Back to results
US 12,710,981 B2Granted
Swappable online artificial intelligence algorithms implemented in a data intake and query system
AssigneeCisco Technology, Inc.
InventorRam Sriharsha
Life of this patent
Estimating the term…
Abstract
Systems and methods are described for processing ingested data, detecting anomalies in the ingested data, and providing explanations of a possible cause of the detected anomalies as the data is being ingested. For example, a token or field in the ingested data may have an anomalous value. Tokens or fields from another portion of the ingested data can be extracted and analyzed to determine whether there is any correlation between the values of the extracted tokens or fields and the anomalous token or field having an anomalous value. If a correlation is detected, this information can be surfaced to a user.
Claims20
A method, comprising:
- obtaining first raw machine data from an event data stream generated by one or more components in an information technology environment;
- comparing, using a set of data, an accuracy of a first model and an accuracy of a second model by at least (i) comparing an output produced by the first model processing the set of data to an actual or expected output to generate a first data result being a first prediction of one or more values of the set of data, (ii) comparing an output produced by the second model processing the set of data to the actual or expected output to generate a second data result being a second prediction of the one or more values of the set of data, and (iii) comparing the first data result and the second data result to determine that the second model is more accurate with respect to the actual or expected output than the first model, wherein the first model is generated using a first artificial intelligence algorithm code, the first raw machine data, and a base model, and wherein the second model is generated using a second artificial intelligence algorithm code, the first raw machine data, and the base model;
- responsive to determining that the second model is more accurate than the first model, obtaining second raw machine data from the event data stream generated by the one or more components in the information technology environment;
- and
- processing the second raw machine data from the event data stream using the second model by swapping a portion of the first artificial intelligence algorithm code with a portion of the second artificial intelligence algorithm code,
- wherein the second artificial intelligence algorithm code includes at least a second transformation operation and a second reference to a storage location of a model state of the second model and the first artificial intelligence algorithm code includes at least a first transformation operation and a reference to a storage location of a model state of the first model in lieu of variables defining the model state of the first model to avoid loss of the model state of the first model during swapping of the first artificial intelligence algorithm code for the second artificial intelligence algorithm code and avoid re-training of the second model using previously ingested raw machine data by the first artificial intelligence algorithm code, and
- wherein the swapping of the portion of the first artificial intelligence algorithm code comprises swapping the first transformation operation with the second transformation operation in response to the determination that the second model is more accurate than the first model and the second artificial intelligence code utilizing the model state of the first model.
4 more elements
A system, comprising:
- one or more data stores including computer-executable instructions;
- and
- one or more processors configured to execute the computer-executable instructions, wherein execution of the computer-executable instructions causes the system to:
- obtain first raw machine data from an event data stream generated by one or more components in an information technology environment;
- compare, using a set of data, an accuracy of a first model and an accuracy of a second model by at least (i) comparing an output produced by the first model processing the set of data to an actual or expected output to generate a first data result being a first prediction of one or more values of the set of data, (ii) comparing an output produced by the second model processing the set of data to the actual or expected output to generate a second data result being a second prediction of the one or more values of the set of data, and (iii) comparing the first data result and the second data result to determine that the second model is more accurate with respect to the actual or expected output than the first model, wherein the first model is generated using a first artificial intelligence algorithm code, the first raw machine data, and a base model, and wherein the second model is generated using a second artificial intelligence algorithm code, the first raw machine data, and the base model;
- responsive to determination that the second model is more accurate than the first model, obtain second raw machine data from the event data stream generated by the one or more components in the information technology environment;
- and
- process the second raw machine data from the event data stream using the second model by swapping a portion of the first artificial intelligence algorithm code with a portion of the second artificial intelligence algorithm code,
- wherein the second artificial intelligence algorithm code includes at least a second transformation operation and a second reference to a storage location of a model state of the second model and the first artificial intelligence algorithm code includes at least a first transformation operation and a reference to a storage location of a model state of the first model in lieu of variables defining the model state of the first model to avoid loss of the model state of the first model during swapping of the first artificial intelligence algorithm code for the second artificial intelligence algorithm code and avoid re-training of the second model using previously ingested raw machine data by the first artificial intelligence algorithm code, and
- wherein the swapping of the portion of the first artificial intelligence algorithm code comprises swapping the first transformation operation with the second transformation operation in response to the determination that the second model is more accurate than the first model and the second artificial intelligence code utilizing the model state of the first model.
7 more elements
A non-transitory computer-readable media comprising instructions executable by one or more processors of a computing system to:
- obtain first raw machine data from an event data stream generated by one or more components in an information technology environment;
- compare, using a set of data, an accuracy of a first model and an accuracy of a second model by at least (i) comparing an output produced by the first model processing the set of data to an actual or expected output to generate a first data result being a first prediction of one or more values of the set of data, (ii) comparing an output produced by the second model processing the set of data to the actual or expected output to generate a second data result being a second prediction of the one or more values of the set of data, and (iii) comparing the first data result and the second data result to determine that the second model is more accurate with respect to the actual or expected output than the first model, wherein the first model is generated using a first artificial intelligence algorithm code, the first raw machine data, and a base model, and wherein the second model is generated using a second artificial intelligence algorithm code, the first raw machine data, and the base model;
- determine that the second model is more accurate than the first model;
- obtain second raw machine data from the event data stream generated by the one or more components in the information technology environment;
- and
- process the second raw machine data from the event data stream using the second model by swapping a portion of the first artificial intelligence algorithm code with a portion of the second artificial intelligence algorithm code,
- wherein the second artificial intelligence algorithm code includes at least a second transformation operation and a second reference to a storage location of a model state of the second model and the first artificial intelligence algorithm code includes at least a first transformation operation and a reference to a storage location of a model state of the first model in lieu of variables defining the model state of the first model to avoid loss of the model state of the first model during swapping of the first artificial intelligence algorithm code for the second artificial intelligence algorithm code and avoid re-training of the second model using previously ingested raw machine data by the first artificial intelligence algorithm code, and
- wherein the swapping of the portion of the first artificial intelligence algorithm code comprises swapping the first transformation operation with the second transformation operation in response to the determination that the second model is more accurate than the first model and the second artificial intelligence code utilizing the model state of the first model.
5 more elements
Dependencies are inferred from the claim text.