APPARATUS AND METHOD OF LEVERAGING SEMI-SUPERVISED MACHINE LEARNING PRINCIPALS TO PERFORM ROOT CAUSE ANALYSIS AND DERIVATION FOR REMEDIATION OF ISSUES IN A COMPUTER ENVIRONMENT

• US 20170017537A1
• Filed: 07/14/2016
• Published: 01/19/2017
• Est. Priority Date: 07/14/2015
• Status: Active Grant

• Current Assignee: SIOS Technology Corporation
• Original Assignee: SIOS Technology Corporation
• Inventors: Robinson, Spencer Hall, Marlett, Tracy L., TO, Yokuki, Razin, Sergey A.
• Granted Patent: US 10,055,275 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks

Abstract

Embodiments of the innovation relate to a host device having a memory and a processor, the host device configured to determine an anomaly associated with an attribute of a computer environment resource of the computer infrastructure. The host device is configured to correlate an object associated with the attribute of the detected anomaly with a related object of the computer infrastructure. The host device is configured to determine a root cause probability for each object of the correlated objects, the root cause probability identifying a probability of the correlated object functioning as a cause of the detected anomaly. The host device is configured to output an identification of a root object associated with the anomaly based upon the identified root cause probability.

Claims

1. In a host device, a method for performing an anomaly analysis of a computer environment, comprising:

determining, by the host device, an anomaly associated with an attribute of a computer environment resource of the computer infrastructure;

correlating, by the host device, an object associated with the attribute of the detected anomaly with a related object of the computer infrastructure;

determining, by the host device, a root cause probability for each object of the correlated objects, the root cause probability identifying a probability of the correlated object functioning as a cause of the detected anomaly; and

outputting, by the host device, an identification of a root object associated with the anomaly based upon the identified root cause probability.

2. The method of claim 1, wherein detecting the anomaly associated with the attribute of the computer infrastructure resource comprises:

applying, by host device, a classification function to a set of data elements related to the attribute of the computer infrastructure resources of the computer infrastructure to define at least one group of data elements of the set of data elements; and

identifying, by host device, a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one group of data elements.

3. The method of claim 2, wherein applying the classification function to the set of data elements to define the at least one group of data elements of the set of data elements comprises applying, by host device, a clustering function to the set of data elements to define at least one cluster of data elements of the set of data elements.

4. The method of claim 3, wherein identifying a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one group of data elements comprises identifying, by host device, a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one cluster of data elements of the set of data elements.

5. The method of claim 3, further comprising:

applying, by host device, a learned behavior function to the at least one cluster of data elements of the set of data elements, the learned behavior function defining at least one learned behavior boundary relative to the at least one cluster of data elements; and

wherein identifying a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one group of data elements comprises identifying, by host device, a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one learned behavior boundary.

6. The method of claim 5, further comprising:

applying, by host device, a sensitivity function to the at least one learned behavior boundary, the sensitivity function defining a sensitivity boundary relative to at least one learned behavior boundary; and

wherein identifying a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one group of data elements comprises identifying, by the host device, a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the sensitivity boundary.

7. The method of claim 1, wherein correlating the object associated with the attribute of the detected anomaly with the related object of the computer infrastructure comprises:

accessing, by the host device, a graph database; and

identifying, by the host device, the object associated with the attribute of the detected anomaly and the related object via graph database.

8. The method of claim 1, wherein identifying the root cause probability for each object of the correlated objects comprises:

detecting, by the host device, a prior probability of an anomaly caused by one of anomalous object and related objects;

detecting, by the host device, a conditional probability of anomaly caused by one of anomalous object and related objects; and

detecting, by the host device, a posterior probability of anomaly caused by one of anomalous object and related objects, the posterior probability based on the prior probability and the conditional probability.

9. The method of claim 1, wherein outputting the identification of the root object associated with the anomaly based upon the identified root cause probability comprises:

providing, by the host device, a user interface identifying at least one probable cause of a detected anomaly in the computer environment;

receiving, by the host device, ranking information associated with the detected anomaly; and

performing, by the host device, a second root cause analysis on the data set based upon the ranking information.

10. The method of claim 2, further comprising:

updating, by the host device, the set of data elements related to the attribute of the computer infrastructure resources to include updated data elements; and

applying, by host device, a characterization function to the set of data elements, including the updated data elements, to define at least one group of data elements of the set of data elements.

11. A host device, comprising:

a controller having a memory and a processor, the controller configured to;

determine an anomaly associated with an attribute of a computer environment resource of the computer infrastructure;

correlate an object associated with the attribute of the detected anomaly with a related object of the computer infrastructure;

determine a root cause probability for each object of the correlated objects, the root cause probability identifying a probability of the correlated object functioning as a cause of the detected anomaly; and

output an identification of a root object associated with the anomaly based upon the identified root cause probability.

12. The host device of claim 11, wherein, when detecting the anomaly associated with the attribute of the computer infrastructure resource, the controller is configured to:

apply a characterization function to a set of data elements related to the attribute of the computer infrastructure resources of the computer infrastructure to define at least one group of data elements of the set of data elements; and

identify a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one group of data elements.

13. The host device of claim 12, wherein when applying the characterization function to the set of data elements to define the at least one group of data elements of the set of data elements, the host device is configured to apply a clustering function to the set of data elements to define at least one cluster of data elements of the set of data elements.

14. The host device of claim 13, wherein when identifying a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one group of data elements, the controller is configured to identify a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one cluster of data elements of the set of data elements.

15. The host device of claim 13, wherein the controller is further configured to:

apply a learned behavior function to the at least one cluster of data elements of the set of data elements, the learned behavior function defining at least one learned behavior boundary relative to the at least one cluster of data elements; and

when identifying a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one group of data elements, the controller is configured to identify a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one learned behavior boundary.

16. The host device of claim 15, wherein the controller is further configured to:

apply a sensitivity function to the at least one learned behavior boundary, the sensitivity function defining a sensitivity boundary relative to at least one learned behavior boundary; and

when identifying a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the at least one group of data elements, the controller is configured to identify a data element of the set of data elements as an anomalous element associated with the attribute when the data element falls outside of the sensitivity boundary.

17. The host device of claim 11, wherein when correlating the object associated with the attribute of the detected anomaly with the related object of the computer infrastructure, the controller is configured to:

access a graph database; and

identify the object associated with the attribute of the detected anomaly and the related object via graph database.

18. The host device of claim 11, wherein when identifying the root cause probability for each object of the correlated objects, the host device is configured to:

detect a prior probability of an anomaly caused by one of anomalous object and related objects;

detect a conditional probability of anomaly caused by one of anomalous object and related objects; and

detect a posterior probability of anomaly caused by one of anomalous object and related objects, the posterior probability based on the prior probability and the conditional probability.

19. The host device of claim 11, wherein when outputting the identification of the root object associated with the anomaly based upon the identified root cause probability, the controller is configured to:

provide a user interface identifying at least one probable cause of a detected anomaly in the computer environment;

receive ranking information associated with the detected anomaly; and

perform a second root cause analysis on the data set based upon the ranking information.

20. The host device of claim 12, wherein the controller is further configured to:

update the set of data elements related to the attribute of the computer infrastructure resources to include updated data elements; and

apply a characterization function to the set of data elements, including the updated data elements, to define at least one group of updated data elements of the set of data elements.