METHODS AND SYSTEMS FOR IDENTIFYING ACTION FOR RESPONDING TO ANOMALY IN CLOUD COMPUTING SYSTEM

• US 20140372347A1
• Filed: 10/10/2011
• Published: 12/18/2014
• Est. Priority Date: 10/10/2011
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Cohen, Ira, Mordechai, Eli, Assulin, Ahad, Dakar, Refael
• Granted Patent: US 10,599,506 B2
• Time in Patent Office: Days
• US Class Current: 706/12
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06N 20/00 Machine learning

Abstract

Methods performed by a physical computing system include automatically identifying, using at least one trained classifier, an action for responding to an anomaly in the execution of the application in a cloud computing system. The at least one trained classifier relates a metrics set to a result of performing an action for addressing an anomaly. Systems and computer readable media are also described herein.

Claims

1. A method performed by a physical computing system, the method comprising:

determining whether a set of quantified metrics corresponds to an anomaly, the metrics set being associated with an execution of an application in a cloud computing system; and

upon determining that the set of quantified metrics corresponds to an anomaly, automatically identifying, using at least one trained classifier, an action for addressing the anomaly, wherein the at least one trained classifier relates a metrics set to a result of performing an action for addressing an anomaly.

2. The method of claim 1, wherein identifying an action for addressing the anomaly includes selecting an action from a plurality of actions including at least one component type action and at least one component instance action,

a component type action corresponding to an action performed on a component type of the cloud computing system, and

a component instance action corresponding to an action performed on an instance of a component of the cloud computing system.

3. The method of claim 2, wherein the at least one trained classifier includes at least one trained component type classifier and at least one trained component instance classifier,

a component type classifier being for computing a likelihood that a component type action solves an anomaly, and

a component instance classifier being for computing a likelihood that a component type action solves an anomaly.

4. The method of claim 1, wherein the automatic identification includes computing, using the at least one trained classifier, a likelihood of a result of performing the action for addressing the anomaly.

5. The method of claim 4, wherein:

identifying an action for addressing the anomaly includes selecting an action from a plurality of actions;

each action of the plurality of actions is associated with a cost value; and

the selected action corresponds to the action from the plurality of actions with the highest likelihood of solving the anomaly at a minimum cost.

6. The method of claim 1, wherein the at least one trained classifier is a classifier selected from the group consisting of K-nearest neighbor classifiers, support vector machine classifiers, and Bayesian network classifiers.

7. The method of claim 1, further comprising:

generating a feature vector from the set of quantified metrics; and

evaluating the at least one trained classifier using the feature vector for relating the metrics set to a result of performing an action for addressing the anomaly.

8. The method of claim 1, further including:

determining whether addressing an anomaly requires training a classifier; and

upon determining that the anomaly requires training a classifier, automatically training a classifier.

9. The method of claim 1, further including applying the identified action on the execution of the application in the cloud computing system.

10. The method of claim 1, further including recommending the identified action to a user.

11. A system for identifying an action for responding to an anomaly in the execution of an application in a cloud computing system, the system comprising an action identification engine, wherein:

the action identification engine is to automatically identify, using at least one trained classifier, an action for responding to an anomaly in the execution of the application in the cloud computing system,

the at least one trained classifier relates a metric to a result of performing the action for addressing an anomaly.

12. The system of claim 11, further comprising an anomaly determination engine to automatically determine whether the set of quantified metrics is associated with an anomaly,

the action identification engine being to identify an action for responding to an anomaly upon the determination engine determines that the set of quantified metrics is associated with the anomaly.

13. The system of claim 11, further comprising a communication engine to communicate the selected action to a client computer system.

14. The system of claim 11, wherein the action identification engine is to perform the automatic identification on the basis of:

at least one trained component type classifier and at least one trained component instance classifier;

a component type classifier being associated with at least one component type action; and

a component instance classifier being associated with at least one component instance action.

15. A computer readable medium comprising instructions that when executed implement a method for identifying an action for responding to an anomaly in the execution of an application, the method including:

automatically identifying an action from a plurality of actions that can be performed on a cloud computing system for execution of the application;

the action being for responding to an anomaly in the execution of the application in the cloud computing system, and

the automatic identification being performed using at least one quantified metric associated with the anomaly and on the basis of at least one trained classifier, the at least one trained classifier relating the at least one quantified metric to a result of performing an action for addressing an anomaly.