System and methods for risk assessment in a multi-tenant cloud environment

An early warning and risk assessment system for early warning and risk assessment of incidents in a multi-tenant cloud environment, the system comprising one or more processors configured by programming instructions on non-transitory computer readable media, the system configured by the programming instruction to:

• capture a plurality of data metrics relating to the multi-tenant cloud environment;
• automatically generate derived features from the plurality of data metrics, the derived features including one or more features that describe the temporal patterns of one or more data metrics and their compounding effect over time;
• automatically select relevant features from the derived features and the captured data metrics, the selected relevant features being sufficient to explain the temporal variations of an incident occurrence that is to be predicted;
• automatically train, test, and evaluate an incident risk assessment model using machine learning techniques with the selected relevant features, the incident risk assessment model being trained to predict the risk of an incident in the multi-tenant cloud environment within a specified time window in the future, provide an explanation of possible root causes of the incident, and assign a strength level to each possible root cause;
• capture a plurality of newly captured data metrics;
• automatically generate newly derived features from the plurality of newly captured data metrics, the newly derived features including one or more features that describe the temporal patterns of one or more newly captured data metrics and their compounding effect over time;
• automatically select newly selected risk assessment features from the newly derived features and the newly captured data metrics;
• and
• predict the risk of an incident in the multi-tenant cloud environment within a specified time window in the future and one or more possible root causes of the incident by applying the newly selected risk assessment features to the trained risk assessment model.

A processor-implemented method of early warning and risk assessment of incidents in a multi-tenant cloud environment, the method comprising:

• capturing, by a processor, a plurality of newly captured data metrics;
• automatically generating, by the processor, newly derived features from the plurality of newly captured data metrics, the newly derived features including one or more features that describe the temporal patterns of one or more newly captured data metrics and their compounding effect over time;
• automatically selecting, by the processor, newly selected risk assessment features from the newly derived features and the newly captured data metrics;
• and
• predicting, by the processor, the risk of an incident in the multi-tenant cloud environment within a specified time window in the future and one or more possible root causes of the incident by applying the newly selected risk assessment features to a trained risk assessment model, the trained risk assessment model having been trained using a method comprising:
• capturing a plurality of data metrics relating to the multi-tenant cloud environment;
• automatically generating derived features from the plurality of data metrics, the derived features including one or more features that describe the temporal patterns of one or more data metrics and their compounding effect over time;
• automatically selecting relevant features from the derived features and the captured data metrics, the selected relevant features being sufficient to explain the temporal variations of an incident occurrence that is to be predicted;
• automatically training, testing, and evaluating the incident risk assessment model using machine learning techniques with the selected relevant features, the incident risk assessment model being trained to predict the risk of an incident in the multi-tenant cloud environment within a specified time window in the future, provide an explanation of possible root causes of the incident, and assign a strength level to each possible root cause.