Patent application EP20168307A (EP), filed 2020-04-06
Publication number: EP3751430A1
Title: METHOD AND SYSTEM FOR LOG DATA ANALYTICS BASED ON SUPERMINHASH SIGNATURES
Abstract: [0001]    A method for identifying problem resolutions in a computing environment is provided. The method comprises receiving a problem graph for a current problem in the computing environment, wherein the problem graph describes abnormal operating conditions in the computing environment; generating a signature of interest from the problem graph; comparing the signature of interest to a plurality of signatures stored in an index, where each signature in the plurality of signatures is derived from a previous problem graph and has an associated problem resolution, such that the previous problem graph represents an occurrence of a previous problem in the computing environment; and identifying one or more previous problems that are similar to the current problem based on the comparison of the signature of interest to the plurality of signatures, wherein the signature of interest is generated by extracting a group of data features from the problem graph, where the group of data features preserves the connection structure of the graph. For each extracted data feature in the group of data features, generating a list of random numbers using a pseudo random number generator, where the random numbers in each of the lists of random numbers are generated from different non-overlapping intervals; for each list of random numbers, creating a random permutation of the list of random numbers; grouping the random numbers from the lists of random numbers into subsets of random numbers, where the random numbers having same placement in the lists of random numbers are grouped into the same subset of random numbers; from each subset of random numbers, selecting a particular random number from a subset of random numbers, where the particular random number has the smallest value amongst the random numbers in the subset of random numbers; and concatenating the selected random numbers to form the signature of interest from the problem graph.
IPC codes: G06F  11/    00            A I
G06F  16/    35            A I
G06F  21/    55            A I
Claims: number: 1
text: A method for identifying problem resolutions in a computing environment, comprising:
number: 2
text: The method of claim 1, wherein nodes comprising the problem graph represent events in the computing environment and edges in the problem graph represent a causal relationship between events in the problem graph.
number: 3
text: The method of claim 2, wherein extracting a group of data features from the problem graph further comprises creating a tuple for each edge in the problem graph, such that a given tuple includes data identifying nodes connected by a given edge.
number: 4
text: The method of claim 3, wherein extracting a group of data features from the problem graph further comprises identifying a causality probability associated with each edge in the problem graph, mapping the causality probability to one of a set of discrete values for the causality probability and adding the mapped discrete value to the tuple for the given edge.
number: 5
text: The method of at least one of the preceding claims, wherein identifying one or more previous problems that are similar to the current problem further comprises comparing each number in the signature of interest to corresponding number in a given signature from the plurality of signatures and totaling how many numbers are identical between the signature of interest and the given signature.
number: 6
text: The method of at least one of the preceding claims, wherein generating a list of random numbers includes applying a hash function to at least a portion of the extracted data feature.
number: 7
text: The method of at least one of the preceding claims, further comprising initializing a pseudo random number generator for each of the extracted data features in the group of data features.
number: 8
text: The method of claim 7, further comprising initializing the pseudo random number generator using a value of the extracted data feature.
number: 9
text: The method of at least one of the preceding claims, further comprising creating a random permutation of the row using Fisher-Yates shuffle method.
number: 10
text: The method of at least one of the preceding claims, further comprising combining the step of generating a list of random numbers and creating a random permutation into one iterative step.
number: 11
text: The method of at least one of the preceding claims, further comprising
Office action: search_report, dated 2020-12-16
Prior art cited: ref_id: - ANIMESH NANDI ET AL: "Anomaly Detection Using Program Control Flow Graph Mining From Execution Logs", PROCEEDINGS OF THE 22ND ACM SIGKDD INTERNATIONAL CONFERENCE ON KNOWLEDGE DISCOVERY AND DATA MINING, KDD '16, ACM PRESS, NEW YORK, NEW YORK, USA, 13 August 2016 (2016-08-13), pages 215 - 224, XP058276841, ISBN: 978-1-4503-4232-2, DOI: 10.1145/2939672.2939712
ref_type: npl
severity: background
ref_id: - TRISTAN CACQUERAY: "Anomaly Detection in CI logs", 14 November 2017 (2017-11-14), XP055625772, Retrieved from the Internet <URL:https://blogs.rdoproject.org/2017/11/anomaly-detection-in-ci-logs/> [retrieved on 20190924]
ref_type: npl
severity: background
ref_id: - STOKES JACK W ET AL: "MART: Targeted attack detection on a compromised network", MILCOM 2016 - 2016 IEEE MILITARY COMMUNICATIONS CONFERENCE, IEEE, 1 November 2016 (2016-11-01), pages 988 - 997, XP033028265, DOI: 10.1109/MILCOM.2016.7795459
ref_type: npl
severity: background
ref_id: - OTMAR ERTL: "SuperMinHash - A New Minwise Hashing Algorithm for Jaccard Similarity Estimation", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, 18 June 2017 (2017-06-18), XP080770671
ref_type: npl
severity: background
ref_id: - ANIMESH NANDI ET AL, "Anomaly Detection Using Program Control Flow Graph Mining From Execution Logs", PROCEEDINGS OF THE 22ND ACM SIGKDD INTERNATIONAL CONFERENCE ON KNOWLEDGE DISCOVERY AND DATA MINING, KDD '16, ACM PRESS, NEW YORK, NEW YORK, USA, (20160813), doi:10.1145/2939672.2939712, ISBN 978-1-4503-4232-2, pages 215 - 224, XP058276841 [I] 1-11 * the whole document *
ref_type: npl
severity: background
ref_id: - Tristan Cacqueray, "Anomaly Detection in CI logs", (20171114), URL: https://blogs.rdoproject.org/2017/11/anomaly-detection-in-ci-logs/, (20190924), XP055625772 [I] 1-11 * page  1, paragraph  1  - paragraph  4 * * page  2, line  21  - page  4, line  12 * * page  6, line  15  - line  l *
ref_type: npl
severity: background
ref_id: - STOKES JACK W ET AL, "MART: Targeted attack detection on a compromised network", MILCOM 2016 - 2016 IEEE MILITARY COMMUNICATIONS CONFERENCE, IEEE, (20161101), doi:10.1109/MILCOM.2016.7795459, pages 988 - 997, XP033028265 [I] 1-11 * the whole document *
ref_type: npl
severity: background
ref_id: - OTMAR ERTL, "SuperMinHash - A New Minwise Hashing Algorithm for Jaccard Similarity Estimation", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, (20170618), XP080770671 [A] 1-11 * the whole document *
ref_type: npl
severity: background
Final disposition: pending (2020-12-16)