System and method for detecting platform anomalies through neural networks

• US 9,679,243 B2
• Filed: 03/13/2014
• Issued: 06/13/2017
• Est. Priority Date: 03/14/2013
• Status: Active Grant

• Current Assignee: Apcera, Inc. (Telefonaktiebolaget LM Ericsson)
• Original Assignee: Apcera, Inc. (Telefonaktiebolaget LM Ericsson)
• Inventors: Zou, Youzhi, Collison, Derek
• Primary Examiner(s): Gonzales, Vincent
• Application Number:
  US14/209,288
• Publication Number:
  US 20140279779A1
• Time in Patent Office: 1,188 Days
• CPC Class Codes: G06N 3/049 Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
• CPC Class Codes: G06N 3/08 Learning methods

Abstract

A system and method for detecting behavior of a computing platform that includes obtaining platform data; for each data motif identifiers in a set data motif identifiers, performing data motif detection on data in an associated timescale, wherein a first data motif identifier operates on data in a first timescale, wherein a second data motif identifier operates on data in a second timescale, wherein the first timescale and second timescale are different; in a neural network model, synthesizing platform data anomaly detection with at least a set of features inputs from data motif detection of the set of motif identifiers; and signaling if a platform data anomaly is detected through the neural network model.

Claims

1. A system for monitoring usage of a computing platform, the system comprising memory and associated processing circuitry configured as:

a data ingester that collects time-based data of a computing platform, wherein the time-based data comprises operational data collected for the computing platform and includes data of a plurality of data types, and wherein different types of the data among the plurality of data types may have a common timescale or have different timescales;

a set of motif identifier modules, wherein each motif identifier is configured to apply a machine learning process within one timescale of the data and output a motif signal, the set of motif identifier modules comprising a raw motif identifier module that operates on data in a base timescale, at least one motif identifier module that operates on data from a substantially weekly timescale, at least one motif identifier that operates on data from a substantially yearly timescale;

a set of data samplers, wherein a data sampler of one timescale couples a sampled data output to at least one motif identifier of the same timescale; and

a neural network model that includes feature inputs of at least one layer coupled to the motif signal outputs, a combined motif layer, and including at least one output signal of the operational status of the computing platform the operational status selectively indicating normal operation or anomalous operation of the computing platform.

2. A method for detecting behavior of a computing platform comprising:

collecting the time-based data for the computing platform, wherein the time-based data comprises operational data collected for the computing platform and includes data of a plurality of data types, and wherein different types of the data among the plurality of data types may have a common timescale or have different timescales;

for each data motif identifier in a set of data motif identifiers, performing data motif detection in an associated timescale, wherein a first data motif identifier operates on the operational data in a first timescale, wherein a second data motif identifier operates on the operational data in a second timescale, wherein the first timescale and second timescale are different;

in a neural network model, synthesizing platform data anomaly detection with at least a set of features inputs from data motif detection of the set of motif identifiers; and

outputting, in dependence on the platform anomaly detection, signaling indicating normal or anomalous operation of the computing platform.

3. The method of claim 2, further comprising for at least a subset of data motif identifiers, sampling the collected data according to the timescale of an associated data motif identifier, wherein the associated data motif identifier operates on the sampled collected data.

4. The method of claim 3, wherein the first timescale is substantially an hour-based timescale, wherein the second timescale is substantially a day-based timescale, wherein a third data motif identifier operates on data in a substantially week-based timescale, wherein a fourth motif identifier operates on data in substantially a month-based timescale and wherein a fifth motif identifier operates on data in substantially a year-based timescale.

5. The method of claim 2, wherein a third data motif identifier operates on data in a first timescale, wherein a data set of the collected data operated on by the third data motif identifier is different from a data set of the collected data operated on by the first data motif identifier.

6. The method of claim 2, wherein synthesizing platform data anomaly detection further comprises combining output from multiple data motif identifiers in features of a higher layer of the neural network model.

7. The method of claim 2, further comprising training the neural network model.

8. The method of claim 7, further comprising collecting, as new operational data collected for the computing platform, new time-based data for the computing platform, within a new timescale associated with a new data motif identifier, and performing data motif detection on the new operational data when the new data motif identifier is trained.

9. The method of claim 2, wherein collecting the time-based data for the computing platform comprises collecting event records and resource usage from within the computing platform.

10. The method of claim 9, wherein collecting event records and resource usage is scoped to events and usage scoped to an account of the computing platform.

11. The method of claim 2, further comprising, in the neural network model, synthesizing platform data motif prediction with at least a set of features inputs from the data motif detection by the set of motif identifiers, and outputting signaling indicating a data motif prediction.