Discovering critical alerts through learning over heterogeneous temporal graphs

A method is provided that includes transforming training data into a neural network based learning model using a set of temporal graphs derived from the training data. The method includes performing model learning on the learning model by automatically adjusting learning model parameters based on the set of the temporal graphs to minimize differences between a predetermined ground-truth ranking list and a learning model output ranking list. The method includes transforming testing data into a neural network based inference model using another set of temporal graphs derived from the testing data. The method includes performing model inference by applying the inference and learning models to test data to extract context features for alerts in the test data and calculate a ranking list for the alerts based on the extracted context features. Top-ranked alerts are identified as critical alerts. Each alert represents an anomaly in the test data.

BACKGROUND

Technical Field

The present invention relates to information processing, and more particularly to discovering critical alerts through learning over heterogeneous temporal graphs.

Description of the Related Art

Log analysis systems offer services to automatically process logs from large complex systems and generate alerts when log anomalies are detected.

Since it is unfeasible for system admins to investigate an excessive number of alerts one by one, there is a need for an intelligent tool capable of recommending top-ranked alerts that will be more likely to trigger meaningful system diagnosis and improve system administrators' productivity.

SUMMARY

According to an aspect of the present invention, a computer-implemented method is provided. The method includes transforming, by a processor, training data into a neural network based learning model using a set of temporal graphs derived from the training data. The method further includes performing, by the processor, model learning on the learning model by automatically adjusting learning model parameters based on the set of the temporal graphs to minimize differences between a predetermined ground-truth ranking list and a learning model output ranking list. The method also includes transforming, by the processor, testing data into a neural network based inference model using another set of temporal graphs derived from the testing data. The method additionally includes performing, by the processor, model inference by applying the inference model and the learning model to test data to extract context features for alerts in the test data and calculate a ranking list for the alerts in the test data based on the extracted context features. Top-ranked ones of the alerts in the ranking list are identified as critical alerts. Each of the alerts represents an anomaly in the test data.

According to another aspect of the present invention, a computer program product is provided. The computer program product includes a non-transitory computer readable storage medium having program instructions embodied therewith. The program instructions are executable by a computer to cause the computer to perform a method. The method includes transforming, by a processor of the computer, training data into a neural network based learning model using a set of temporal graphs derived from the training data. The method further includes performing, by the processor, model learning on the learning model by automatically adjusting learning model parameters based on the set of the temporal graphs to minimize differences between a predetermined ground-truth ranking list and a learning model output ranking list. The method also includes transforming, by the processor, testing data into a neural network based inference model using another set of temporal graphs derived from the testing data. The method additionally includes performing, by the processor, model inference by applying the inference model and the learning model to test data to extract context features for alerts in the test data and calculate a ranking list for the alerts in the test data based on the extracted context features. Top-ranked ones of the alerts in the ranking list are identified as critical alerts. Each of the alerts represents an anomaly in the test data.

According to yet another aspect of the present invention, a computer processing system is provided. The computer processing system includes a processor. The processor is configured to transform training data into a neural network based learning model using a set of temporal graphs derived from the training data. The processor is further configured to perform model learning on the learning model by automatically adjusting learning model parameters based on the set of the temporal graphs to minimize differences between a predetermined ground-truth ranking list and a learning model output ranking list. The processor is also configured to transform testing data into a neural network based inference model using another set of temporal graphs derived from the testing data. The processor is further configured to perform model inference by applying the inference model and the learning model to test data to extract context features for alerts in the test data and calculate a ranking list for the alerts in the test data based on the extracted context features. Top-ranked ones of the alerts in the ranking list are identified as critical alerts. Each of the alerts represents an anomaly in the test data.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The present invention is directed to discovering critical alerts through learning over heterogeneous temporal graphs

In an embodiment, the present invention provides a solution to the alert ranking problem which can involve the following: given a collection of logs, alerts generated from a subset of abnormal logs, and users' feedback on such alerts indicating whether they are meaningful for further investigation, learn a rank function for alerts so that for new alerts, higher ranked ones are more likely to be true anomalies that trigger meaningful investigation and/or curative actions.

In an embodiment, a general-purpose method is proposed (and interchangeably referred to as “TGNet”) that learns a rank function from users' feedback on alerts. Unlike conventional methods that assume the quality of alerts is identically and independently distributed, TGNet assumes context features define each individual alert so that the quality of each alert is conditioned on its context features. TGNet includes the following two major steps: model learning; and model inference.

In model learning, given training data that include users' preference on alerts, TGNet automatically adjusts model parameters and minimizes ranking discrepancy between model output and user feedback.

In model inference, given model parameters, TGNet automatically extracts context features for alerts by performing structural and temporal graph propagation over temporal graphs, and assign proper ranking score by the context features.

Referring now in detail to the figures in which like numerals represent the same or similar elements and initially toFIG. 1, a block diagram illustrating an exemplary processing system100to which the present principles may be applied, according to an embodiment of the present principles, is shown. The processing system100includes at least one processor (CPU)104operatively coupled to other components via a system bus102. A cache106, a Read Only Memory (ROM)108, a Random Access Memory (RAM)110, an input/output (I/O) adapter120, a sound adapter130, a network adapter140, a user interface adapter150, and a display adapter160, are operatively coupled to the system bus102.

Moreover, it is to be appreciated that system200described below with respect toFIG. 2is a system for implementing respective embodiments of the present principles. Part or all of processing system100may be implemented in one or more of the elements of system200.

Further, it is to be appreciated that processing system100may perform at least part of the method described herein including, for example, at least part of method300ofFIG. 3and/or at least part of method400ofFIG. 4. Similarly, part or all of system200may be used to perform at least part of method300ofFIG. 3and/or at least part of method400ofFIG. 4.

FIG. 2shows a block diagram of an exemplary environment200to which the present invention can be applied, in accordance with an embodiment of the present invention. The environment200is representative of a computer network to which the present invention can be applied. The elements shown relative toFIG. 2are set forth for the sake of illustration. However, it is to be appreciated that the present invention can be applied to other network configurations and other operational environments as readily contemplated by one of ordinary skill in the art given the teachings of the present invention provided herein, while maintaining the spirit of the present invention.

The environment200at least includes a critical alert recommendation system210operatively coupled to a set of computing nodes (e.g., servers, providers of services, etc.)220.

The critical alert recommendation system210is trained using training data. The training data can include, for example, logs, alerts, and user feedback on alerts. The source(s) of the training data can be and/or otherwise involve an alert database and/or a user feedback (on alerts) database. The training data can be obtained from the set of computing nodes220or another source(s). In either case, databases such as the aforementioned alert and user feedback databases can be included in these sources such as, but not limited to, the set of computing nodes220. The training data is used to form a model used for model learning (hereinafter interchangeably referred to as the “learning mode”). To that end, learning model parameters can be automatically adjusted to minimize differences between a ground-truth ranking list and a model output ranking list. Preferably, the training data is obtained from the same or similar source as the testing data.

The critical alert recommendation system210receives testing data from the set of computing nodes220. The testing data is used to form a model used for model inference (hereinafter interchangeably referred to as the “inference model”). The inference model is used to identify critical alerts in the test data using ranking. In this way, higher ranked alerts, which are more likely to be true anomalies, can be further investigated and/or acted upon (using curative actions).

The learning model and the inference model can be considered to form a temporal graph filter. The inputs to the temporal graph filter can be considered to be the inputs to the models, while the output of the temporal graph filer can be considered to be the output of the inference model.

The critical alert recommendation system210can be any type of computer processing system including, but not limited to, servers, desktops, laptops, tablets, smart phones, media playback devices, and so forth, depending upon the particular implementation. For the sake of illustration, the computer processing system210is a server.

The critical alert recommendation system210can be configured to perform an action (e.g., a control action) on a controlled system, machine, and/or device230responsive to detecting an anomaly. Such action can include, but is not limited to, one or more of: applying an antivirus detection and eradication program; powering down the controlled system, machine, and/or device230or a portion thereof; powering down, e.g., a system, machine, and/or a device that is affected by an anomaly in another device, opening a valve to relieve excessive pressure (depending upon the anomaly), locking an automatic fire door, and so forth. As is evident to one of ordinary skill in the art, the action taken is dependent upon the type of anomaly and the controlled system, machine, and/or device230to which the action is applied.

In an embodiment, a safety system or device240can implement the aforementioned or other action, responsive to a control signal from the critical alert recommendation system210. The safety system or device240can be used to control a shut off switch, a fire suppression system, an overpressure valve, and so forth. As is readily appreciated by one of ordinary skill in the art, the particular safety system or device240used depends upon the particular implementation to which the present invention is applied. Hence, the safety system240can be located within or proximate to or remote from the controlled system, machine, and/or device230, depending upon the particular implementation.

In the embodiment shown inFIG. 2, the elements thereof are interconnected by a network(s)201. However, in other embodiments, other types of connections can also be used. Additionally, one or more elements inFIG. 2may be implemented by a variety of devices, which include but are not limited to, Digital Signal Processing (DSP) circuits, programmable processors, Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), Complex Programmable Logic Devices (CPLDs), and so forth. These and other variations of the elements of environment200are readily determined by one of ordinary skill in the art, given the teachings of the present invention provided herein, while maintaining the spirit of the present invention.

FIG. 3shows system log data presented as a temporal graph300to which the present invention can be applied, in accordance with an embodiment of the present invention. The system log data can correspond to logs from, for example, a data center or other data processing entity.

Nodes of the temporal graph300represent a heterogeneous set of system entities, edges represent dependencies between the system entities, and time stamps on edges indicate when interactions occurred.

The system entities include servers310, logs320, alerts330, and software components340. In the embodiment ofFIG. 3, the servers include a SAP server311, a front-end server312, and a SAP server313. In the embodiment ofFIG. 3, the software components340include a database (DB) service341, a SAP service342, and a network service343. Of course, other servers and/or other software components can be used, depending upon the implementation, while maintaining the spirit of the present invention.

FIG. 4shows an exemplary method400for alert ranking, in accordance with an embodiment of the present invention.

At step401, receive training data. The training data can include logs, alerts, and user feedback on alerts.

At step402, perform model construction on the training data to transform the training data into a model. The model resulting from step402is used for model learning per step403, and is thus interchangeably referred to herein as the “learning model”.

At step403, perform model learning (using the learning model).

At step404, receive testing data. The testing data can include logs and alerts.

At step405, perform model construction on the testing data to transform the testing data into another model. The other model resulting from step405is used for model inference per step406, and is thus interchangeably referred to herein as the “inference model”.

At step406, perform model inference (using the inference model).

At step407, perform an action responsive to an output of the model inference.

A further description will now be given regarding some of the steps of method400.

Further regarding step401, the present invention takes output data from log analytics systems as its input data for model learning. Such data include logs, alerts, and user feedback on alerts. Regarding the logs, each log indicates an event happened at a specific time about a specific software in a specific machine. Regarding the alerts, each alert indicates a log or a set of logs is abnormal. Regarding the user feedback, the same indicates importance of alerts judged by users' domain knowledge. Such alert importance naturally forms a ranking list over alerts.

Further regarding step404, for any new data, the present invention performs model inference and give a recommended ranking list over alerts in the data. The new data is referred to as testing data, which can include logs and alerts. Regarding the logs, each log indicates an event happened at a specific time about a specific software in a specific machine. Regarding the alerts, each alert indicates a log or a set of logs is abnormal.

FIG. 5shows an exemplary method500further showing the model construction of step402ofFIG. 4, in accordance with an embodiment of the present invention.

At step501, transform the training data into a temporal graph.

At step502, calculate, from the temporal graph, a graph sequence including multiple temporal graphs.

At step503, transform the graph sequence into the neural network based learning model.

A further description will now be given regarding the steps of method500, in accordance with one or more embodiments of the present invention.

Further regarding step501, as mentioned above, training data include logs, alerts, and user feedback. Based on log and alert information, four types of graph nodes can be derived as follows: (1) log node; (2) alert node; (3) server node; and (4) software node. In the following, we show how different types of nodes connect to each other.

Step501can be considered to include and/or otherwise involving the following501A-E.

At step501A, let each log node represent an individual log in training data. Let a log node connects to the software node that generates this log, and all the alert nodes that are related to this log.

At step501B, let each alert node represent an alert in training data. Let an alert node connects to a log or a sets of logs that is related this alert.

At step501C, let each server node represents a server that appears in training data. Let a server node connect to a set of software nodes that are contained from this server.

At step501D, let each software node represents a software that appears in training data. Let a software node connect to a set of logs that are generated from this software, and the server node that contains this software.

At step501E, let each edge mentioned above be associated with a pair of timestamps as follows: one denotes the starting timestamp of the dependency encoded by this edge; and the other denotes the ending timestamps of the dependency encoded by this edge.

After these steps (501A-E), we obtain a temporal graph GTderived from training data.

Further regarding step502, a graph sequence Gs=G(1), G(2), . . . , G(k−1), G(k)> is derived for the temporal graph G generated at step501. We start with an initial graph G(1)that includes nodes and edges with smallest starting timestamps. Then we perform the following steps502A-C to generate a sequence of graphs. Without loss of generality, G(i)is the graph under processing, and G(i)starts at time t(i)start.

At step502A, let t(i)endbe the earliest timestamp after t(i)startwhen there are edges run out of their lifetime or there are new edges that join. The time interval (t(i)start, t(i)end) indicates the lifetime during which G(i) holds.

At step502B, generate G(i+1)by removing expired edges from G(i)and adding new edges to G(i), and we set t(t+1)startas t(i)end.

At step502C, repeat steps502A and502B until the resulting graph sequence covers all the information in G.

After these steps (502A-C), a graph sequence Gs=G(1), G(2), . . . , G(k−1), G(k)> is derived from the training data.

Further regarding step503, Gs is transformed into TGNet as per steps503A-G as follows. Without loss of generality, G(i)is the graph under processing.

At step503A, identify the node set N(i)from G(i)that includes the nodes which appear in Gs for the first time. For each node v in N(i), it is associated with a di×1 input vector xv. Note that exact values of xvare decided in a concrete application.

At step503B, for any node v in G(i), it is associated with a di×1 hidden vector h(i)v.

At step503C, set up a dh×diparameter matrix Win, which controls the process of transforming input vectors into hidden vectors.

At step503D, set up a 2dh×1 parameter vector θc, which controls the amount of influence between two nodes.

At step503E, set up a (dh+1)×dhparameter matrix Wtemp, which controls the amount of temporal changes on each node's hidden vector.

At step503F, set up a dh×1 parameter vector θout, which controls the process of transforming hidden vectors into output ranking score.

At step503G, we repeat steps503A-F until all graphs in Gs are processed.

After these steps (503A-G), a TGNet instance is obtained that is ready for parameter learning.

FIG. 6shows an exemplary method600further showing the model learning of step403ofFIG. 4, in accordance with an embodiment of the present invention.

At the beginning, we randomly initialize model parameters including Win, θc, θout, and Wtemp. Then we repeat steps601and602described below until the discrepancy converges.

At step601, perform a model evaluation.

At step602, perform a model parameter adjustment.

A further description will now be given regarding the steps of method500, in accordance with one or more embodiments of the present invention.

Further regarding step601, given model parameters, the goal is to evaluate a model-output ranking list. We go through graphs in Gs one by one, and repeat the following process, as delineated by steps601A-D. Without loss of generality, G(i)is the graph under processing.

At step601A, let N(i)be the node set in G(i)that includes all the nodes that appear in Gs for the first time. For any node v in N(i), we compute its hidden vector by the following equation
h(i)v=f(Winxv)
where f( ) is sigmoid function.

At step601B, perform concurrent propagation (as follows). For any node v in G(i), initialize h(i, 0)vby h(i)v, and perform concurrent propagation by the following propagation:
hv(i,j+1)=Σu∈N(v)∪)∪{v}σ(zv(i,j))uhu(i,j)
where σ(z(i,j)v)uis the amount of influence from u to v. In particular, σ(z(i,j)v)ucomputed as follows:

σ⁡(zv(i,j))⁢u=ezv,u(i,j)∑w∈N⁡(v)⋃)⋃{v}⁢⁢ezv,w(i,j)
where z(i,j)v,uis computed by the following equation:
z(i,j)v,u=f(θcT[h(i,j)v,h(i,j)u])

Note that concurrent propagation is performed D(i)times on graph G(i), where D(i)is the diameter of G(i).

At step601C, generate a ranking score (as follows). If node v is an alert node, its ranking score is computed by the following:
{circumflex over (r)}v=f(θoutThv(i,D(i)))

At step601D, perform temporal propagation (as follows). For any node v in G(i), if it still exists in G(i+1). h(i+1)vis initialized as follows:
hv(i+1)=λv(i)·hv(i,D(i))),
where operator o is element-wise product, and λv(i)is computed by
λv(i)=f(Wtemp[hv(i,D(i)),tend(i))−tstart(i)])

The model evaluation per step601repeats steps601A-D from G(1)to G(k)covering all graphs in Gs.

Further regarding step602, we first utilize the output from model evaluation (601) to compute the error, and then perform parameter adjustment by backpropagation through time. In an embodiment, step602can include steps602A-B.

At step602A, perform error computation (as follows). In an embodiment, the model error is computed by the following equation:
J=Σv:alertΣu:alertδ(v,u)({circumflex over (r)}v−{circumflex over (r)}u)
where δ(v, u) is −1, if v's rank is higher than u's rank in user feedback; otherwise, it is 1.

At step602B, perform error minimization (as follows). In order to minimize J, stochastic gradient descent over J and backpropagation through time are performed to adjust parameters including Win, θc, θout, and Wtemp.

Note that adjusted parameters after step602will be the input parameters for the next round of step601. We repeat a loop over steps601and602until the improvement between two rounds is small enough (e.g., below a threshold amount).

FIG. 7shows an exemplary method700further showing the model construction of step405ofFIG. 4, in accordance with an embodiment of the present invention.

At step701, transform the testing data into a temporal graph.

At step702, calculate, from the temporal graph, a graph sequence including multiple temporal graphs.

At step703, transform the graph sequence into the neural network based inference model.

A further description will now be given regarding the steps of method700, in accordance with one or more embodiments of the present invention.

It is to be appreciated that steps701and702are performed similar to steps501and502of method500ofFIG. 5. Regarding step703, we set up input and hidden vectors for nodes in graph sequence, and model parameters are the learned ones from step403of method400ofFIG. 4.

FIG. 8shows an exemplary method800further showing the model inference of step406ofFIG. 4, in accordance with an embodiment of the present invention.

At step801, perform a model evaluation (as follows). Using the learned parameters from model learning, a model evaluation is performed using the same approach described for step algorithm discussed in step601of method600ofFIG. 6.

At step802, generate an alert recommendation (as follows). Based on the ranking score on alerts, extract the top-ranked alerts and recommend them to users for further investigation.

A description will now be given regarding alert relationships to which the present invention can be applied, in accordance with one or more embodiments of the present invention.

For example, such alert relationships can include, but are not limited to the following:Alerts are not isolatedTemporal closeness:Alert A is one second behind alert B;Alert C is one minute behind alert B.(A,B) is closer than (B,C).Physical closeness:A and B are generated from the same server.B and C are generated from different servers.(A, B) is closer.Semantic closeness:A and B are generated from logs sharing the same template.B and C are generated from logs sharing different templates.(A, B) is closer.

A description will now be given of some of the many attendant advantages of the present invention.

The present invention provides a method that leverages user knowledge to improve accuracy and usability of alert ranking in general log analysis systems.

In TGNet model learning, user feedback on alerts is utilized to train model parameters without heavy dependency on sophisticated domain knowledge, which significantly improves the usability of alert ranking.

In TGNet model inference, context features are automatically formed without human interference. Such context features further generate meaningful ranking scores that suggest the priority of alert investigation and improve system admins' productivity

The present invention provides a method that uses temporal graphs and graph sequence to represent temporal and structural relationships in log data, including402and403, which enables context features extraction. Unlike conventional methods that assume alerts are independently and identically distributed and anomaly detectors have uniform quality, the present invention presumes that each alert is defined by its context features.

A deep learning method is provided that automatically extracts context features for alerts so that the discrepancy between model-output ranking list and ground truth ranking list is minimized, including403and406of method400ofFIG. 5. Unlike traditional learning-to-rank methods on graphs that use fixed pair-wise node influence which is either learned or preset by heuristic methods, the present invention dynamically decides node and temporal influence by their updated hidden vectors, which significantly enhances the expressive power of the model.

The present invention provides data fusion over alerts by identifying relationships between heterogeneous alerts; integrating alert relationships into temporal graphs; forming contexts by substructures in the temporal graphs; and ranking alerts by features provided in the contexts (high rank→critical). The alerts can be generated using multiple different detectors.

These and other advantages of the present invention are readily determined by one of ordinary skill in the art, given the teachings of the present invention provided herein.

As readily appreciated by one of ordinary skill in the art, given the teachings of the present invention provided herein, that the present invention can be applied to various applications. For example, some exemplary applications to various embodiments of the present invention can be applied include, but are not limited to, the following: big data analytics in system management; system malfunction detection via alerts; the high false positive problem; critical alert discovery; learning contexts and ranking alerts; and so forth.

Regarding learning contexts and ranking alerts, the context can be used to determine under what conditions the (anomaly) detectors perform well or bad. Moreover, in an embodiment, user feedback is used to guide both context formulation and ranking. To that end, in an embodiment, a parametric model is used to simulate context formulation and ranking process. The user feedback can involve user labels or feedback including, but is not limited to, “critical”, “suspicious”, or “ignore”. Model parameters are then learned that best meet (match) the user feedback.