Machine learning in edge analytics

• US 10,460,255 B2
• Filed: 07/29/2016
• Issued: 10/29/2019
• Est. Priority Date: 07/29/2016
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Nagaraju, Pradeep B., Oliner, Adam Jamison, Gilmore, Brian Matthew, Dean, Erick Anthony, Wang, Jiahan
• Primary Examiner(s): Chen, Alan
• Assistant Examiner(s): Islam, Urmana
• Application Number:
  US15/224,439
• Publication Number:
  US 20180032908A1
• Time in Patent Office: 1,187 Days
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps

Abstract

Disclosed is a technique that can be performed by an electronic device. The technique can include generating raw data based on inputs to the electronic device, and sending the raw data or data items over a network to a server computer system. The sent raw data or the data items can include training data. The technique can further include receiving global model data from the server computer system over the network. The global model data may have been derived from the training data in accordance with a machine learning process. The technique can further include generating an updated local model by updating a local model associated with the electronic device based on the received global model data, and processing local data based on the updated local model to generate output data. The local data can include raw data or data items generated based on inputs to the electronic device.

Claims

1. A method comprising:

generating, by an electronic device, raw data based on inputs to the electronic device;

generating, by the electronic device, a plurality of events indexed by timestamps, each of the plurality of events including a respective segment of the raw data;

extracting, by the electronic device, a data field from each of the plurality of events, the extracted data fields corresponding to data derived from the raw data;

sending, by the electronic device, the raw data or data derived from the raw data over a network to a server computer system, the sent raw data or the data derived from the raw data including training data;

receiving, by the electronic device, model data from the server computer system over the network, the model data having been derived by the server computer system from the training data by use of a machine learning process;

generating, by the electronic device, an updated local model by updating a local model associated with the electronic device based on the received model data; and

processing, by the electronic device, local data based on the updated local model to generate output data, the local data including raw data or data derived from raw data generated based on inputs to the electronic device.

2. The method of claim 1, further comprising:

executing, by the electronic device, a local action based on the output data, the local action including at least one of changing an operational parameter of the electronic device or changing a setting controlled by the electronic device.

3. The method of claim 1, wherein the data fields are extracted after the plurality of events are indexed.

4. The method of claim 1, wherein the data fields are extracted while the plurality of events are being indexed.

5. The method of claim 1, wherein the output data is first output data, the method further comprising:

experiencing, by the electronic device, a termination of all communication links with the server computer system;

generating, by the electronic device, a locally updated local model by performing a machine learning process to train the updated local model with raw data or data derived from raw data;

processing, by the electronic device, local data in accordance with the locally updated local model while the electronic device is communicatively disconnected from the server computer system to generate second output data; and

executing, by the electronic device, a local action based on the second output data, the local action including at least one of changing an operational parameter of the electronic device or changing a setting controlled by the electronic device.

6. The method of claim 1, wherein the model data is derived from at least one of raw data or data derived from raw data generated by a plurality of electronic devices including the electronic device, the model data having been derived in accordance with the machine learning process.

7. The method of claim 1, wherein the electronic device is an endpoint device that forms an endpoint of a communications link over the network.

8. The method of claim 1, wherein sending the raw data or the data derived from the raw data over the network to the server computer system comprises:

establishing a machine-to-machine (M2M) communications link between the electronic device and the server computer system; and

sending, by the electronic device, the raw data or the data derived from the raw data via the machine-to-machine communications link to the server computer system.

9. The method of claim 1, wherein the training data is only a portion of raw data or data derived from raw data generated by the electronic device.

10. The method of claim 1, wherein updating the local model comprises:

replacing the local model with a new local model included in the model data.

11. The method of claim 1, wherein updating the local model comprises:

modifying the local model with data indicating changes to the local model included in the model data.

12. A method comprising:

collecting, by a server computer system, global data from a plurality of electronic devices via a network, the global data including at least one of raw data or data derived from raw data generated locally by each of the plurality of electronic devices;

generating, by the server computer system, a plurality of events indexed by timestamps, each of the plurality of events including a respective segment of the global data;

extracting, by the server computer system, a data field from each of the plurality of events to obtain the data derived from the global data;

generating, by the server computer system, an updated global model by executing a machine learning process to train a global model based on the global data or data derived from the global data, the updated global model being configured to enable the plurality of electronic devices each to generate local data-driven outputs based on inputs to the electronic devices; and

sending, by the server computer system, model data based on the updated global model to each electronic device of the plurality of electronic devices, to cause the electronic device to modify or replace a local model of the electronic device based on the model data.

13. The method of claim 12, wherein the data fields are extracted after the plurality of events is indexed.

14. The method of claim 12, wherein the data fields are extracted while the plurality of events are being indexed.

15. The method of claim 12, wherein the server computer system is intermittently communicatively connected to at least one of the plurality of electronic devices.

16. The method of claim 12, wherein the model data for each of the electronic devices includes an instance of the updated global model configured to cause the electronic device to replace the local model associated with the electronic device with the instance of the global model.

17. The method of claim 12, wherein the model data for each of the electronic devices includes data configured to cause the electronic device to modify the local model associated with the electronic device in accordance with the updated global model.

18. An electronic device comprising:

a communication device through which the electronic device can communicate with a server computer system over a network;

a processor; and

memory containing instructions that, when executed by the electronic device, cause the electronic device to;

generate raw data based on inputs to the electronic device;

generate a plurality of events indexed by timestamps, each of the plurality of events including a respective segment of the raw data;

extract, after the plurality of events are indexed, a data field from each segment of raw data in each event, the extracted data fields corresponding to the data derived from the raw data;

send the raw data or data derived from the raw data over a network to a server computer system, the sent raw data or the data derived from the raw data including training data;

receive model data from the server computer system over the network, the model data having been derived by the server computer system from the training data by use of a machine learning process;

generate an updated local model by updating a local model associated with the electronic device based on the received model data; and

process local data based on the updated local model to generate output data, the local data including raw data or data derived from raw data generated based on inputs to the electronic device.

19. The electronic device of claim 18, wherein the instructions further cause the electronic device to:

execute a local action based on the output data, the local action including at least one of changing an operational parameter of the electronic device or changing a setting controlled by the electronic device.

20. The electronic device of claim 18, wherein the output data is first output data, and the instructions further cause the electronic device to:

experience termination of all communication links with the server computer system;

generate a locally updated local model by performing a machine learning process to train the updated local model with raw data or data derived from raw data;

process local data in accordance with the locally updated local model while the electronic device is communicatively disconnected from the server computer system to generate second output data; and

execute a local action based on the second output data, the local action including at least one of changing an operational parameter of the electronic device or changing a setting controlled by the electronic device.

21. The electronic device of claim 18, wherein the model data is derived from raw data or data derived from raw data generated by a plurality of electronic devices including the electronic device, the model data having been derived in accordance with the machine learning process.

22. The electronic device of claim 18, wherein the electronic device is an endpoint device configured to form an endpoint of a communications link over the network.

23. The electronic device of claim 18, wherein the model data is configured to modify the local model or replace the local model with a new local model included in the model data.

24. A server computer system comprising:

a communication device through which the server computer system can communicate with a plurality of electric devices over a network;

a processor;

and memory containing instructions that, when executed by the server computer system, cause the server computer system to;

collect global data from the plurality of electronic devices via a network, the global data including at least one of raw data or data derived from raw data generated locally by each of the plurality of electronic devices;

generate a plurality of events indexed by timestamps, each of the plurality of events including a respective segment of the global data;

extract a data field from each segment of global data in each event to obtain the data derived from the global data;

generate an updated global model by executing a machine learning process to train a global model based on the global data or data derived from the global data, the updated global model being configured to enable the plurality of electronic devices each to generate local data-driven outputs based on inputs to the electronic devices; and

send model data based on the updated global model to each electronic device of the plurality of electronic devices, to cause the electronic device to modify or replace a local model of the electronic device based on the model data.

25. The server computer system of claim 24, wherein the data fields are extracted after the plurality of events is indexed.

26. The server computer system of claim 24, wherein the server computer system is intermittently communicatively connected to at least one of the plurality of electronic devices.

27. The server computer system of claim 24, wherein the model data for each of the electronic devices includes an instance of the updated global model configured to cause the electronic device to replace the local model associated with the instance of the global model.