Neural network-assisted computer network management

A computer program product, comprising:

• a non-transitory computer-readable storage device having computer-executable program instructions embodied thereon that when executed by a computer cause the computer to identify sequences of computer network log entries indicative of a cause of an event described in a computer network log entry of a first type, the computer-executable program instructions comprising:
• computer-executable program instructions to train a neural network to detect computer network log entries of a first type in sequences of computer network log entries, the neural network characterized by a plurality of ordered cells Fi, each cell with an output hi and a final sigmoid layer characterized by a weight vector wT;
• computer-executable program instructions to determine a value of a gating function Gi(hi, hi-1)=II(wT(hi−hi-1)+b) for each log entry xi, where II is an indicator function yielding “1” for a positive value of its argument, and “0” otherwise, b is a bias parameter, and wT is a weight vector of the final sigmoid layer of the neural network;
• and
• computer-executable program instructions to output a sub-sequence of the computer network log entries xi corresponding to Gi(hi, hi-1)=1 as a sequence of computer network log entries indicative of a cause of an event described in a computer network log entry of a first type.

A system to identify sequences of computer network log entries indicative of a cause of an event described in a computer network log entry of a first type, comprising:

• a storage device;
• and
• a processor communicatively coupled to the storage device, wherein the processor executes application code instructions that are stored in the storage device to cause the system to:
• train a long short-term memory (LSTM) recurrent neural network to detect computer network log entries of a first type in sequences of computer network log entries, the LSTM network characterized by a plurality of ordered cells Fi and a final sigmoid layer;
• the first cell F1 outputting a cell state vector c1 and an output vector h1 based on a network log entry x1 and a plurality of layered gating functions, the gating functions comprising a plurality of sigmoid layers and at least one hyperbolic tangent (tan h) layer, each gating function characterized by weights;
• each cell Fi after the first cell F1:
• receiving a subsequent sequential computer network log entry xi, a cell state vector of the previous cell ci-1, a output of previous cell hi-1, and
• outputting a cell state vector ci and a new output vector hi based on xi, ci-1, hi-1, and a plurality of layered gating functions comprising a plurality of layered gating functions, the gating functions comprising a plurality of sigmoid layers and at least one tan h layer, each gating function characterized by weights;
• and
• the final sigmoid layer receiving the hfinal output of Ffinal and characterized by a weight vector wT;
• receive a sequence of computer network log entries xi from one or more network devices of the computer network;
• determine hi for each log entry xi in accordance with the trained Fi(xi, ci-1, hi-1);
• determine a value of a gating function Gi(hi, hi-1)=II (wT (hi−hi-1)+b) for each log entry xi, where II is an indicator function yielding “1” for a positive value of its argument, and “0” otherwise, b is a bias parameter, and wT is a weight vector of the final sigmoid layer of the LSTM model;
• and
• output a sub-sequence of the computer network log entries xi, corresponding to Gi(hi, hi-1)=1 as a sequence of computer network log entries indicative of a cause of an event described in a computer network log entry of a first type.