Automated abnormality detection in service networks

Patent metadata

Field	Value
Publication number	US-9906543-B2
Application number	US-201514923645-A
Country	US
Kind code	B2
Filing date	Oct 27, 2015
Priority date	Oct 27, 2015
Publication date	Feb 27, 2018
Grant date	Feb 27, 2018

Abstract

From a log of a machine, an entry is selected relating to providing a subservice in processing a service request from a requestor associated with a key. The log entry includes a subsequence of machines used and a cost of providing the subservice. A set of entries is selected from the log, an entry including the subsequence and a second cost of providing the subservice but in processing a different service request from a different requestor associated with a different key. A distance is computed between the cost and the second cost. A number of occurrences of the subsequence with the key is determined. Using the number and the distance for the subsequence, a value pair is computed. Responsive to an aggregate number in the value pair not exceeding a threshold count. The processing of the service request is output as a suspect for using an improper sequence of machines.

First claim

What is claimed is:

1. A method comprising:
selecting, from a log of a machine, an entry relating to providing a subservice in processing a service request from a requestor associated with a key, the log entry comprising a subsequence of machines used and a cost of providing the subservice in the processing of the service request;
selecting from the log, a set of entries, wherein an entry in the set of entries comprises the subsequence and a second cost of providing the subservice but in processing a different service request from a different requestor associated with a different key;
computing, using a processor and a memory, a distance between the cost and the second cost;
determining from the log a number of occurrences of the subsequence with the key;
computing using the number and the distance for the subsequence, a value pair;
evaluating whether an aggregate number in the value pair exceeds a threshold count, the aggregate number using the number;
outputting as a suspect, responsive to the evaluating being negative, the processing of the service request for the key, for using an improper sequence of machines during the provisioning of the service and causing an error;
further evaluating whether an aggregate distance in the value pair exceeds a threshold distance, the aggregate distance using the distance;
outputting as the suspect, responsive to the further evaluating being negative, the processing of the service request for the key, for costing an improper computing cost during the provisioning of the service and causing an error; and
wherein the further evaluating is responsive to the evaluating being affirmative.

2. The method of claim 1 , further comprising:
determining that the evaluating and the further evaluating are both negative; and
outputting as the suspect, responsive to the evaluating and the further evaluating each being negative, the processing of the service request for the key, for forming an improper entry in the log during the provisioning of the service and causing an error.

3. The method of claim 1 , further comprising:
computing using another number and another distance, another value pair for another subsequence used in the processing of the service request for the key;
combining the number and the other number to form the aggregate number; and
combining the distance and the other distance to form the aggregate distance.

4. The method of claim 1 , further comprising:
applying, as a part of computing the value pair for the subsequence, a logarithm function to the number and the distance.

5. The method of claim 1 , further comprising:
applying a weight to the distance.

6. The method of claim 5 , wherein the weight is a function of the distance.

7. The method of claim 1 , further comprising:
further computing a set of distances between the cost and each cost associated with each entry in the set of entries, wherein the distance is an absolute value of a subtraction function using two costs, the set of distances including the distance.

8. The method of claim 7 , further comprising:
computing the aggregate distance using the set of distances.

9. The method of claim 1 , further comprising:
determining that providing the service uses a set of subservices, the set of subservices including the subservice, each subservice in the set being provided at a different machine in a set of machines, the set of machines including the machine, and each machine in the set of machines producing a corresponding log.

10. The method of claim 1 , wherein the log of the machine provides information about only a portion of the processing, the portion comprising a source machine identifier, an identifier of the machine, a target machine identifier, and the cost, wherein the source machine identifier, the identifier of the machine, and the target machine identifier together form the subsequence, the subsequence being a part of a sequence of using machines from a set of machines in processing the service request.

11. The method of claim 1 , wherein the processor and the memory are in the machine.

12. The method of claim 1 , wherein the processor and the memory are in a different machine.

13. A computer program product comprising one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices, the stored program instructions comprising:
program instructions to select, from a log of a machine, an entry relating to providing a subservice in processing a service request from a requestor associated with a key, the log entry comprising a subsequence of machines used and a cost of providing the subservice in the processing of the service request;
program instructions to select from the log, a set of entries, wherein an entry in the set of entries comprises the subsequence and a second cost of providing the subservice but in processing a different service request from a different requestor associated with a different key;
program instructions to compute, using a processor and a memory, a distance between the cost and the second cost;
program instructions to determine from the log a number of occurrences of the subsequence with the key;
program instructions to compute using the number and the distance for the subsequence, a value pair;
program instructions to evaluate whether an aggregate number in the value pair exceeds a threshold count, the aggregate number using the number;
program instructions to output as a suspect, responsive to the evaluating being negative, the processing of the service request for the key, for using an improper sequence of machines during the provisioning of the service and causing an error;
program instructions to further evaluate whether an aggregate distance in the value pair exceeds a threshold distance, the aggregate distance using the distance;
program instructions to output as the suspect, responsive to the further evaluating being negative, the processing of the service request for the key, for costing an improper computing cost during the provisioning of the service and causing an error; and
wherein the further evaluating is responsive to the evaluating being affirmative.

14. The computer program product of claim 13 , wherein the stored program instructions are stored in a computer readable storage device in a data processing system, and wherein the stored program instructions are transferred over a network from a remote data processing system.

15. The computer program product of claim 13 , wherein the stored program instructions are stored in a computer readable storage device in a server data processing system, and wherein the stored program instructions are downloaded over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system.

16. A computer system comprising one or more processors, one or more computer-readable memories, and one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:
program instructions to select, from a log of a machine, an entry relating to providing a subservice in processing a service request from a requestor associated with a key, the log entry comprising a subsequence of machines used and a cost of providing the subservice in the processing of the service request;
program instructions to select from the log, a set of entries, wherein an en

Assignees

• IBM

Inventors

• Arora Parul
• Debusk Jonathan A
• Ezry Raphael
• Goyal Munish
• Gupta Chirdeep
• Klein Uri

Classifications

• H04L67/16

  Electricity · mapped topic

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/091

  Measuring contribution of individual network components to actual service level · CPC title

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title