Behavioral rules discovery for intelligent computing environment administration

• US 9,195,943 B2
• Filed: 03/12/2013
• Issued: 11/24/2015
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: BladeLogic Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Dang, Derek, Mitbander, Bharat
• Primary Examiner(s): CHEN, ALAN S
• Application Number:
  US13/795,071
• Publication Number:
  US 20140279797A1
• Time in Patent Office: 987 Days
• US Class Current: 1/1
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 5/046 Forward inferencing; Production systems

Abstract

A management system for determining causal relationships among system entities may include a causal relationship detector configured to receive events from a computing environment having a plurality of entities, and detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events, and a rules converter configured to convert one or more of the causal relationships into at least one behavioral rule. The at least one behavioral rule may indicate a causal relationship between at least two entities of the plurality of entities.

Claims

1. A management system for determining causal relationships among system entities, the management system comprising:

at least one processor;

a non-transitory computer-readable storage medium including instructions executable by the at least one processor, the instructions configured to implement,

a causal relationship detector configured to receive events from a computing environment having a plurality of entities, and configured to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events, the causal relationship detector being configured to create vertices and arcs connecting temporally adjacent vertices, and annotate each arc with a coefficient value representing a level of connectivity between the temporally adjacent vertices based on the events; and

a rules converter configured to convert one or more of the causal relationships into at least one behavioral rule, the rules converter configured to map the temporally adjacent vertices to corresponding entities of the plurality of entities that generated the temporally adjacent vertices when the coefficient value is above a threshold value, the at least one behavioral rule indicating a causal relationship between the corresponding entities.

2. The management system of claim 1, wherein the causal relationship detector includes:

a graph generator configured to generate one or more graphs based on the events, each graph including the vertices and the arcs connecting the temporally adjacent vertices, each vertex representing an event instance of one or more events, and each arc representing a level of causal connectivity between at least two vertices,

wherein the causal relationship detector is configured to detect the causal relationships based on the one or more graphs, wherein at least two connected vertices represents the causal relationship between a set of entities.

3. The management system of claim 2, wherein the event instance includes a creation of the one or more events, a closure of the one or more events, or an absence of the one or more events where a pattern of appearance has been established.

4. The management system of claim 1, wherein the causal relationship detector includes a graph generator configured to generate a graph based on the events, the graph generator including:

a vertex classifier configured to create the vertices based on an initial set of events including a first vertex, a second vertex, and a third vertex, the vertex classifier further configured to arrange the first vertex, the second vertex, and the third vertex in chronological order; and

an arc classifier configured to create the arcs between the temporally adjacent vertices including a first arc connected between the first vertex and the second vertex and a second arc connected between the second vertex and the third vertex,

wherein the arc classifier is configured to annotate the first arc with a first coefficient value representing a level of connectivity between the first vertex and the second vertex and annotate the second arc with a second coefficient value representing a level of connectivity between the second vertex and the third vertex.

5. The management system of claim 4, wherein the arc classifier is configured to receive a relationship model providing at least one known relationship between the plurality of entities, and the arc classifier is configured to strengthen at least one arc of the graph based on the at least one known relationship.

6. The management system of claim 4, wherein the graph generator is configured to update the graph based on a secondary set of events, wherein the arc classifier is configured to strengthen or weaken the arcs of the graph based on, in part, a presence or absence of a repeat pattern of vertices associated with the secondary set of events.

7. The management system of claim 6, wherein each vertex is represented by a string representation, and the arc classifier is configured to analyze the repeat pattern of vertices by searching the graph for a match with a search pattern that includes a concatenation of string representations corresponding to at least two temporally adjacent vertices associated with the secondary set of sets.

8. The management system of claim 6, wherein each arc is associated with a time limit and the time limit is dependent upon the coefficient value, wherein the causal relationship detector further includes:

a pruner unit configured to remove at least one arc from the graph when the time limit associated with the at least one arc has been exhausted,

wherein the pruner unit is configured to remove at least one vertex when the at least one vertex is not connected to any other vertex.

9. A non-transitory computer-readable medium storing instructions that when executed cause at least one processor to determine causal relationships among system entities, the instructions comprising instructions to:

receive events from a computing environment having a plurality of entities;

generate a graph including,

create vertices based on an initial set of events including a first vertex, a second vertex, and a third vertex, and arrange the first vertex, the second vertex, and the third vertex in chronological order;

create arcs between temporally adjacent vertices including a first arc connected between the first vertex and the second vertex and a second arc connected between the second vertex and the third vertex; and

annotate each arc with a coefficient value representing a level of connectivity between the temporally adjacent vertices;

detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the graph; and

convert one or more of the causal relationships into at least one behavioral rule, the at least one behavioral rule indicating a causal relationship between at least two entities of the plurality of entities.

10. The non-transitory computer-readable medium of claim 9, wherein

each vertex represents an event instance of one or more events, and each arc represents a level of causal connectivity between at least two vertices.

11. The non-transitory computer-readable medium of claim 10, wherein the event instance includes a creation of the one or more events, a closure of the one or more events, or an absence of the one or more events where a pattern of appearance has been established.

12. The non-transitory computer-readable medium of claim 9, wherein the instructions further include instructions to:

receive a relationship model providing at least one known relationship between the plurality of entities; and

strengthen at least one arc of the graph based on the at least one known relationship.

13. The non-transitory computer-readable medium of claim 9, wherein the instruction further include instructions to:

update the graph based on a secondary set of events including strengthening or weakening the arcs of the graph based on, in part, a presence or absence of a repeat pattern of vertices associated with the secondary set of events.

14. The non-transitory computer-readable medium of claim 13, wherein each vertex is represented by a string representation, and the instructions to update the graph include:

analyze the repeat pattern of vertices by searching the graph for a match with a search pattern that includes a concatenation of string representations corresponding to at least two temporally adjacent vertices associated with the secondary set of sets.

15. The non-transitory computer-readable medium of claim 13, wherein each arc is associated with a time limit and the time limit is dependent upon the coefficient value, wherein the instructions to update the graph include:

remove at least one arc from the graph when the time limit associated with the at least one arc has been exhausted; and

remove at least one vertex when the at least one vertex is not connected to any other vertex.

16. A method for determining causal relationships among system entities, the method comprising:

receiving, by at least one processor, events from a computing environment having a plurality of entities;

detecting, by the at least one processor, causal relationships among the plurality of entities, during runtime of the computing environment including creating vertices and arcs connecting temporally adjacent vertices, and annotating each arc with a coefficient value representing a level of connectivity between the temporally adjacent vertices based on the events; and

converting, by the at least one processor, one or more of the causal relationships into at least one behavioral rule including mapping the temporally adjacent vertices to corresponding entities of the plurality of entities that generated the temporally adjacent vertices when the coefficient value is above a threshold value, the at least one behavioral rule indicating a causal relationship between the corresponding entities.

17. The method of claim 16, wherein the detecting, by the at least one processor, causal relationships among the plurality of entities, during runtime of the computing environment, based on the events includes:

generating one or more graphs based on the events, each graph including the vertices and the arcs connecting the temporally adjacent vertices, each vertex representing an event instance of one or more events, and each arc representing the level of causal connectivity between at least two vertices; and

detecting the causal relationships based on the one or more graphs.

18. The method of claim 17, wherein the event instance includes a creation of the one or more events, a closure of the one or more events, or an absence of the one or more events where a pattern of appearance has been established.