Detection of anomalies in error signals of cloud based service

• US 9,378,079 B2
• Filed: 09/02/2014
• Issued: 06/28/2016
• Est. Priority Date: 09/02/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Ivanova, Olga, Ojha, Smita, de Baynast, Alexandre, Cozowicz, Markus, Pinsdorf, Ulrich, Wang, Yi, Kranen, Philipp, Narayanan, Venkat
• Primary Examiner(s): LE, DIEU MINH T
• Application Number:
  US14/475,550
• Publication Number:
  US 20160062815A1
• Time in Patent Office: 665 Days
• Field of Search: 714/26, 714/27, 714/28, 714/25, 714/4.1
• US Class Current: 1/1
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/88 Monitoring involving counting
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks

Abstract

Anomalies detection in error signals of a cloud based service is provided. An application such as an analysis application identifies a machine learning algorithm that matches error signals of components of a cloud based service. A periodic pattern from the error signals is removed with the machine learning algorithm to filter the periodic pattern from an error count in the error signals. The error signals are processed with the machine learning algorithm to detect one or more anomalies with the components. The machine learning algorithm is updated while processing new data to detect new patterns.

Claims

1. A method executed on a computing device to provide detection of anomalies in error signals of a cloud based service, the method comprising:

identifying a machine learning algorithm that matches error signals of components of a cloud based service;

removing a periodic pattern from the error signals with the machine learning algorithm to filter the periodic pattern from an error count in the error signals;

processing the error signals with the machine learning algorithm to detect one or more anomalies with the components; and

updating the machine learning algorithm while processing new data to detect new patterns.

2. The method of claim 1, further comprising:

computing an error count in the error signals, wherein the error count is a number of errors generated by the components of the cloud based service.

3. The method of claim 1, further comprising:

flattening the periodic pattern from the error signals that includes one or more from a set of a daily pattern and a weekly pattern.

4. The method of claim 1, further comprising:

flattening the periodic pattern from the error signals that includes a custom time period based pattern.

5. The method of claim 1, further comprising:

processing the filtered error count with a sequential likelihood computation to generate a sequential likelihood ratio (SLR) of the error signals.

6. The method of claim 1, further comprising:

processing a sequential likelihood ratio (SLR) with an SLR test to generate a score duration associated with the error signals, wherein the SLR is generated by processing the filtered error count with a sequential likelihood computation.

7. The method of claim 6, further comprising:

comparing the score duration to a threshold; and

in response to a detection that the score duration exceeds the threshold, detecting the one or more anomalies associated with the error signals.

8. The method of claim 1, further comprising:

processing a subset of the error signals that includes training data through one or more machine learning algorithm candidates.

9. The method of claim 8, further comprising:

using the training data that includes previously detected service issues.

10. The method of claim 8, further comprising:

comparing previously detected service issues in the training data to output of the machine learning algorithm candidates.

11. The method of claim 10, further comprising:

ordering the machine learning algorithm candidates based on a number of matches between the previously detected service issues and the output; and

selecting one of the machine learning algorithm candidates at a top of the ordered machine learning algorithm candidates that has a highest number of the matches between the previously detected service issues and the output, as the machine learning algorithm.

12. A computing device to provide detection of anomalies in error signals of a cloud based service, the computing device comprising:

a memory;

a processor coupled to the memory, the processor executing an analysis application in conjunction with instructions stored in the memory, wherein the analysis application is configured to;

identify a machine learning algorithm that matches error signals of components of a cloud based service by analyzing training data that includes historical data with previously detected service issues;

remove a periodic pattern from the error signals with the machine learning algorithm to filter the periodic pattern from an error count in the error signals, wherein the error count is computed as a number of errors generated by the components of the cloud based service;

process the error signals with the machine learning algorithm to detect one or more anomalies with the components; and

update the machine learning algorithm while processing new data to detect new patterns.

13. The computing device of claim 12, wherein the analysis application is further configured to:

combine the one or more anomalies to generate a composite score.

14. The computing device of claim 13, wherein the analysis application is further configured to:

apply an “

OR”

operation to each one or the one or more anomalies to detect probability values of the anomalies to cause a service issue of the components of the cloud based service; and

add the probability values to generate the composite score.

15. The computing device of claim 13, wherein the analysis application is further configured to:

compare the composite score against a service issue threshold; and

detect the service issue of the components of the cloud based service in response to the composite score exceeding the service issue threshold.

16. The computing device of claim 15, wherein the analysis application is further configured to:

allow a stakeholder to adjust the service issue threshold to configure a sensitivity of detecting the service issue, wherein the stakeholder includes an authorized user of the analysis application and an administrator of the cloud based service.

17. The computing device of claim 12, wherein the analysis application is further configured to:

process the new data that includes one or more new error signals through machine learning algorithm to detect new anomalies; and

adjust one or more attributes of the machine learning algorithm to improve a detection of the new anomalies.

18. A computer-readable memory device with instructions stored thereon to provide detection of anomalies in error signals of a cloud based service, the instructions comprising:

identifying a machine learning algorithm that matches error signals of components of a cloud based service by analyzing training data that includes historical data with previously detected service issues through machine learning algorithm candidates to select one of the machine learning algorithm candidates as the machine learning algorithm;

removing a periodic pattern from the error signals with the machine learning algorithm to filter the periodic pattern from an error count in the error signals, wherein the error count is computed as a number of errors generated by the components of the cloud based service;

processing the error signals with the machine learning algorithm to detect one or more anomalies with the components; and

updating the machine learning algorithm while processing new data to detect new patterns.

19. The computer-readable memory device of claim 18, wherein the instructions further comprise:

comparing the previously detected service issues with output of the machine learning algorithm candidates;

ordering the machine learning algorithm candidates based on a number of matches between the previously detected service issues and the output; and

selecting one of the machine learning algorithm candidates at a top of the ordered machine learning algorithm candidates that has a highest number of the matches between the previously detected service issues and the output, as the machine learning algorithm.

20. The computer-readable memory device of claim 18, wherein the instructions further comprise:

combining the one or more anomalies to generate a composite score;

comparing the composite score against a service issue threshold; and

detecting the service issue of the components of the cloud based service in response to the composite score exceeding the service issue threshold.