the reconstruction errors obtained.

According to another aspect, the invention is embodied as a characterization system for characterizing a computerized system of interest. The characterization system comprises a communication unit configured to access data from the computerized system, as well as a processing unit. The latter is connected to the communication unit and configured to perform steps as described above, i.e., accessing KPIs, channeling KPI values through n buffer channels, and obtaining reconstructions errors via the cognitive model, which is implemented as an autoencoder by a trained neural network.

According to a final aspect, the invention is embodied as a computer program for characterizing a computerized system. The computer program product comprises a computer readable storage medium having program instructions embodied therewith. The program instructions are executable by processing means to cause the latter to take steps according to the method described above.

The accompanying drawings show simplified representations of devices or parts thereof, as involved in embodiments. Similar or functionally similar elements in the figures have been allocated the same numeral references, unless otherwise indicated.

Characterization systems, computer-implemented methods, and computer program products embodying the present invention will now be described, by way of non-limiting examples.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

The following description is structured as follows. First, general embodiments and high-level variants are described in section1. Section2addresses particularly preferred embodiments and section3concerns technical implementation details. Note, the present method and its variants are collectively referred to as the “present methods”. All references Sn refer to methods steps (FIGS.2and3), while numeral references pertain to physical parts, components, and concepts involved in the present characterization systems (FIGS.1,4, and6).

1. General Embodiments and High-Level Variants

In reference toFIGS.1-4, a first aspect of the invention is now described in detail, which concerns a computer-implemented method of characterizing a computerized system2based on key performance indicators (KPIs) for this computerized system2. The KPIs are typically obtained from compute devices and/or storage devices composing the system2.

First, KPIs are accessed. Each KPI is a timeseries, i.e., a series of values (here called KPI values) of a quantity obtained at successive times. Such KPI values may for instance be continuously collected and aggregated (see step S5inFIG.2) from data streams of raw KPI values, and then buffered at step S10. The aggregated values are typically subject to some preprocessing (step S20), as discussed later in reference to particular embodiments.

According to the present approach, the KPIs are categorized, before being fed to a cognitive model15for characterizing the target system2. More precisely, each KPI is categorized S30into one of n types of KPIs, where n≥2. This categorization is preferably achieved thanks to a clustering process, which is described later in detail.

Next, KPI values of the KPIs are channeled S40through n buffer channels, in accordance with the n types of KPIs identified earlier. That is, each of the n buffer channels buffers KPI values of KPIs of a respective one of the n types. Each buffer channel is basically a memory for temporarily storing values of the KPIs. I.e., the buffer channels store KPIs with a view to subsequently injecting the stored KPI values in input channels of a cognitive model15, in order to characterize the system2based on outputs of the model15. I.e., the KPI values buffered in the n buffer channels serve as input data for the cognitive model15and are referred to as “initial KPI values” in the following.

General step S50concerns processing performed by the cognitive model15. It decomposes as follows. At step S51, the initial KPI values (as buffered in then buffer channels) are fed to n respective input channels15.1,15.2of the cognitive model15. The latter is implemented as an autoencoder by a trained neural network15, i.e., an artificial neutral network (ANN). The autoencoder notably includes an encoder15.5and a decoder15.7. Basically, the ANN15processes the initial KPI values to produce output values, based on which reconstructions errors are obtained S50-S60. Remarkably, the encoder15.5includes temporal convolutional layer blocks TCN1, TCN2. The latter are connected by each of the n input channels15.1,15.2, as seen inFIG.4. Consistently, the decoder15.7includes deconvolution layer blocks DC1, DC2, which are connected by the encoder15.5. I.e., input channels connect to the encoder, which connects to the decoder. The ANN15is configured in such a manner that the initial KPI values are independently processed S52in the n input channels15.1,15.2, then compressed S53via the temporal convolutional layer blocks TCN1, TCN2of the encoder15.5, prior to being reconstructed S55via the deconvolution layer blocks DC1, DC2of the decoder15.7.

Eventually, reconstruction errors are obtained S60by comparing the reconstructed KPI values with the initial KPI values. I.e., reconstructs from the latent space of the autoencoder are exploited to compute reconstruction errors. This, in turn, makes it possible to characterize S70-S90the computerized system2based on the reconstruction errors obtained, in an unsupervised manner.

The proposed approach enables an unsupervised pipeline, which exploits reconstruction errors obtained for KPIs channeled through multiple input channels15.1,15.2of the ANN15for characterizing the target computerized system2, e.g., to detect an anomaly in the system2and, if necessary, to troubleshoot the target system2, as in embodiments described later in detail. The present approach may for instance be used to monitor general-purpose computers, datacenters, clouds, supercomputers, as well as memory and storage hardware, and load/store engines.

As the present inventors realized, the proposed architecture (in particular the temporal convolutional blocks and deconvolution counterparts) has advantages in terms of interpretability (explainability), scalability, and root cause analysis (RCA), as further explained throughout this document.

The encoder15.5compresses the input KPIs into a latent space manifold that encodes the essential signal and then process it via the decoder15.7, which attempts to reconstruct the initial KPIs from their compressed representations. Moreover, the cognitive model15may possibly ingest a frontend data stream, which may already be compressed, e.g., by way of a selection of most representative KPIs. Still, the cognitive model15allows additional compression to be achieved in its latent space, which is exploited for characterizing the system2. The latent space manifold preferably involve 32 to 128 neurons (more preferably 64 neurons), as opposed to the hundreds to thousands nodes used in input.

The temporal convolutional layer blocks TCN1, TCN2allow temporality to be taken into account, in addition to spatial correlations between the KPIs. The TCN blocks enable interpretability inasmuch as dilation factors, even small, can directly be related to causality lags, a thing that is not possible with non-dilated convolutional models. In a causality context, non-linear neural networks have advantages as they allow to go beyond pairwise co-determination algorithms of prior methods. Furthermore, the proposed approach makes it possible to relax KPI constraints in terms of strict stationarity and linear time-invariance that prior methods often impose.

The data aggregation and categorization can be performed repeatedly, so as to continually feed the cognitive model15with data and continually characterize the system2of interest, possibly in (near) real-time. I.e., KPI values may possibly be continually fed into respective input channels of the cognitive model15. Thus, the present methods may be implemented as an anomaly detection method to detect potential anomalies in (near) real-time. However, the present methods may also be performed on specific occasions, e.g., in respect of past timeseries, to detect past anomalies in the system2(e.g., for forensic purposes).

The range of KPIs considered for categorization may typically include between 50 and 260 KPIs, initially. However, one preferably considers between 70 and 130 KPIs, e.g., approximately 100 KPIs. The KPIs are computed based on data collected (e.g., streamed) S5from the computerized system2of interest. The KPIs may be formed using any suitable metric. Such KPIs may for instance relate to CPU utilizations, read/write response times, and read/write input/output (I/O) rates. Other KPIs may for instance relate to access rights, disk-to-cache transfer rates or, conversely, cache-to-disk transfer rates, possibly using volume cache (VC) or volume copy cache (VCC) metrics for volumes. In practice, however, cache-related KPIs are found to be less useful than read/write data in the present context. Other types of KPIs are known to the skilled person.

The KPIs may be streamed and sampled at any suitable frequency, e.g., 288 times per day, i.e., every 300 seconds (every 5 minutes). The duration of the period used to train the model 15 may for instance be 1, 3, or 6 months. Higher frequencies and/or longer periods may be contemplated in the present context.

Some of the initial KPIs may possibly be discarded, after the preprocessing step S20. At step S30, the KPIs are categorized S30as objects of n respective types, i.e., as objects having different properties as per the procedure used to identify them. Now, the categorization performed at step S30may advantageously involve substantial precompression, thanks to a clustering process and a selection of representative KPIs in each cluster. Namely, after the preprocessing S30, the KPIs may be clustered S30, so as to obtain k clusters, where k≥2. Each cluster includes at least m KPIs, where m>n. That is, each cluster should include a number m of KPIs that is larger than the number n of input channels, for reasons that will become apparent below. Next, representative KPIs can be identified in each of the clusters formed. That is, for each cluster of the k clusters obtained thanks to the clustering process, n representative KPIs are identified in each cluster. The representative KPIs are identified as objects of distinct types. Finally, KPI values of the n representative KPIs identified can be buffered in respective ones of the n buffer channels.

The representative KPIs are preferably identified so as to exhibit antagonistic or contrasting properties, as per the metric used to identify them. Preferred is to select a central KPI and a peripheral KPI in each cluster. That is, the n representative KPIs identified in each cluster may include a central KPI (cR-KPI) and a peripheral KPI (pR-KPI) of this cluster, e.g., the most central and the most peripheral KPIs. For example, the KPIs can be ordered in each cluster according to their distances to the centroid of that cluster, which makes it possible to easily determine the representative KPIs. Preferably, use is made of the most central KPI and the most peripheral KPI only, such that only two buffer channels and two inputs channels are needed in that case. The most central and the most peripheral KPIs can be regarded as statistically normal and abnormal KPIs, respectively.

In preferred embodiments, the KPIs are iteratively clustered S30thanks to a k-shape algorithm. The k-shape clustering algorithm is a robust, iterative refinement algorithm that scales linearly with the number of features and creates k-well-separated, homogeneous clusters. This clustering process is iterative: the algorithm first randomly initializes the timeseries' assignments to clusters and then iteratively updates the assignments based on distances to the cluster centroids. In practice, one preferably seeks to obtain 8 to 10 clusters, eventually. The k-shape algorithm relies on the so-called shape-based distance (SBD), which uses a normalized cross-correlation (NCC) measure that compares the shapes of the timeseries shapes and hence can detect pairwise similarities, even for lagged (non-simultaneous) co-dependencies.

In variants, one may select different types of KPIs at step S30(i.e., other than the central and peripheral KPIs), provided that the KPIs selected remain sufficiently representative of each cluster. For example, the representative KPIs may be selected as follows. In each cluster, one first selects a subset of n KPIs that are the closest to the average radial distance to the centroid. In that sense, the n KPIs selected are representative of this cluster. Then, one categorizes the n KPIs selected into n different types, in accordance with their respective distances to n axes spanning a n-dimensional space, where the n axes may for instance be determined by principal component analysis. Other algorithms may similarly be designed, to select n representative KPIs in each cluster.

Next, the algorithm may aggregate timeseries corresponding to representative KPIs of each type. I.e., representative KPIs of a given type form a set {{xj1, xj2, . . . , xjm}, {xk1, xk2, . . . , xkm}, . . . }, where {xj1, xj2, . . . , xjm} corresponds to one representative KPI of that given type. The corresponding KPIs are then fed into a respective input channel of the neural network15. In other words, n-uplets of KPIs are identified, and the KPIs of each n-uplet is subsequently fed into the nth input channel of the cognitive model15. Time data do typically not need to be fed into the model, because they do not provide learnable information. However, they are typically saved, in order to later map the anomalous indices detected to time points, e.g., when investigating incidents.

In principle, one may have any number n of input channels, provided that this number is smaller than the average number of KPIs in each cluster. That is, if k clusters of KPIs are identified, which, on average, include M KPIs, then n must be strictly smaller than M. To that aim, one may need to adapt the number k of clusters formed to ensure that a sufficiently large number of KPIs are included in each cluster. That said, the number n of channels is preferably chosen to be small, to increase the compression achieved through the clustering and selection process.

The number n of channels is preferably chosen to be equal to 2 (i.e., n=2). In that case, the two representative KPIs identified for each cluster may correspond to the most central KPI (cR-KPI) and the most peripheral KPI (pR-KPI) in this cluster. This means that the buffer channels consists of two buffer channels only. Similarly, the input channels of the neural network15consists of two input channels15.1,15.2only, i.e., a first input channel15.1and a second input channel15.2, as assumed inFIG.4. Thus, the central KPIs of the k clusters can be buffered S40in a first buffer channel and fed S51into the first input channel15.1, while peripheral KPIs of the k clusters are buffered S40in a second buffer channel and fed S51into the second input channel15.2. For example, two data streams of representative KPIs (central and peripheral KPIS) can be formed, from which two compressed channels (the buffer channels) are built, which are later ingested by the cognitive model15. Combining the k-shape clustering algorithm with a two-channel extraction (for central and peripheral representative KPIs only) allows a particularly efficient compression to be achieved.

In variants, the number n of channels may for instance be chosen to be equal to 4 (i.e., n=2). In that case, two channels may be used to respectively ingest central and peripheral KPIs, while the two remaining channels are used to respectively ingest read and write data in parallel. This leads to noticeable improvements over the previous example, albeit at a higher computational costs. Whether to use four instead of two channels can be decided by a cost/benefit analysis. More generally, one may similarly use any number of pair of channel. Still, the performance achieved with only two channels buffering central and peripheral KPIs will likely be satisfactory in most applications. Therefore, the following embodiments mostly assume a two-channel configuration as described above.

In addition, a frequency-based aggregation mechanism can be used, whereby the most frequently occurring KPIs are selected, e.g., according to a percentage or heuristic. The aggregation mechanism may for instance aggregate weekly representative KPIs that are the most frequently occurring in one month into monthly KPI channels. Applying this to both the central and peripheral representative KPIs yields two monthly channels. Still, the channeling algorithm may ensure that both channels are equally-sized, according to a predefined channel size (e.g., specified by a user). This makes it possible to achieve balance between capturing: (i) the current representative trends, and (ii) the core system behavior during an extended time period. For example, each KPI may be a vector aggregating one week of data (2016 points), corresponding to 5 min time lags. The same procedure can be run for several successive weeks; the most frequent KPIs are then picked up to extract monthly representatives.

In addition, the clusters are preferably ordered by cardinality, prior to feeding S51the buffered KPIs into the input channels. More precisely, the KPIs (as buffered in each of the two buffer channels) may be ordered in descending order of cardinality of the respective clusters. In other words, the representative KPIs of large clusters are buffered first. In practice, the ingestion tensor may be built cluster-by-cluster, from the largest to the smallest cluster by cardinality number of KPIs in each cluster. That is, one may first sort the clusters by cardinality, then sort and select the KPIs according to their distances to the centroids of the clusters, to select the representative KPIs. The benefit of such an ordering on the model performance can be evaluated at run-time.

The characterization S90of the computerized system2may notably aim at detecting potential anomalies. Formally, anomalies are defined as rare events that are so different from other observations that they raise suspicion concerning the mechanism that generated them. Anomalies may arise due to malicious or improper actions, frauds, or system failures, for example. An anomaly may notably be due to a data traffic anomaly, as with a network attack (e.g., on the business environment), unauthorized access, network intrusion, improper data disclosure, data leakage, system malfunction, or data and/or resources deletion. Anomaly detection is important in various domains, such as cybersecurity, fraud detection, and healthcare. An early detection is often of utmost importance as failing to act upon the causes of the anomaly can cause significant harm.

The detection of an anomaly may lead to (instruct to) take S90action in respect of the computerized system2, so as to modify a functioning of the computerized system. Any appropriate decision may be made in the interest of preserving the system and/or its environment. Both the type of action and its intensity may depend on the anomaly score obtained. For example, a preemptive action may be taken, to preempt or forestall adverse phenomena. E.g., in case a substantial anomaly is detected, some of the data traffic may be interrupted, re-routed, deleted, or even selected parts of the computerized system may be shut down, as necessary to deal with the anomaly.

The detection of an anomaly may notably lead to troubleshooting S90the computerized system2, e.g., by performing a causal analysis based on a selection of the representative KPIs that have been determined to contribute the most to the anomaly detected. In that respect, reducing the feature space to only a small number of KPIs (as achieved thanks to a pre-compression scheme proposed above) allows support engineers to analyze the system performance behavior more effectively, based on only a fraction of the large number of initial KPIs, and accordingly reduces incident resolution times. Moreover, this feature compression is crucial for scalable causality discovery of root anomalous culprits.

The following explains how the target system2is characterized, in preferred embodiments. Referring toFIG.2, the present methods preferably rely on time-dependent indicators, which are obtained S70based on the reconstruction errors computed S60thanks to outputs provided by the ANN15. The reconstruction errors are typically obtained S60by computing differences between the reconstructed KPI values and the initial KPI values, for each KPI and for each time point. Next, one may seek to identify S80abnormal values of the time-dependent indicators obtained. In turn, the computerized system can be characterized S90based on a selection of the KPIs that are found to contribute the most to the abnormal values identified. For example, the algorithm may pick the top-h KPIs that contribute the most to a given, abnormal value. In variant, the algorithm may select all the KPIs that contribute to more than a given fraction (e.g., 50%) of any abnormal value identified. In both cases, it is possible to automatically identify those KPIs that are responsible for the characterized state of the system2, which eases the task of support engineers when analyzing the system2, e.g., to resolve incidents.

The time-dependent indicators may notably be obtained S70by summing absolute values of the reconstructions errors obtained for the KPI values over all of the KPIs and, this, for each time point. That is, at each time point, the algorithm sums the reconstructions errors obtained for all KPI values corresponding to this time point. In variants, one may sum reconstructions errors obtained for a subset of the KPI values, this resulting in a small performance improvement. Abnormal values can then be identified S80by detecting those critical time points, at which the time-dependent indicators take abnormal values, e.g., exceed a threshold value.

Note, the algorithm may advantageously smooth the time-dependent indicators over time, to minimize false positives. More precisely, the reconstructions errors may be smoothed S70over time, after summing them, e.g., by summing the KPI values at each time point and then computing a moving average. This way, the time-dependent indicators are obtained S70as smoothed values for each time point and the critical time points are identified as points corresponding to time points at which the smoothed values exceed a threshold value.

One may for instance calculate the reconstruction error, for each KPI, as the squared distance between the initial KPI and reconstructed KPI (considered as vectors). The resulting distance can be normalized, e.g., by scaling in the [0, 1] range. Then, the mean error over all KPIs is smoothed over time, e.g., via a moving average function with a rolling a [4-hour] window with a certain overlap to obtain smoothed errors. The overlap may for example amount to 1, 2, or 3 hours. Preferably, a 3-hour overlap is used, which amounts to 75% of the rolling window, to achieve more granularity. In variants, other smoothing functions can be used, such as convolutions or low-pass filters.

In embodiments, the time points are identified S80according to a K-sigma thresholding method, i.e., based on the mean value μ and the dispersion value σ (e.g., the standard deviation) obtained for the smoothed values. The underlying assumption is that the majority of the data have a normal behavior and, thus, are correctly learned and reconstructed by the cognitive model15. The K-sigma thresholding method classifies a time point as anomalous if the corresponding smoothed error exceeds μ+K×σ. That is, a timestep t is classified as anomalous if and only if its smoothed error exceeds a threshold set to μ+K×σ. The hyper parameter K controls the tolerance to outliers and is usually set to 2, which corresponds to the 95thpercentile of a Gaussian distribution. Finally, for each anomaly, the algorithm may for instance extract the top-f KPI contributors to the anomalous reconstruction error. Consecutive anomalous timepoints are preferably grouped in anomaly windows. In some applications, sustained anomalies (e.g., lasting several hours) may be particularly interesting to track. In such applications, the algorithm may for instance filter out point outliers (short-lived bursts), e.g., lasting less than 15-minutes, as these do typically not require further investigation by the support engineers. In such applications, the outputs provided to the support engineers, at post-proces sing (i.e., downstream the cognitive model15), may include anomaly windows, together with corresponding top-f KPI contributors.

The following describes preferred architectures of the ANN15, in reference toFIG.4. To start with, each of the n input channels15.1,15.2preferably includes one or more depth-wise convolutional (DWC) layers. In that case, the initial KPI values are independently processed S52in then input channels15.1,15.2by performing depth-wise spatial convolutions separately on each of the n input channels15.1,15.2, thanks to the DWC layers. That is, at least one DWC layer is used in each input channel and each DWC layer performs a depth-wise spatial convolution acting on each input channel separately, without mixing the outputs.

Note, the cognitive model15may advantageously be trained S100based on initial weights that are differently scaled in the DWC layers of the n input channels15.1,15.2, as assumed inFIG.2, to speed up the training. That is, the initial weights are distinctly scaled upward or downward in each input channel, in accordance with the types of the categorized KPIs. Doing so amounts to introducing some bias, on purpose, from the start, even though zero biases are typically set in each input channel. For example, the training algorithm may initially put more weight on the input channel corresponding to statistically normal KPIs (e.g., the central R-KPIs) than on the input channel corresponding to statistically abnormal KPIs (e.g., the peripheral R-KPIs), assuming that the target system2mostly performs normally. E.g., the input channel corresponding to central KPIs may have weights initially set to 0.7, while the input channel corresponding to peripheral KPIs may have weights initially set to 0.3, assuming weights in the range [0-1].

More generally, the initial weights can be up/down-weighted using simple heuristics. Doing this enables a simplified attention mechanism. Using a more complex attention method may conceptually defeat the explainability purpose of the present approach. Therefore, it is preferred to simply scale the two input channels with custom initialization weights in the DWC layers. Weight scaling heuristics are simple to understand when troubleshooting in a specific time frame, based on prior knowledge or information obtained from tickets, clients, the anomaly detection model, etc.

As further seen inFIG.4, the encoder15.5preferably includes two temporal convolutional layer blocks TCN1, TCN2, while the decoder15.7consistently includes two deconvolutional layer blocks DC1, DC2. More preferably, the encoder15.5consists of the two blocks TCN1, TCN2, while the decoder15.7consists of the two blocks DC1, DC2. This makes it easier to maintain consistency upon reconstructing the KPIs. Indeed, the more deconvolutional blocks the longer it takes to train S100the model15, let alone risks in terms of overfit. So, as the present inventors concluded, a good trade-off is to rely on two blocks only, in each the encoder15.5and the decoder15.7. In variants, however, one may contemplate using a larger number of blocks (e.g., three block on each side), notably if the input dataset has a large size.

In preferred embodiments, each block TCN1, TCN2comprises one or more dilated temporal convolutional filter layers. In addition, each block TCN1, TCN2will typically include a hierarchy of neural layers in output of the dilated temporal convolutional filter layers, namely a batch normalization layer, an activation layer (typically a Rectified Linear Unit, or ReLU), and a spatial dropout layer. The second block may further include a skip connection convolution from the previous residual block. The dilated temporal convolutional filter layers enable causal convolutions, with increasing dilation factors, e.g., in powers of two, although different dilation factors might be used. In each residual block, two stacks of temporal convolutions are used, which allows the model to learn more complex patterns by flexibly increasing the receptive field. The filter sizes can be gradually reduced in the two TCN blocks, resulting in a much reduced dimensionality in the bottleneck layer.

Another aspect of the invention is now discussed in reference toFIGS.1and5. This aspect concerns a characterization system1for characterizing a computerized system2, as schematically illustrated inFIG.1. Consistently with the present methods, characterizations are performed based on KPIs for the computerized system2. As noted earlier, the computerized system2may notably be a single computer or a network of interconnected computerized units25, e.g., forming a cloud. In that case, the nodes25may store and deploy resources, so as to provide cloud services for users, which may include companies or other large infrastructures. Note, the characterization system1may possibly belong to the target computerized system2and include one or more units of that system2.

In general, the characterization system1may include one or more computerized units101such as shown inFIG.5. In the following, we assume that the system1consists of a single unit101, for simplicity. The system1notably comprises a communication unit, which is configured to access data from the computerized system2. The communication unit may for example be formed by a network interface160and an input/output (I/O) controller135; the network interface160is connected to the I/O controller135via the system bus of the unit101. The network interface160allows the characterization system1to receive external data, including data from the computerized system2; the received data are then handled by the I/O controller.

The system1further comprises processing means105, which are connected to the communication unit. The system1typically includes computerized methods in the form of software that is stored in a storage120. The software instructions can be loaded in the memory110, so as to configure the processing means105to perform steps according to the present methods. In operation, the processing means cause to access KPIs and channel the KPIs through n buffer channels, e.g., by clustering the KPIs, identifying representative KPIs in each cluster, and buffering KPI values of the representative KPIs identified in the buffer channels. In turn, the processing means105cause to feed the buffered KPI values into input channels15.1,15.2of the ANN15(implementing an autoencoder), to process such values and obtain reconstructions errors, based on which the processing means105subsequently characterize the computerized system2, as explained earlier in reference to the present methods.

In particular, the input channels15.1,15.2of the neural network15may be formed by respective sets of neural layers, for the neural network15to independently processes S51the KPIs in the input channels via the respective sets of neural layers. As discussed earlier, each input channels15.1,15.2preferably includes one or more DWC layers. Besides, the encoder15.5preferably includes (or even consists of) two temporal convolutional layer blocks TCN1, TCN2, while the decoder15.7preferably includes (or even consists of) two deconvolutional layer blocks DC1, DC2. Moreover, each block TCN1, TCN2preferably comprises one or more dilated temporal convolutional filter layers, for reasons explained earlier. In addition, each block TCN1, TCN2typically includes a hierarchy of neural layers (i.e., a batch normalization layer, an activation layer, and a spatial dropout layer) in output of the dilated temporal convolutional filter layers.

In the example ofFIG.1, the system1is assumed to be distinct from (nodes of) the system2. That is, the system1is adapted to interact with hardware components of the system2, e.g., with a view to detecting anomalies in this system2and instruct to take appropriate actions in respect of the target system2. In variants, the system1may actually form part of the target system2. In that case, the tasks performed by the characterization system1may for instance be delocalized over nodes of the system2. Other entities (not shown) may possibly be involved, such as traffic monitoring entities (packet analyzers, etc.). Additional features of the system1are described in section3.1.

Next, according to a final aspect, the invention can be embodied as a computer program product for characterizing a computerized system2. The computer program product comprises a computer readable storage medium having program instructions embodied therewith. Such instructions typically form a software, e.g., stored in the storage120of the system1described above. The program instructions can be executed by processing means105of such a system1to cause the latter to perform steps according to the present methods. Additional features of this computer program product are described in section 3.2.

The above embodiments have been succinctly described in reference to the accompanying drawings and may accommodate a number of variants. Several combinations of the above features may be contemplated. Examples are given in the next section.

2. Particularly Preferred Embodiments

2.1 Preferred Flows of Operations

FIG.2shows a high-level flow of operations according to preferred embodiments. Raw KPI values are continually collected S5with a view to forming KPIs as timeseries. Raw KPI values are recurrently buffered S10and then preprocessed S20. A preferred preprocessing pipeline S20is the following. The KPIs accessed are first rescaled to the range [0, 1] according to a min-max method. Missing values are then imputed using cubic splines. KPIs with lowest variance are subsequently dropped, while KPIs with extreme outliers are clipped, and the trends of the KPIs are removed by first-order differencing, if necessary. Still, other preprocessing techniques may be contemplated, depending on the data types and applications. The refined KPIs are then categorized S30, e.g., by clustering them. To that aim, in each of the clusters formed, representative KPIs (central and peripheral KPIs) are selected, queued, and ordered S40in respective buffer channels. The buffered KPIs are then injected S51in respective input channels of the ANN15, for it to reconstruct S55the initial KPIs. I.e., the central and peripheral KPIs are fed S51into respective input channels of the ANN15, which independently processes S52the injected KPI values in each input channel, prior to jointly processing S53-S55the resulting values via the encoder and decoder inner layers. Namely, the ANN15first compresses the KPI values via the TCN blocks and then reconstruct them via the DC blocks. Reconstruction errors are computed at step S60. Time-dependent indicators are obtained at step S70, based on the reconstruction errors computed at step S60. To that aim, reconstruction errors are averaged S70over all KPIs and smoothed over time, e.g., using a moving average function. Abnormal values of the time-dependent indicators are then identified at step S80, together with the top contributing KPIs. The latter are subsequently used to characterize S90the target system2, e.g., to detect a potential anomaly. A detected anomaly may, in turn, prompt support engineers to troubleshoot S90the system2or, more generally, take any action with respect to system2, e.g., to modify and improve its functioning. Meanwhile, the ANN15may be retrained S100, e.g., as necessary to cope with dynamically evolving conditions. This causes to update parameters (e.g., weights) of the ANN15, which impacts subsequent reconstructions S50, and so on.

FIG.3shows a functional diagram of the characterization system1. A preprocessing module11continually collects S5raw KPI values. The latter are buffered S10and preprocessed S20to form timeseries. Refined KPI values are then categorized S30and channeled S40via another module12, prior to injecting them into an ANN module14. I.e., representative KPIs of the clusters formed at step S30are coupled into input channels of the ANN15, to reconstruct S50the representative KPIs. Reconstruction errors computed in output of the ANN module14are then exploited by a further module16to characterize S90and, if necessary, troubleshoot the system2. Meanwhile, training data may be continually updated and stored in a dedicated storage13, with a view to continually retraining S100the ANN15and updating parameters thereof.

3. Technical Implementation Details

Computerized systems and devices can be suitably designed for implementing embodiments of the present invention as described herein. In that respect, it can be appreciated that the methods described herein are largely non-interactive and automated. In exemplary embodiments, the methods described herein can be implemented either in an interactive, a partly-interactive, or a non-interactive system. The methods described herein can be implemented in software, hardware, or a combination thereof. In exemplary embodiments, the methods proposed herein are implemented in software, as an executable program, the latter executed by suitable digital processing devices. More generally, embodiments of the present invention can be implemented wherein virtual machines and/or general-purpose digital computers, such as personal computers, workstations, etc., are used.

For instance, each of the systems1and2shown inFIG.1may comprise one or more computerized units101(e.g., general- or specific-purpose computers), such as shown in FIG.5. Each unit101may interact with other, typically similar units101, to perform steps according to the present methods.

In exemplary embodiments, in terms of hardware architecture, as shown inFIG.5, each unit101includes at least one processor105, and a memory110coupled to a memory controller115. Several processors (CPUs, and/or GPUs) may possibly be involved in each unit101. To that aim, each CPU/GPU may be assigned a respective memory controller, as known per se.

One or more input and/or output (I/O) devices145,150,155(or peripherals) are communicatively coupled via a local input/output controller135. The I/O controller135can be coupled to or include one or more buses and a system bus140, as known in the art. The I/O controller135may have additional elements, which are omitted for simplicity, such as controllers, buffers (caches), drivers, repeaters, and receivers, to enable communications. Further, the local interface may include address, control, and/or data connections to enable appropriate communications among the aforementioned components.

The processors105are hardware devices for executing software, including instructions such as coming as part of computerized tasks triggered by machine learning algorithms. The processors105can be any custom made or commercially available processor(s). In general, they may involve any type of semiconductor-based microprocessor (in the form of a microchip or chip set), or more generally any device for executing software instructions, including quantum processing devices.

The memory110typically includes volatile memory elements (e.g., random-access memory), and may further include nonvolatile memory elements. Moreover, the memory110may incorporate electronic, magnetic, optical, and/or other types of storage media.

Software in memory110may include one or more separate programs, each of which comprises executable instructions for implementing logical functions. In the example ofFIG.5, instructions loaded in the memory110may include instructions arising from the execution of the computerized methods described herein in accordance with exemplary embodiments. The memory110may further load a suitable operating system (OS)111. The OS111essentially controls the execution of other computer programs or instructions and provides scheduling, I/O control, file and data management, memory management, and communication control and related services.

Possibly, a conventional keyboard and mouse can be coupled to the input/output controller135. Other I/O devices140-155may be included. The computerized unit101can further include a display controller125coupled to a display130. The computerized unit101may also include a network interface or transceiver160for coupling to a network (not shown), to enable, in turn, data communication to/from other, external components, e.g., other units101.

The network transmits and receives data between a given unit101and other devices101. The network may possibly be implemented in a wireless fashion, e.g., using wireless protocols and technologies, such as Wifi, WiMax, etc. The network may notably be a fixed wireless network, a wireless local area network (LAN), a wireless wide area network (WAN), a personal area network (PAN), a virtual private network (VPN), an intranet or other suitable network system and includes equipment for receiving and transmitting signals. Preferably though, this network should allow very fast message passing between the units.

The network can also be an IP-based network for communication between any given unit101and any external unit, via a broadband connection. In exemplary embodiments, network can be a managed IP network administered by a service provider. Besides, the network can be a packet-switched network such as a LAN, WAN, Internet network, an Internet of things network, etc.

3.2 Computer Program Products

It is to be understood that although this disclosure refers to embodiments involving cloud computing, implementation of the teachings recited herein are not limited to a cloud computing environment. Rather, embodiments of the present invention are capable of being implemented in conjunction with any other type of computing environment now known or later developed. Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a provider of the service.

While the present invention has been described with reference to a limited number of embodiments, variants, and the accompanying drawings, it will be understood by those skilled in the art that various changes may be made, and equivalents may be substituted without departing from the scope of the present invention. In particular, a feature (device-like or method-like) recited in a given embodiment, variant or shown in a drawing may be combined with or replace another feature in another embodiment, variant, or drawing, without departing from the scope of the present invention. Various combinations of the features described in respect of any of the above embodiments or variants may accordingly be contemplated, that remain within the scope of the appended claims. In addition, many minor modifications may be made to adapt a particular situation or material to the teachings of the present invention without departing from its scope. Therefore, it is intended that the present invention not be limited to the particular embodiments disclosed, but that the present invention will include all embodiments falling within the scope of the appended claims. In addition, many other variants than explicitly touched above can be contemplated.