System fault diagnosis via efficient temporal and dynamic historical fingerprint retrieval

• US 10,289,478 B2
• Filed: 04/18/2017
• Issued: 05/14/2019
• Est. Priority Date: 04/26/2016
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Cheng, Wei, Yoshihira, Kenji, Chen, Haifeng, Jiang, Guofei
• Primary Examiner(s): Riad, Amine
• Application Number:
  US15/490,499
• Publication Number:
  US 20170308427A1
• Time in Patent Office: 756 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: H04L 41/064 involving time analysis

Abstract

Methods are provided for both single modal and multimodal fault diagnosis. In a method, a fault fingerprint is constructed based on a fault event using an invariant model. A similarity matrix between the fault fingerprint and one or more historical representative fingerprints are derived using dynamic time warping and at least one convolution. A feature vector in a feature subspace for the fault fingerprint is generated. The feature vector includes at least one status of at least one system component during the fault event. A corrective action correlated to the fault fingerprint is determined. The corrective action is initiated on a hardware device to mitigate expected harm to at least one item selected from the group consisting of the hardware device, another hardware device related to the hardware device, and a person related to the hardware device.

Claims

1. A computer-implemented method for multimodal fault diagnosis, the method comprising:

constructing, by a processor using an invariant model, a fault fingerprint based on a fault event;

generating, by the processor, a feature vector in a feature subspace for the fault fingerprint, wherein said feature vector includes at least one status of at least one system component during the fault event, with fault fingerprint feature vectors generated from the fault fingerprint and one or more historical representative fingerprint feature vectors from the one or more historical representative fingerprints;

determining, by the processor, a corrective action correlated to the fault fingerprint, from among a plurality of candidate corrective actions associated with the one or more historical representative fingerprints, based on a Jaccard similarity using the feature vector in the feature subspace; and

initiating, by the processor, the corrective action on a hardware device to mitigate expected harm to at least one item selected from the group consisting of the hardware device, another hardware device related to the hardware device, and a person related to the hardware device.

2. The computer-implemented method of claim 1, wherein the invariant model learns continuous pair-wise correlations between one or more system components during the fault event.

3. The computer-implemented method of claim 2, wherein the invariant model computes a normalized residual between a measurement for one of the pair-wise correlations and an estimate for the one of the pair-wise correlations, wherein the normalized residual exceeding a predetermined threshold signals the one of the pair-wise correlations is broken.

4. The computer-implemented method of claim 1, wherein the invariant model includes an autoregressive model.

5. The computer-implemented method of claim 1, further comprising generating the feature subspace using one or more binary vectors representing each of one or more pair-wise correlations in the invariant model.

6. The computer-implemented method of claim 5, wherein the one or more binary vectors has a value of 1 if the represented one or more pair-wise correlations is broken and 0 otherwise.

7. The computer-implemented method of claim 1, wherein the generating the feature vector further includes mapping the fault fingerprint feature vectors and the one or more historical representative fingerprint feature vectors in the feature subspace based on informative broken evidence.

8. A non-transitory article of manufacture tangibly embodying a computer readable program which when executed causes a computer to perform the steps of claim 1.

9. A computer-implemented method for multimodal fault diagnosis, the method comprising:

constructing, by a processor using an invariant model, a fault fingerprint based on a fault event;

generating, by the processor, a feature subspace using one or more binary vectors representing each of one or more pair-wise correlations in the invariant model with a chi-square feature selection method using one or more categories of historical fingerprints with one or more fault labels;

generating, by the processor, a feature vector in the feature subspace for the fault fingerprint, wherein said feature vector includes at least one status of at least one system component during the fault event;

determining, by the processor, a corrective action correlated to the fault fingerprint, from among a plurality of candidate corrective actions associated with the one or more historical representative fingerprints, based on a Jaccard similarity using the feature vector in the feature subspace; and

initiating, by the processor, the corrective action on a hardware device to mitigate expected harm to at least one item selected from the group consisting of the hardware device, another hardware device related to the hardware device, and a person related to the hardware device.

10. The computer-implemented method of claim 9, wherein the invariant model learns continuous pair-wise correlations between one or more system components during the fault event.

11. The computer-implemented method of claim 10, wherein the invariant model computes a normalized residual between a measurement for one of the pair-wise correlations and an estimate for the one of the pair-wise correlations, wherein the normalized residual exceeding a predetermined threshold signals the one of the pair-wise correlations is broken.

12. The computer-implemented method of claim 9, wherein the invariant model includes an autoregressive model.

13. The computer-implemented method of claim 9, wherein the one or more binary vectors has a value of 1 if the represented one or more pair-wise correlations is broken and 0 otherwise.

14. The computer-implemented method of claim 9, wherein the generating the feature vector includes generating fault fingerprint feature vectors from the fault fingerprint and one or more historical representative fingerprint feature vectors from the one or more historical representative fingerprints.

15. The computer-implemented method of claim 14, wherein the generating the feature vector further includes mapping the fault fingerprint feature vectors and the one or more historical representative fingerprint feature vectors in the feature subspace based on informative broken evidence.

16. A non-transitory article of manufacture tangibly embodying a computer readable program which when executed causes a computer to perform the steps of claim 9.