Enhancement of machine learning-based anomaly detection using knowledge graphs

#Anomaly detection is a data-mining technique for identifying unusual patterns in data that do not conform to expected behavior. In the computing domain, anomaly detection is commonly utilized to identify incidents impacting the operation of computing devices, network components, and software components (which might be referred to herein as “information technology (“IT”) infrastructure components” or simply “infrastructure components”). For example, anomaly detection might be utilized to identify unusual patterns in network traffic that indicate unauthorized access to infrastructure components.

#Anomaly detection techniques commonly utilize supervised or unsupervised machine learning (“ML”) and statistical methods. For example, supervised ML techniques for anomaly detection utilize training data that describes historical anomalies and corresponding values for audited metrics to identify anomalies. Other types of ML and non-ML techniques can be utilized to identify anomalies.

#A root-cause analysis (“RCA”) is commonly performed following the detection of an anomaly. RCA is a systematic process for identifying root causes of anomalies. RCA can be very complex, particularly in scenarios where there are hundreds or even thousands of co-dependent components and potential underlying causes for an anomaly. For instance, in the computing domain, an anomaly detected with respect to a network service might be caused by other network services, software components, server hardware, networking components, or other types of components. As a result, current anomaly detection and RCA identification systems commonly produce many false-positive alarms. The root causes of anomalies might therefore go undetected and the performance of infrastructure components associated with the anomalies might be negatively impacted.

#The Detailed Description is described with reference to the accompanying FIGS. In the FIGS., the left-most digit(s) of a reference number identifies the FIG. in which the reference number first appears. The same reference numbers in different FIGS. indicate similar or identical items.

#FIGS. 1A, 1B, and 2 are computing system architecture diagrams showing aspects of a system disclosed herein for enhancing ML-based anomaly detection systems using knowledge graphs, according to one embodiment disclosed herein;

#FIGS. 3A and 3B are flow diagrams showing aspects of an illustrative routine for enhancing ML-based anomaly detection systems using knowledge graphs, according to one embodiment disclosed herein;

#The following Detailed Description presents technologies for enhancing ML-based anomaly detection systems using knowledge graphs. As discussed briefly above, and in greater detail below, the disclosed technologies can enhance the functionality provided by ML-based anomaly detection systems in order to reduce or eliminate false-positive alarms. The disclosed technologies can also enable quicker and more accurate identification of the root causes of anomalies, which can result in improved performance of computing resources that have been impacted by such anomalies. Further, data accuracy can be improved because components with anomalies may be identified early, and appropriated remedial action taken to correct the anomalies. Technical benefits other than those specifically mentioned herein might also be realized through implementations of the disclosed technologies.

#It is to be appreciated that while the technologies disclosed herein are primarily described in the context of identifying the root causes of anomalies impacting IT infrastructure components, the technologies described herein can be utilized to identify the root causes of anomalies in other types of systems and data in other configurations, which will be apparent to those of skill in the art.

#Referring now to the appended drawings, in which like numerals represent like elements throughout the several FIGS., aspects of various technologies for enhancing ML-based anomaly detection systems using knowledge graphs will be described. In the following detailed description, references are made to the accompanying drawings that form a part hereof, and which are shown by way of illustration specific configurations or examples.