US 11,455,570 B2 · Machine learning-based infrastructure anomaly and incident detection using multi-dimensional machine metrics

Abstract

A machine learning (“ML”) pipeline that includes unsupervised learning, supervised learning, and Bayesian learning is utilized to train a ML classifier that can classify machine metrics as being indicative of an anomaly. A boosting process can be utilized during the unsupervised learning portion of the ML pipeline that scores clusters of training data for completeness, and further splits clusters of training data based upon the completeness scores in order to optimize the clustering of the training data. Supervised learning is then performed on the cluster-labeled training data. Bayesian learning can also be utilized to assign incident probability inferences to the clusters of training data. Once the ML classifier has been trained, the ML classifier can be utilized in a production environment to classify multi-dimensional machine metrics generated by computing devices in the production environment as being indicative of an anomaly.

Claims20

Dependent claims

A computer-implemented method for training a machine learning classifier, the method comprising:

performing unsupervised machine learning to identify a plurality of clusters in training data, the training data comprising multi-dimensional machine metrics generated by a plurality of computing devices;
determining, for each of the plurality of clusters and independent of user input specifying a label to be used in labeling the cluster, whether the cluster is complete or incomplete by comparing differences between pairs of the multi-dimensional machine metrics included in the cluster to a median difference of the pairs of the multi-dimensional machine metrics included in the cluster;
selecting a cluster of the plurality of clusters;
responsive to determining the cluster is incomplete, splitting the selected cluster into multiple clusters;
and
responsive to determining the selected cluster is complete, assigning a cluster label to the selected cluster based on the multi-dimensional machine metrics included in the selected cluster, independent of user input or previously labeled data.

3 more elements

A computer-implemented method for training a machine learning classifier, the method comprising:

performing unsupervised machine learning to generate cluster-labeled training data from training data independent of user input specifying a label to be used in assigning a cluster label to the cluster-labeled training data, the training data comprising multi-dimensional machine metrics generated by a plurality of computing devices, and the unsupervised machine learning comprising determining, for each of a plurality of clusters in the training data and independent of user input specifying a label to be used in labeling the cluster, whether the cluster is complete or incomplete by comparing differences between pairs of the multi-dimensional machine metrics included in the cluster to a median difference of the pairs of the multi-dimensional machine metrics included in the cluster;
training the machine learning classifier by performing supervised machine learning on the cluster-labeled training data;
assigning incident probability inferences to individual clusters included in the cluster-labeled training data by performing Bayesian learning on the cluster-labeled training data;
and
classifying instances of production metrics as indicating anomalies using the machine learning classifier and the incident probability inferences.

2 more elements

A computing system, comprising:

one or more processors;
and
a computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by the one or more processors, cause the one or more processors to:
generate cluster-labeled training data from training data, comprising multi-dimensional machine metrics generated by a plurality of computing devices by processing the training data using an unsupervised machine learning algorithm configured to:
identify a plurality of clusters of the training data;
classify, independent of user input or previously labeled training data specifying a label to be used in labeling the cluster, each of the plurality of clusters as complete or incomplete by comparing differences between pairs of the multi-dimensional machine metrics included in the cluster to a median difference of the pairs of the multi-dimensional machine metrics included in the cluster;
generate at least one merged cluster using a subset of the plurality of clusters classified as incomplete;
and
label each of the complete clusters and the at least one merged cluster independent of user input;
perform supervised machine learning on the cluster-labeled training data to train a machine learning classifier;
perform Bayesian learning on the cluster-labeled training data to assign incident probability inferences to the clusters;
and
classify instances of production metrics as indicating anomalies using the machine learning classifier and the incident probability inferences.

10 more elements

Dependencies are inferred from the claim text.

Machine learning-based infrastructure anomaly and incident detection using multi-dimensional machine metrics

Life of this patent

Machine learning-based infrastructure anomaly and incident detection using multi-dimensional machine metrics

Life of this patent

Abstract

Claims20