BEHAVIORAL RULES DISCOVERY FOR INTELLIGENT COMPUTING ENVIRONMENT ADMINISTRATION

• US 20140279797A1
• Filed: 03/12/2013
• Published: 09/18/2014
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: BladeLogic Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Dang, Derek, Mitbander, Bharat
• Granted Patent: US 9,195,943 B2
• Time in Patent Office: Days
• US Class Current: 706/47
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 5/046 Forward inferencing; Production systems

Abstract

A management system for determining causal relationships among system entities may include a causal relationship detector configured to receive events from a computing environment having a plurality of entities, and detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events, and a rules converter configured to convert one or more of the causal relationships into at least one behavioral rule. The at least one behavioral rule may indicate a causal relationship between at least two entities of the plurality of entities.

Claims

1. A management system for determining causal relationships among system entities, the management system comprising:

at least one processor;

a non-transitory computer-readable storage medium including instructions executable by the at least one processor, the instructions configured to implement,

a causal relationship detector configured to receive events from a computing environment having a plurality of entities, and configured to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events; and

a rules converter configured to convert one or more of the causal relationships into at least one behavioral rule, the at least one behavioral rule indicating a causal relationship between at least two entities of the plurality of entities.

2. The management system of claim 1, wherein the causal relationship detector includes:

a graph generator configured to generate one or more graphs based on the events, each graph including vertices and arcs connecting temporally adjacent vertices, each vertex representing an event instance of one or more events, and each arc representing a level of causal connectivity between at least two vertices,

wherein the causal relationship detector is configured to detect the causal relationships based on the one or more graphs, wherein at least two connected vertices represents the causal relationship between a set of entities.

3. The management system of claim 2, wherein the event instance includes a creation of the one or more events, a closure of the one or more events, or an absence of the one or more events where a pattern of appearance has been established.

4. The management system of claim 1, wherein the causal relationship detector includes a graph generator configured to generate a graph based on the events, the graph generator including:

a vertex classifier configured to create vertices based on an initial set of events including a first vertex, a second vertex, and a third vertex, the vertex classifier further configured to arrange the first vertex, the second vertex, and the third vertex in chronological order; and

an arc classifier configured to create arcs between temporally adjacent vertices including a first arc connected between the first vertex and the second vertex and a second arc connected between the second vertex and the third vertex,

wherein the arc classifier is configured to annotate each arc with a coefficient value representing a level of connectivity between the temporally adjacent vertices.

5. The management system of claim 4, wherein the arc classifier is configured to receive a relationship model providing at least one known relationship between the plurality of entities, and the arc classifier is configured to strengthen at least one arc of the graph based on the at least one known relationship.

6. The management system of claim 4, wherein the graph generator is configured to update the graph based on a secondary set of events, wherein the arc classifier is configured to strengthen or weaken the arcs of the graph based on, in part, a presence or absence of a repeat pattern of vertices associated with the secondary set of events.

7. The management system of claim 6, wherein each vertex is represented by a string representation, and the arc classifier is configured to analyze the repeat pattern of vertices by searching the graph for a match with a search pattern that includes a concatenation of string representations corresponding to at least two temporally adjacent vertices associated with the secondary set of sets.

8. The management system of claim 6, wherein each arc is associated with a time limit and the time limit is dependent upon the coefficient value, wherein the causal relationship detector further includes:

a pruner unit configured to remove at least one arc from the graph when the time limit associated with the at least one arc has been exhausted,

wherein the pruner unit is configured to remove at least one vertex when the at least one vertex is not connected to any other vertex.

9. The management system of claim 1, wherein the rules converter is configured to map at least two entities of the plurality of entities to the at least two vertices, and generate the at least one behavior rule that specifies the causal relationship between the at least two entities.

10. A non-transitory computer-readable medium storing instructions that when executed cause at least one processor to determine causal relationships among system entities, the instructions comprising instructions to:

receive events from a computing environment having a plurality of entities, and detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events; and

convert one or more of the causal relationships into at least one behavioral rule, the at least one behavioral rule indicating a causal relationship between at least two entities of the plurality of entities.

11. The non-transitory computer-readable medium of claim 10, wherein the instructions to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events includes instructions to:

generate one or more graphs based on the events, each graph including vertices and arcs connecting temporally adjacent vertices, each vertex representing an event instance of one or more events, and each arc representing a level of causal connectivity between at least two vertices; and

detect the causal relationships based on the one or more graphs, wherein at least two connected vertices represents the causal relationship between a set of entities.

12. The non-transitory computer-readable medium of claim 11, wherein the event instance includes a creation of the one or more events, a closure of the one or more events, or an absence of the one or more events where a pattern of appearance has been established.

13. The non-transitory computer-readable medium of claim 10, wherein the instructions to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events includes instructions to:

generate a graph including;

create vertices based on an initial set of events including a first vertex, a second vertex, and a third vertex, and arrange the first vertex, the second vertex, and the third vertex in chronological order;

create arcs between temporally adjacent vertices including a first arc connected between the first vertex and the second vertex and a second arc connected between the second vertex and the third vertex; and

annotate each arc with a coefficient value representing a level of connectivity between the temporally adjacent vertices.

14. The non-transitory computer-readable medium of claim 13, wherein the instructions further include instructions to:

receive a relationship model providing at least one known relationship between the plurality of entities; and

strengthen at least one arc of the graph based on the at least one known relationship.

15. The non-transitory computer-readable medium of claim 13, wherein the instruction further include instructions to:

update the graph based on a secondary set of events including strengthening or weakening the arcs of the graph based on, in part, a presence or absence of a repeat pattern of vertices associated with the secondary set of events.

16. The non-transitory computer-readable medium of claim 15, wherein each vertex is represented by a string representation, and the instructions to update the graph include:

analyze the repeat pattern of vertices by searching the graph for a match with a search pattern that includes a concatenation of string representations corresponding to at least two temporally adjacent vertices associated with the secondary set of sets.

17. The non-transitory computer-readable medium of claim 15, wherein each arc is associated with a time limit and the time limit is dependent upon the coefficient value, wherein the instructions to update the graph include:

remove at least one arc from the graph when the time limit associated with the at least one arc has been exhausted; and

remove at least one vertex when the at least one vertex is not connected to any other vertex.

18. A method for determining causal relationships among system entities, the method comprising:

receiving, by at least one processor, events from a computing environment having a plurality of entities, and detecting, by the at least one processor, causal relationships among the plurality of entities, during runtime of the computing environment, based on the events; and

converting, by the at least one processor, one or more of the causal relationships into at least one behavioral rule, the at least one behavioral rule indicating a causal relationship between at least two entities of the plurality of entities.

19. The method of claim 18, wherein the detecting, by the at least one processor, causal relationships among the plurality of entities, during runtime of the computing environment, based on the events includes:

generating one or more graphs based on the events, each graph including vertices and arcs connecting temporally adjacent vertices, each vertex representing an event instance of one or more events, and each arc representing a level of causal connectivity between at least two vertices; and

detecting the causal relationships based on the one or more graphs, wherein at least two connected vertices represents a causal relationship between a set of entities.

20. The method of claim 19, wherein the event instance includes a creation of the one or more events, a closure of the one or more events, or an absence of the one or more events where a pattern of appearance has been established.