Event identification through machine learning

Patent metadata

Field	Value
Publication number	US-11816586-B2
Application number	US-201715811573-A
Country	US
Kind code	B2
Filing date	Nov 13, 2017
Priority date	Nov 13, 2017
Publication date	Nov 14, 2023
Grant date	Nov 14, 2023

Abstract

A method for event identification including receiving event information pertaining to events occurring with respect to a computing environment, each event having a measurement metric; evaluating by a probability function the measurement metric for each event to determine when the measurement metric is above a predetermined probability threshold or below a probability threshold wherein above a probability threshold or below a probability threshold is classified as alarm data; processing the alarm data through a decision tree to determine based on historical data when the alarm data is significant or when the alarm data is not significant and to reduce the number of alarm data to a predetermined number of significant alarm data; and displaying the predetermined number of significant alarm data to a user.

First claim

What is claimed is:

1. A method for event identification comprising:
receiving event information pertaining to events occurring with respect to a cloud computing environment over a network, each occurring event having a measurement metric, the measurement metric for each occurring event including a value attribute, a change attribute, a streak size attribute and a streak duration attribute wherein the value attribute is the original series of measurement data over one or more measurement periods, the change attribute is the change of value at a current measurement period relative to a previous measurement period, the streak size attribute is the size of continuous change in one direction as positive, negative or flat and the streak duration attribute is the number of measurement periods of continuous change in one direction as positive, negative or flat;
evaluating by a probability function the measurement metric for each occurring event to determine when any of the value attribute, the change attribute, the streak size attribute and the streak duration attribute is above a predetermined probability threshold or below the probability threshold, wherein the probability threshold is dynamically determined based on a historical distribution of measurement metric data, and wherein above the probability threshold or below the probability threshold is classified as alarm data;
training a decision tree by a training process using training data comprising:
obtaining the training data, wherein the training data includes a plurality of event information that triggers an alarm regardless of whether the alarm is above the predetermined probability threshold or below the probability threshold, the plurality of event information that triggers the alarm having an indication of whether the event information that triggered the alarm was a significant alarmed event;
creating a root node using the training data;
finding a splitting point of the value attribute, the change attribute, the streak size attribute and the streak duration attribute by determining a probability ratio of the significant alarmed event and an insignificant alarmed event for a subset of the value attribute, the change attribute, the streak size attribute and the streak duration attribute;
comparing the probability ratio of the value attribute, the change attribute, the streak size attribute and the streak duration attribute and choosing an attribute from the compared attributes as a split node that results in a maximum probability ratio between the significant alarmed event and the insignificant alarmed event;
splitting the root node using the chosen attribute as the split node and new node to the decision tree; and
repeating finding the splitting point, comparing the probability ratio, and splitting the splitting node until all nodes terminate splitting;

processing the alarm data through the decision tree after the training process has been performed to determine based on the training data when the alarm data is significant or when the alarm data is not significant and to reduce the number of alarm data to a predetermined number of significant alarm data, wherein the alarm data that is classified as significant requires attention;
displaying the predetermined number of significant alarm data to a user;
retraining the decision tree with a second set of training data based on feedback received from the user; and
adjusting the probability threshold based in part on the second set of training data.

2. The method of claim 1 wherein processing the alarm data through the decision tree to determine when the alarm data is significant or when the alarm data is not significant further to determine when the alarm data is not significant but the alarm data is unusual in that an odd pattern of data emerges.

3. A computer program product for event identification, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:
receiving event information pertaining to events occurring with respect to a cloud computing environment over a network, each occurring event having a measurement metric, the measurement metric for each occurring event including a value attribute, a change attribute, a streak size attribute and a streak duration attribute wherein the value attribute is the original series of measurement data over one or more measurement periods, the change attribute is the change of value at a current measurement period relative to a previous measurement period, the streak size attribute is the size of continuous change in one direction as positive, negative or flat and the streak duration attribute is the number of measurement periods of continuous change in one direction as positive, negative or flat;
evaluating by a probability function the measurement metric for each occurring event to determine when any of the value attribute, the change attribute, the streak size attribute and the streak duration attribute is above a predetermined probability threshold or below the probability threshold, wherein the probability threshold is dynamically determined based on a historical distribution of measurement metric data, and wherein above the probability threshold or below the probability threshold is classified as alarm data;
training a decision tree by a training process using training data comprising:
obtaining the training data, wherein the training data includes a plurality of event information that triggers an alarm regardless of whether the alarm is above the predetermined probability threshold or below the probability threshold, the plurality of event information that triggers the alarm having an indication of whether the event information that triggered the alarm was a significant alarmed event;
creating a root node using the training data;
finding a splitting point of the value attribute, the change attribute, the streak size attribute and the streak duration attribute by determining a probability ratio of the significant alarmed event and an insignificant alarmed event for a subset of the value attribute, the change attribute, the streak size attribute and the streak duration attribute;
comparing the probability ratio of the value attribute, the change attribute, the streak size attribute and the streak duration attribute and choosing an attribute from the compared attributes as a split node that results in a maximum probability ratio between the significant alarmed event and the insignificant alarmed event;
splitting the root node using the chosen attribute as the split node and new node to the decision tree; and
repeating finding the splitting point, comparing the probability ratio, and splitting the splitting node until all nodes terminate splitting;

processing the alarm data through the decision tree after the training process has been performed to determine based on the training data when the alarm data is significant or when the e alarm data is not significant and to reduce the number of alarm data to a predetermined number of significant alarm data, wherein the alarm data that is classified as significant requires attention;
displaying the predetermined number of significant alarm data to a user;
retraining the decision tree with a second set of training data based on feedback received from the user; and
adjusting the probability threshold based in part on the second set of training data.

4. The computer program product of claim 3 wherein processing the alarm data through the decision tree to determine when the alarm data is significant or when the alarm data is not significant includes a probability that the alarm data is significant or that the alarm data is not significant.

5.

Assignees

• IBM

Inventors

• Gao Xue Feng
• Shi Hui Qing
• Thorburn James C
• Yuan Yu Fen
• Zhang qing feng

Classifications

• G06N5/045 Primary

  Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N20/00 Primary

  Machine learning · CPC title

• G06Q10/0639

  Performance analysis of employees; Performance analysis of enterprise or organisation operations · CPC title

• G06Q10/06393

  Score-carding, benchmarking or key performance indicator [KPI] analysis · CPC title