# US 2021/0342702 A1 · Method for automatically analyzing transaction logs of a distributed computing system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0342702 A1
- Document ID: US20210342702A1
- Status: Published application
- Kind: A1
- Application number: 17/244,848
- Filed: 2021-04-29
- Published: 2021-11-04
- Earliest claimed: 2020-04-30
- Assignees: Bull SAS
- Applicants: Bull SAS
- Inventors: Marc PLATINI; Benoît PELLETIER; Loïc PAULETTO
- Web page: https://patentgrep.com/patent/US20210342702A1

## CPC

- G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)}
- G06N 3/088: Non-supervised learning, e.g. competitive learning
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/2263: {using neural networks}
- G06F 11/3608: {using formal methods, e.g. model checking, abstract interpretation (theorem proving G06N5/013)}
- G06F 40/166: Editing, e.g. inserting or deleting
- G06F 40/279: Recognition of textual entities
- G06N 3/044: Recurrent networks, e.g. Hopfield networks
- G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

An aspect of the invention relates to a method for automatically analysing a transaction log of a distributed computing system, comprising a plurality of lines, the method comprising the following steps: For each line: Cutting the line into words; Constructing a comparison vector by comparing the line with the other lines of the same size as the line; Constructing a pattern from the comparison vector; Creating an event per pattern; Constructing at least one prediction model by training an artificial neural network on a group of training events, the prediction model being configured to predict the next event in the transaction log; For at least one event: Using the prediction model to predict the event, from a group of prediction events; Generating from the prediction model, a causal graph of the event comprising a causal relation for each event of the group of prediction events responding to a relevance condition.

## Claims

### Claim at position 1

1-10. (canceled)

### Claim 11

A method (100) for automatically analyzing a transaction log comprising at least one transaction log (200) of a distributed computing system, comprising a plurality of lines (201), the method comprising:
for each line (201) of the transaction log (200)
cutting the line (201) into words and associating the line with a size that is defined as a number of words (101);
constructing a comparison vector by comparing the line (201) with other lines (201) of the transaction log (200) associated with a same size as said line (201, 103);
constructing a pattern from at least one word of the line (201) from the comparison vector (104);
creating an event (401) per pattern (105);
constructing at least one prediction model by training in an unsupervised manner an artificial neural network (300) on a group (400_1) of training events (401) comprising at least one event (401), corresponding to a set (202_1) of training lines (201) comprising a plurality of lines (201) of the transaction log (200), the at least one prediction model being configured to predict a next event (401) that will take place in the transaction log (200, 107);
for at least one event (401)
using the at least one prediction model to predict the event (401) as the next event (401) that will take place in the transaction log (200), from a group (400_2) of prediction events comprising at least one event (401) having taken place before the event (401) in the transaction log (200, 108);
generating from the at least one prediction model, a causal graph (500) of the event (401) comprising a causal relation for each event (401) of the group (400_2) of prediction events (401) responding to a relevance condition (109).

### Claim 12 (depends on 11)

The method (100) according to claim 11, wherein each word of said at least one word is associated with a position on the line (201) and the method (100) further comprises a step (102) of replacing each word with a descriptor, the comparison vector comprising for each word, an occurrence corresponding to a number of times where the descriptor corresponding to the word appears at the position associated with the word, in another line (201) of the transaction log (200) associated with a same size as the line (201).

### Claim 13 (depends on 12)

The method (100) according to claim 12, wherein the step (103) of constructing the comparison vector is carried out using a hash table comprising a plurality of keys each comprised of a descriptor and a position and each being associated with the occurrence corresponding to the number of times when the descriptor appears at the position in another line (201) of the transaction log (200) associated with the same size as the line (201).

### Claim 14 (depends on 12)

The Method (100) according to claim 12, wherein the pattern comprises each descriptor of the line (201) associated with an occurrence appearing a maximum number of times in the comparison vector.

### Claim 15 (depends on 11)

The method (100) according to claim 11, wherein the artificial neural network (300) is an artificial neural network of a Long Short-Term Memory type.

### Claim 16 (depends on 11)

The method (100) according to claim 11, wherein each event (401) is associated with a number of lines (201) having for pattern the pattern corresponding to the event (401), said constructing the at least one prediction model being carried out for at least one sub-group (402) of events (401) of the group (400_1) of training events (401), each sub-group (402) of events (401) grouping together each event (401) of the group (400_1) of training events (401) having a same cardinality, the cardinality of an event (401) being defined as a power of 10 of the number of lines (201) associated with the event (401).

### Claim 17 (depends on 11)

The method (100) according to claim 11, wherein said constructing the at least one prediction model is preceded by a step (106) of constructing for each event (401), a numeric vector comprising a value of linguistic similarity for at least one other event (401).

### Claim 18 (depends on 11)

The method (100) according to claim 11, wherein the artificial neural network (300) comprises an attention layer (301) and said using the at least one prediction model comprises a sub-step (1081) of generating a weight vector by the attention layer (301), the weight vector comprising a weight for each event (401) of the group (400_2) of prediction events (401).

### Claim 19 (depends on 18)

The method (100) according to claim 18, wherein the relevance condition is verified for a given event (401) if the weight of the weight vector corresponding to the event (401) is greater than a threshold, the threshold being a sum of an average of the weights of the weight vector and of a standard deviation of the weights of the weight vector.

### Claim 20

A computer program product comprising instructions that when executed on a computer lead the computer to implement a method for automatically analyzing a transaction log comprising at least one transaction log (200) of a distributed computing system, comprising a plurality of lines (201), the method comprising:
for each line (201) of the transaction log (200)
cutting the line (201) into words and associating the line with a size that is defined as a number of words (101);
constructing a comparison vector by comparing the line (201) with other lines (201) of the transaction log (200) associated with a same size as said line (201, 103);
constructing a pattern from at least one word of the line (201) from the comparison vector (104);
creating an event (401) per pattern (105);
constructing at least one prediction model by training in an unsupervised manner an artificial neural network (300) on a group (400_1) of training events (401) comprising at least one event (401), corresponding to a set (202_1) of training lines (201) comprising a plurality of lines (201) of the transaction log (200), the at least one prediction model being configured to predict a next event (401) that will take place in the transaction log (200, 107);
for at least one event (401)
using the at least one prediction model to predict the event (401) as the next event (401) that will take place in the transaction log (200), from a group (400_2) of prediction events comprising at least one event (401) having taken place before the event (401) in the transaction log (200, 108);
generating from the at least one prediction model, a causal graph (500) of the event (401) comprising a causal relation for each event (401) of the group (400_2) of prediction events (401) responding to a relevance condition (109).