Utilizing machine learning models to process resource usage data and to determine anomalous usage of resources

Patent metadata

Field	Value
Publication number	US-2020311603-A1
Application number	US-201916551314-A
Country	US
Kind code	A1
Filing date	Aug 26, 2019
Priority date	Mar 29, 2019
Publication date	Oct 1, 2020
Grant date	—

Abstract

A device receives historical data associated with multiple cloud computing environments, trains one or more machine learning models, with the historical data, to generate trained machine learning models that generate outputs, and trains a model with the outputs to generate a trained model. The device receives particular data, associated with a cloud computing environment, that includes data identifying usage of resources associated with the cloud computing environment, and processes the particular data, with the trained machine learning models, to generate anomaly scores indicating anomalous usage of the resources associated with the cloud computing environment. The device processes the one or more anomaly scores, with the trained model, to generate a final anomaly score indicating anomalous usage of at least one of the resources associated with the cloud computing environment, and performs one or more actions based on the final anomaly score.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by a device, historical data associated with multiple cloud computing environments; training, by the device, one or more machine learning models, with the historical data, to generate one or more trained machine learning models,
wherein the training of the one or more machine learning models generates outputs;
training, by the device, a model with the outputs to generate a trained model; receiving, by the device, particular data associated with a cloud computing environment,
wherein the particular data at least includes data identifying usage of resources associated with the cloud computing environment;
processing, by the device, the particular data, with the one or more trained machine learning models, to generate one or more anomaly scores indicating anomalous usage of the resources associated with the cloud computing environment; processing, by the device, the one or more anomaly scores, with the trained model, to generate a final anomaly score indicating anomalous usage of at least one of the resources associated with the cloud computing environment; and performing, by the device, one or more actions based on the final anomaly score.

2 . The method of claim 1 , further comprising:
determining a multi-entity profile for the historical data associated with the multiple cloud computing environments,
wherein the multi-entity profile includes data groupings of the historical data based on a set of attributes included in the historical data; and
identifying trends and patterns in the historical data based on the data groupings of the multi-entity profile,
wherein training the one or more machine learning models, with the historical data, to generate the one or more trained machine learning models includes:
training the one or more machine learning models, with the historical data and data identifying the trends and the patterns, to generate the one or more trained machine learning models.

3 . The method of claim 2 , wherein the set of attributes include one or more of:
an attribute identifying types of resources of the cloud computing environments, an attribute identifying tasks for which the resources are organized, an attribute identifying users of the resources, or an attribute identifying costs associated with the resources.

4 . The method of claim 1 , wherein the historical data includes data identifying one or more of:
types of resources of the cloud computing environments that are used by organizations, quantities of the resources that are used by the organizations, times of day or days of a week when the resources are used by the organizations, costs associated with the resources that are used by organizations, or a migration plan for an organization with regard to resources.

5 . The method of claim 1 , wherein performing the one or more actions includes one or more of:
providing, for display, information indicating whether an anomaly has been detected based on the final anomaly score; providing, to one of the resources, instructions that cause the at least one of the resources to reboot, power off, or power on based on the final anomaly score; generating an alarm when the final anomaly score satisfies a threshold; or generating a recommendation to modify an allocation of the at least one of the resources based on the final anomaly score.

6 . The method of claim 1 , wherein performing the one or more actions includes one or more of:
identifying a cause of an anomaly based on the final anomaly score; causing a robot to be dispatched to service the at least one of the resources based on the final anomaly score; retraining the one or more machine learning models and/or the model based on the final anomaly score; or ordering a new resource to replace the at least one of the resources based on the final anomaly score.

7 . The method of claim 1 , wherein the one or more machine learning models include one or more of:
a kernel density estimation model, a regression splines model, a Gaussian process regression model, a discrete cosine transform signal processing model, a wavelet signal processing model, or a filter banks signal processing model.

8 . A device, comprising:
one or more memories; and one or more processors, communicatively coupled to the one or more memories, to:
receive particular data associated with a cloud computing environment,
wherein the particular data at least includes data identifying usage of resources associated with the cloud computing environment;

process the particular data, with one or more trained machine learning models, to generate one or more anomaly scores indicating anomalous usage of the resources associated with the cloud computing environment,
wherein one or more machine learning models are trained, with historical data associated with multiple cloud computing environments, to generate the one or more trained machine learning models, and
wherein the training of the one or more machine learning models generates outputs;

process the one or more anomaly scores, with a trained model, to generate a final anomaly score indicating anomalous usage of at least one of the resources associated with the cloud computing environment,
wherein a model is trained with the outputs to generate the trained model; and

perform one or more actions based on the final anomaly score.

9 . The device of claim 8 , wherein the model includes one or more of:
a model that determines an average anomaly score based on the one or more anomaly scores, a model that determines a mean anomaly score based on the one or more anomaly scores, a model that selects an anomaly score from the one or more anomaly scores, or a model that determines a weighted average anomaly score based on the one or more anomaly scores.

10 . The device of claim 8 , wherein, when processing the one or more anomaly scores, with the trained model, to generate the final anomaly score, the one or more processors are to:
apply different weights to the one or more anomaly scores to generate one or more weighted anomaly scores; and add the one or more weighted anomaly scores together to determine the final anomaly score.

11 . The device of claim 8 , wherein, when performing the one or more actions, the one or more processors are to:
determine a reallocation of the resources of the cloud computing environment based on the final anomaly score; and cause the reallocation of the resources to be implemented by the cloud computing environment.

12 . The device of claim 8 , wherein the resources of the cloud computing environment include one or more of:
processing resources utilized by an organization, memory resources utilized by the organization, or network resources utilized by the organization.

13 . The device of claim 8 , wherein, when performing the one or more actions, the one or more processors are to:
identify a type of the at least one of the resources; determine a quantity of usage time of the at least one of the resources; determine a quantity of tasks performed by the at least one of the resources; determine a reallocation for the at least one of the resources based on the type of the at least one of the resources, the quantity of usage time of the at least one of the resources, and the quantity of tasks performed by the at least one of the resources; and cause the reallocation to be implemented by the cloud computing environment.

14 . The device of claim 8 , wherein, when processing the one or more anomaly scores, with the trained model, to generate the final anomaly sc

Assignees

• Accenture Global Solutions Ltd

Inventors

• Qiu Kun
• Desai Vijay
• Kaplan Laser Seymour
• Kalyan Ganjapu Durga
• Lombardo Daniel Marcus

Classifications

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title

• G06F11/3452

  Performance evaluation by statistical analysis · CPC title

• G06F11/3442 Primary

  for planning or managing the needed capacity · CPC title

• G06F11/3433

  for load management (allocation of a server based on load conditions G06F9/505; load rebalancing G06F9/5083; redistributing the load in a network by a load balancer H04L67/1029) · CPC title

• G06N20/20

  Ensemble learning · CPC title