text:
2018 Unnamed Press
Home2018 Unnamed Press
The Unnamed Press publishes literature from around the world. Whether it's fiction, memoir or something in between, we are always interested in unlikely protagonists, undiscovered territories and courageous voices.
Featured Titles:
Elizabeth Tan
5 x 7.9″
In Rubik, darkly comedic interconnected stories follow Elena Rubik, her best friend Jules Valentine, and wannabe investigative reporter April Kuan, as a viral marketing scheme's motivations become cause for concern. There are the adventures of a model turned visual artist, a voice actor primarily used for tech support, enigmatic schoolchildren, clever anime characters, and more. Deftly blending the real and imagined with biting social satire, Elizabeth Tan explores the lives of her diverse group of characters with deep empathy and insight into our contemporary world.
Elizabeth Tan recently completed her PhD in Creative Writing at Curtin University in Perth. Her work has previously appeared in Westerly, The Lifted Brow, Voiceworks and The Sleepers Almanac. Her webcomic, Mais Pourquoi, can be found at et-maispourquoi.blogspot.com. Rubik is her first book. She lives in Australia.
Hunting Party
Agnès Desarthe
Translated from the French by Christiana Hills
Pub Date: July 17, 2018
5 x 7.9 "
Cajoled into going by his wife, who is anxious to ingratiate herself with the locals of their new village, Tristan's companions are Pastis-swilling tough guys with designs beyond catching dinner.
Gentle, reflective Tristan has no intention of killing anything, so when his shot inadvertently grazes a rabbit, he saves the animal and hides it in his bag before the others notice. Tristan soon finds himself deeply connected to the wounded rabbit, whose voice comes alive to share its wisdom with the young man.
Suddenly, the weather turns and a terrible storm descends upon the party, as well as their village. In the valley below, the rushing water exposes the close-knit community's secrets and indiscretions, while Tristan and the rabbit must confront something far worse.
Agnes Desarthe was born in Paris in 1966 and has written many books for children and teenagers, as well as adult fiction. She won the Prix du Livre Inter in 1996 for Un Secret Sans Importance and has had three previous novels translated into English: Five Photos of My Wife, which was short-listed for the Independent Foreign Fiction Prize and the Jewish Quarterly Fiction Prize, Good Intentions, Chez Moi, and The Foundling.
Christiana Hills translates written works from French into English, specializing in contemporary literary fiction, with a particular interest in experimental works and the Oulipo. She is most recently the translator of Michele Audin's One Hundred Twenty One Days and Agnes Desarthe's Hunting Party.
Translated and International Backlist:
Djinn City
Saad Z. Hossain
6 x 9″
Saad Z. Hossain returns with his signature blend of satire, dark comedy, and fantasy, using reinvented Islamic mythology to create a mirror world to our own – on the brink of disaster.
Merle Kroeger
Translated from the German by Rachel Hildebrandt and Alexandra Roesch
Formats available: Paperback
Pub date: November 21, 2017
A raft with eleven Algerian refugees, running low on fuel. A cruise ship with a small town's worth of international passengers. An Irish freighter. A Spanish rescue vessel. One single point of convergence in a vast wash of blue.
For the Love of the Dollar
J.M. Servin
Translated from the Spanish by Anthony Seidman
For Love of the Dollar is a young writer's tale of ambitions undermined by economic forces, racial divides, and artistic hubris.
Henrietta Rose-Innes
5.5 x 8.4″
"Henrietta Rose-Innes writes an admirably taut clean prose… a welcome addition to the new South African literature." – J.M. Coetzee, author of Disgrace
Age of Blight
Kristine Ong Muslim
Pub date: January 12, 2016
In this collection of speculative, horror-tinged stories, human cruelty, in all of its abundant diversity, compels humanity toward the final stages of the Anthropocene: the Age of Blight.
Janice Pariat
A sweeping tale of love, nostalgia, and memory, moving through 1990s New Delhi and present-day London, Seahorse tracks one man's undying love for his former professor across time and place.
Eyes Full of Empty
Jérémie Guez
Translated from the French by Edward Gauvin
Pub date: November 5, 2015
A private eye scours the streets of Paris to find the missing heir to a conservative media empire.
Remember the Scorpion
Isaac Goldemberg
Translated from the Spanish by Jonathan Tittler
Beyond a simple pulp, Remember the Scorpion tracks the wreckage of the Second World War and reconstructs it in the conflicted psyche of a South American detective.
Escape from Baghdad
Welcome to Baghdad in the immediate aftermath of the US invasions. In a city constantly under siege, the only way to survive may be, quite simple, the secret to eternal life.
Walker on Water
Kristiina Ehin
Translated from the Estonian by Ilmar Lehtpere
Pub date: June 1, 2014
5.2 x 8″
"Sharp, jarring, and darkly funny, the stories in Walker on Water move seamlessly and defiantly between the real and the surreal, reinventing folklore, redefining fiction, and daringly reexamining relationships." – Susan Steinberg, author of Spectacle


text:
class Article < ActiveRecord::Base
  acts_as_routable \
    scope: -> { where(published: true) },
    name: :custom_name

  def custom_name
    self.title.try(:parameterize) || self.id
  end
end

redpajama_set_name: RedPajamaGithub


It's time for a spooky party! This invitation features a full Moon and flying bats on a starry night sky. This invitation would be good for slumber parties watching scary movies with friends and Halloween.


text:
Home > Vol 6, No 12 (2019) >	Makwana
Knowledge, attitude and behaviour towards seasonal influenza: a community based study in rural Vadodara
Bharati L. Makwana, Parth R. Modi, Kalpita S. Shringarpure
Background: Seasonal influenza, though contagious, is preventable, provided the community and its people are aware of its mode of transmission and basic steps of prevention.
Methods: This was a cross-sectional descriptive study conducted in the rural field practice area of a Medical College Baroda in the month of February 2019, when the seasonal influenza cases were at its peak. A house to house survey was carried out to enquire about the knowledge, attitude, behavior related to seasonal influenza and its source of information. The structured questionnaire was based on the information, education and communication material displayed by the Health Department for the General Public. Respondents between the age of 15-60 years were interviewed after informed consent. Data-entry and analysis was done in Epi-Data software.
Results: Out of 633 respondents, two-thirds of the respondents (427, 67.5%) were aware about seasonal influenza (swine flu). They were aware about common symptoms of flu such as cough, running nose and fever (43.8%, 43% and 41.4% respectively). Majority of those who knew about the flu were aware of it being preventable (59%); 37% knew it could be prevented by using a handkerchief, while 30% were aware about avoiding crowded places. Source of information was television (33%), followed by health care provider (14%) and newspaper (12%).
Conclusions: Two-thirds of the respondents in the rural area were aware about seasonal influenza as a disease; majority of them knew that it could be prevented. The source of information was mainly media and health care providers. Attempts to improve the dissemination of information and behavior change communication is the way forward.
Seasonal influenza, H1N1, Behavior change communication, Knowledge attitude practice
Muruganathan A, Guha S, Munjal YP, Agarwal SS, Parikh KK, Jha V, et al. Recommendations for Vaccination Against Seasonal Influenza in Adult High Risk Groups: South Asian Recommendations. J Assoc Physicians India. 2016;64:3-11.
Park K. Park's Textbook of Preventive and Social Medicine. -Banarsidas Bhanot, 2015.
Mukherjee S, Sen S, Nakate P, Moitra S. Management of swine flu (H1N1 Flu) outbreak and its treatment guidelines. Community Acquir Infect. 2015;2:71.
Carlsen B, Glenton C. The swine flu vaccine, public attitudes, and researcher interpretations: A systematic review of qualitative research. BMC Health Serv Res. 2016;16.
Sachdeva S, Taneja N, Dwivedi N. Knowledge, attitude and practices studies conducted amongst medical students of India. Int J Community Med Public Heal. 2018;5:3913.
Koul PA, Bali NK, Sonawane S. Knowledge, attitude, and behavioural response of corporate employees in India towards influenza: A questionnaire based study. J Assoc Physicians India. 2016;64:44-50.
Damor R, Bhabhor H, Kosambiya JK, Gohil A, Rani G, Parmar P. Knowledge, Attitude and Practices Regarding Swine Flu among OPD Attendees of Tertiary Care Hospital, Surat. IOSR J Dent Med Sci Ver III. 2015;14:2279-861.
Baria HG, Solanky P, Shah H, Patel R. A study on swine flu (H1N1) awareness among college students of Valsad city. Int J Community Med Public Heal. 2017;4:3668.
Kumar Y, Kumar S. Mass Media for Health Education (A Study in the State of Rajasthan) Mass Media for Health Education (A Study in the State of Rajasthan). Multidiscip Int J. 2017;1:26-39.

redpajama_set_name: RedPajamaCommonCrawl


text:
Focus of Feb. 20th Georgia Innovation Summit is emerging technology
How will emerging technologies affect small businesses and what that sector will be like in the future?
That core question is the theme of the 2018 Georgia Innovation Summit, scheduled for Feb. 20 at the Georgia Tech Research Institute Conference Center in Atlanta. (Register at this link: http://workforce.georgia.org/event/3rd-annual-innovation-summit/)
Now in its third year, the Georgia Innovation Summit is an annual gathering of the state's top business, education, and government leaders who meet in a series of panel discussions to discuss emerging trends and innovations that will affect businesses of all sizes across Georgia.
The Georgia Mentor Protégé Connection — in partnership with the Georgia Department of Economic Development, the Georgia Centers of Innovation, and Georgia Tech's Enterprise Innovation Institute (EI2) — is presenting this year's summit.
Keynote speakers include Jen Bonnett, general manager of Georgia Tech's Advanced Technology Development Center (ATDC), and David Justice, the Georgia Centers of Innovation's executive director.
"Emerging technologies are rapidly shaping and changing not only the types of businesses that are being created, but also how business itself is being done," said EI2 vice president Chris Downing.
"The topics and themes we'll be exploring this year reflect that understanding and will help attendees better understand how they can incorporate and use emerging technologies to drive business forward."
Among the topics is financial technology (FinTech), an important sector in Georgia's economy. Jeff Gapusan, ATDC's FinTech catalyst, will moderate a panel discussion titled "FinTech's Impact on Your Business."
The industry is big in Georgia with 70 percent of the $5.3 trillion in annual U.S. card spending being processed through companies in Georgia. "FinTech isn't static," Downing said. "There's constant disruption in this sector which is affecting everything from traditional banking to retail. This panel features the thought leaders in this space who are driving that innovation."
Other panel topics include the Internet of Things (IoT), dealing with cybersecurity, and connecting businesses with the resources they need to navigate the ever-changing business climate.
Filed Under: Georgia Tech News Tagged With: ATDC, cybersecurity, economic development, EI2, FinTech, Georgia Innovation Summit, Georgia Mentor Protégé Connection, Georgia Tech, GTRI, innovation, IoT
Georgia Tech launches $1 million retail technology initiative at ATDC
May 25, 2017 By Andrew Smith
The Advanced Technology Development Center (ATDC), Georgia's technology incubator, is launching a new initiative for entrepreneurs focused on retail-related technology.
The new program — which comes as the retailing sector faces a torrent of change in consumer behavior — is being funded by a $1 million gift from the Mookerji Foundation to the Georgia Tech Foundation. The new initiative was announced at the 2017 ATDC Startup Showcase.
The Georgia Tech Foundation, in turn, has earmarked the new funds for the formation of the ATDC Retail Program. Founded in 1980, ATDC is a program of the Enterprise Innovation Institute, the Georgia Institute of Technology's chief economic development arm. ATDC is one of the longest running university-affiliated incubators in the United States.
"We chose Georgia Tech because of its commitment to economic development in Georgia and beyond, its focus on incorporating innovation in economic development, and its legacy of success," the Mookerji Foundation said in a statement. "ATDC is a world-class technology incubator and is at the forefront of helping entrepreneurs not only build companies, but gives them the tools for long term success."
The Atlanta-based Mookerji Foundation is dedicated to nurturing and enabling entrepreneurs in metro Atlanta.
The gift will fully fund the retail technology startup initiative for the next five years and support a retail technology expert who will serve as an entrepreneur-in-residence to mentor the startups and offer expertise relating to the field of entrepreneurship.
"The retail landscape has undergone a tumultuous shift in the last few years and retailers — from the national chains and department stores to the mom and pop shops on Main Street — are all looking for innovative technologies that help them remain competitive, stay engaged with their customers, and improve the bottom line," said Jennifer Bonnett, ATDC's general manager. "This new focus on retail complements some of our other related focus areas, such as financial technology (FinTech)."
The U.S. retail sector, which is comprised of more than 3.7 million establishments, supports some 42 million jobs with a $2.6 trillion impact on the economy, according to the National Retail Federation (NRF), the industry's chief trade group.
In Georgia, the retail industry supports 1.2 million jobs, includes more than 120,000 establishments, and adds $75.6 billion a year to the Peach State's economy, NRF data show.
"This is a very important segment of the Georgia and national economies and an exciting opportunity for Georgia Tech to make an impact and keep to its economic development mission," said Maryam Alavi, dean and Stephen P. Zelnak Jr. Chair of Georgia Tech's Ernest Scheller Jr. College of Business.
Alavi and other Scheller officials, as well as representatives of Tech's Office of Development, collaborated on the effort that led to the Mookerji Foundation's gift.
The initiative is the second of its kind for ATDC. In March 2015, Worldpay US, a global payments technology and services company, made a $1 million gift to Georgia Tech, which used the funds to launch a FinTech program at ATDC. Since its launch, that effort has reached more than 350 entrepreneurs across the state of Georgia, including 17 FinTech startups in the ATDC Signature and ATDC Accelerate portfolios. To date, those companies in both Signature and Accelerate have raised more than $34 million in outside funding.
About Georgia Tech
The Georgia Institute of Technology is one of the world's premier research universities. Georgia Tech is a national and international leader in scientific and technological research and education and is the nation's leading producer of engineers as well as a leading producer of female and minority engineering Ph.D. graduates. Ranked among the top public universities by U.S. News & World Report, the Institute enrolls more than 23,000 students within its six colleges. For additional information, visit gatech.edu.
About the Advanced Technology Development Center (ATDC)
The Advanced Technology Development Center (ATDC), a program of the Georgia Institute of Technology, is the state of Georgia's technology startup incubator. Founded in 1980 by the Georgia General Assembly, which funds it each year, ATDC's mission is to work with entrepreneurs in Georgia to help them learn, launch, scale, and succeed in the creation of viable, disruptive technology companies. Since its founding, ATDC has grown to become one of the longest running and most successful university-affiliated incubators in the United States, with its graduate startup companies raising nearly $3 billion in investment financing and generating more than $12 billion in revenue in the state of Georgia. For more information, visit atdc.org.
Filed Under: Georgia Tech News Tagged With: ATDC, EI2, FinTech, Georgia Tech, innovation, retail, technology


In order to achieve remarkable local search engine rankings in the Cocos Islands, you will need a .CC domain name. Thus, your website will rank higher in popular search engines such as Yahoo and Google. Additionally, it will attract more website visitors from the Cocos Islands, since it will be thought of as being a local website and will be accessed much more frequently by local citizens.
Grab your .CC domain name from SupremeServer for only $23.00/year a year!
Control all your .CC domains, along with any other domains which you might have, from a single location with ease, taking advantage of our time and effort saving Domain Manager interface. Available totally free with each new domain name registration, it has all the instruments you need to successfully take care of your domains, and much more. You will be able to instantly access all the important DNS settings, to comfortably set up URL redirections, to have limitless parked domain names and to manage various domain names simultaneously. Truthfully, you're going to be hard-pressed to find a better home for your domain names.
And, in case you also have a hosting account with us, it is possible to manage your domains along with your websites from the very same Control Panel - no additional domain or billing management interfaces will be required.


text:
Robert K. Young was a Scottish professional footballer who made over 160 Football League appearances for Bristol City before and after the First World War as a right back.

References

1886 births
Footballers from Fife
Scottish footballers
Association football fullbacks
English Football League players
Bristol City F.C. players
Dundee Violet F.C. players
Scottish Junior Football Association players
Year of death missing

Scotland junior international footballers

redpajama_set_name: RedPajamaWikipedia


text:
Driving through wide open and apparently endless highways and rural routes can make you feel disconcertingly exposed. The notion that the government might be monitoring and tracking average people without probable cause is also somewhat disturbing. Even though the latter is a red hot button issue, a Chicago journalist's misadventures are far more successful conveying the unease of the former. Regardless, he will find himself well out of his depth in Nathan Williams' If There's a Hell Below, which screens during the 2016 Slamdance Film Festival.
Abe has arranged to meet "Debra" out in the middle of nowhere, because she claims to have some sort of explosive information regarding an NSA-ish government agency. Even her first name is more personal information than she wants Abe to have, if it really is her name, which it probably isn't. She is a senior mid-level data cruncher of some sort, but at her level, even her gender would be a meaningful tell.
Debra is certainly better at the cloak-and-dagger stuff than Abe. He will try to win her trust and calm her raging paranoia, but that obsessive fear and suspicion is not misplaced. Events will happen, but at a slow boil that allows for enough ambiguity to fill the Great Plains.
The teasingly oblique manner in which Williams' advances the narrative could have fallen flat, but he manages keep the audience focused like a laser-beam. Frankly, the entire film feels like an homage to North By Northwest, in which Roger Thornhill is constantly looking over his shoulder, wondering if that crop-duster really means business. Of course, nothing is as it really seems, but Williams' third act reversals are almost too much for their own good.
Still, Conner Marx and Carol Roscoe put on a veritable master class playing off each other as the earnest Abe and the skittish Debra. Mark Carr also delivers and fascinating and deceptively out-of-left field monologue as a character whose identity we never really verify.
There is no question If There's a Hell is the sort of film you have to work with. Yet, the layers of mystery Williams bakes in make it quite distinctive. The importance of Chris Messina's cinematography cannot be over-emphasized. He vividly captures a sense of vulnerability one feels on isolated stretches of empty road. Ironically, the film is so enigmatic, we lose sight of the very policies it seeks to critique, but that is not such a bad thing. Recommended for adventurous viewers with adult attention spans, If There's a Hell Below screens again tomorrow (1/27), as part of this year's Slamdance in Park City, Utah.
Labels: Slamdance '16


text:
US20210365762A1 - Detecting behavior patterns utilizing machine learning model trained with multi-modal time series analysis of diagnostic data - Google Patents
Detecting behavior patterns utilizing machine learning model trained with multi-modal time series analysis of diagnostic data Download PDF
US20210365762A1
US20210365762A1 US16/877,631 US202016877631A US2021365762A1 US 20210365762 A1 US20210365762 A1 US 20210365762A1 US 202016877631 A US202016877631 A US 202016877631A US 2021365762 A1 US2021365762 A1 US 2021365762A1
diagnostic data
series diagnostic
Mohammad RAFEY
Dell Products LP
2020-05-19 Application filed by Dell Products LP filed Critical Dell Products LP
2020-05-19 Priority to US16/877,631 priority Critical patent/US20210365762A1/en
2020-05-19 Assigned to DELL PRODUCTS L.P. reassignment DELL PRODUCTS L.P. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: RAFEY, MOHAMMAD
2020-08-18 Assigned to CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH reassignment CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH SECURITY AGREEMENT Assignors: DELL PRODUCTS L.P., EMC IP Holding Company LLC
2020-08-21 Assigned to THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT reassignment THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: DELL PRODUCTS L.P., EMC IP Holding Company LLC
2021-11-02 Assigned to EMC IP Holding Company LLC, DELL PRODUCTS L.P. reassignment EMC IP Holding Company LLC RELEASE OF SECURITY INTEREST AT REEL 053531 FRAME 0108 Assignors: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH
2021-11-25 Publication of US20210365762A1 publication Critical patent/US20210365762A1/en
Status Pending legal-status Critical Current
USPTO PatentCenter
USPTO Assignment
G—PHYSICS
G06—COMPUTING; CALCULATING; COUNTING
G06N—COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS
G06N3/00—Computer systems based on biological models
G06N3/02—Computer systems based on biological models using neural network models
G06N3/04—Architectures, e.g. interconnection topology
G06N3/0445—Feedback networks, e.g. hopfield nets, associative networks
G06K—RECOGNITION OF DATA; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
G06K9/00—Methods or arrangements for reading or recognising printed or written characters or for recognising patterns, e.g. fingerprints
G06K9/62—Methods or arrangements for recognition using electronic means
G06K9/6217—Design or setup of recognition systems and techniques; Extraction of features in feature space; Clustering techniques; Blind source separation
G06K9/6218—Clustering techniques
G06K9/622—Non-hierarchical partitioning techniques
G06K9/6221—Non-hierarchical partitioning techniques based on statistics
G06K9/6223—Non-hierarchical partitioning techniques based on statistics with a fixed number of clusters, e.g. K-means clustering
G06K9/6256—Obtaining sets of training patterns; Bootstrap methods, e.g. bagging, boosting
G06K9/6267—Classification techniques
G06K9/6268—Classification techniques relating to the classification paradigm, e.g. parametric or non-parametric approaches
G06K9/6269—Classification techniques relating to the classification paradigm, e.g. parametric or non-parametric approaches based on the distance between the decision surface and training patterns lying on the boundary of the class cluster, e.g. support vector machines
G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
G16Y40/00—IoT characterised by the purpose of the information processing
G16Y40/10—Detection; Monitoring
An apparatus includes a processing device configured to obtain time series diagnostic data associated with assets in an information technology (IT). The processing device is also configured to generate first modality information comprising behavior labels assigned to each of a plurality of time periods, a given behavior label for a given time period being based at least in part on measured feature values for the features collectively in the given time period. The processing device is further configured to generate second modality information comprising feature deltas characterizing differences between measured feature values for interdependent feature pairs. The processing device is further configured to perform multi-modal analysis of the time series diagnostic data to detect behavior patterns in the utilizing a machine learning model trained using the first modality information and the second modality information, and to initiate remedial action in the IT infrastructure responsive to detecting an anomalous behavior pattern.
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
The field relates generally to information processing, and more particularly to techniques for monitoring information processing systems.
An information technology (IT) infrastructure may be monitored using various devices, such as Internet of Things (IoT) devices. IoT devices may include sensors that are deployed in the IT infrastructure to collect various types of data that is processed to monitor the IT infrastructure. For example, the IoT devices may collect various metrics that characterize state of the IoT devices and the environment in which the IoT devices operate. As the number of IoT devices deployed increases, it is more difficult to handle the volume of collected data to provide accurate and reliable monitoring of the IT infrastructure.
Illustrative embodiments of the present invention provide techniques for detecting behavior patterns utilizing a machine learning model trained based at least in part on multi-modal time series analysis of diagnostic data.
In one embodiment, an apparatus comprises at least one processing device comprising a processor coupled to a memory. The at least one processing device is configured to perform the step of obtaining time series diagnostic data associated with a plurality of assets in an information technology infrastructure, the time series diagnostic data comprising feature values for a plurality of features measured for a plurality of time periods. The at least one processing device is also configured to perform the step of generating first modality information for the time series diagnostic data, the first modality information comprising behavior labels assigned to each of the plurality of time periods, a given behavior label for a given one of the plurality of time periods being based at least in part on measured feature values for the plurality of features collectively in the given time period. The at least one processing device is further configured to perform the step of generating second modality information for the time series diagnostic data, the second modality information comprising feature deltas characterizing differences between measured feature values for interdependent pairs of the plurality of features in each of the plurality of time periods. The at least one processing device is further configured to perform the steps of performing multi-modal analysis of the time series diagnostic data to detect behavior patterns in the time series diagnostic data utilizing a machine learning model trained using the first modality information and the second modality information, and initiating at least one remedial action in the information technology infrastructure responsive to detecting an anomalous behavior pattern in the time series diagnostic data.
These and other illustrative embodiments include, without limitation, methods, apparatus, networks, systems and processor-readable storage media.
FIG. 1 is a block diagram of an information processing system with an information technology infrastructure monitoring system configured for detecting behavior patterns associated with assets in an information technology infrastructure in an illustrative embodiment of the invention.
FIG. 2 is a flow diagram of an exemplary process for detecting behavior patterns utilizing a machine learning model trained based at least in part on multi-modal time series analysis of diagnostic data in an illustrative embodiment.
FIG. 3 shows a feature dependency matrix indicating interdependent relationships between features of telemetry data collected from Internet of Things (IoT) devices in an illustrative embodiment.
FIG. 4 shows a system flow for performing time series analysis of IoT data streams in an illustrative embodiment.
FIG. 5 shows generation of a binary classification model in an illustrative embodiment.
FIGS. 6A-6C show generation of a feature delta model in an illustrative embodiment.
FIG. 7 shows plots illustrating the feature delta model in an illustrative embodiment.
FIG. 8 shows a system flow for identifying anomalous behavior patterns in IoT data streams using deep learning in an illustrative embodiment.
FIGS. 9A-9C show pseudocode for implementing a deep learning model for identifying anomalous behavior in IoT data streams in an illustrative embodiment.
FIGS. 10 and 11 show examples of processing platforms that may be utilized to implement at least a portion of an information processing system in illustrative embodiments.
Illustrative embodiments will be described herein with reference to exemplary information processing systems and associated computers, servers, storage devices and other processing devices. It is to be appreciated, however, that embodiments are not restricted to use with the particular illustrative system and device configurations shown. Accordingly, the term "information processing system" as used herein is intended to be broadly construed, so as to encompass, for example, processing systems comprising cloud computing and storage systems, as well as other types of processing systems comprising various combinations of physical and virtual processing resources. An information processing system may therefore comprise, for example, at least one data center or other type of cloud-based system that includes one or more clouds hosting tenants that access cloud resources.
FIG. 1 shows an information processing system 100 configured in accordance with an illustrative embodiment. The information processing system 100 is assumed to be built on at least one processing platform and provides functionality for detecting behavior patterns (e.g., anomalous behavior) utilizing multi-modal time series analysis of diagnostic data. The information processing system 100 includes an information technology (IT) infrastructure monitoring system 102 and a plurality of client devices 104-1, 104-2, . . . 104-M (collectively client devices 104). The IT infrastructure monitoring system 102 and client devices 104 are coupled to a network 106. Also coupled to the network 106 is an asset database 108, which may store various information relating to diagnostic and other metrics associated with a plurality of assets of IT infrastructure 110 also coupled to the network 106. The assets may include, by way of example, physical and virtual computing resources in the IT infrastructure 110. Physical computing resources may include physical hardware such as servers, storage systems, networking equipment, Internet of Things (IoT) devices, other types of processing and computing devices, etc. Virtual computing resources may include virtual machines (VMs), software containers, etc.
The assets of the IT infrastructure 110 (e.g., physical and virtual computing resources thereof) may generate various telemetry data, such as various diagnostic metrics associated with the assets themselves or an environment in which the assets operate. Such diagnostic metrics or telemetry data may be stored in the asset database 108. In some embodiments, it is assumed that the telemetry data is in the form of time series data sets or data streams (e.g., produced by IoT devices in the IT infrastructure 110).
The client devices 104 may comprise, for example, physical computing devices such as IoT devices, mobile telephones, laptop computers, tablet computers, desktop computers or other types of devices utilized by members of an enterprise, in any combination. Such devices are examples of what are more generally referred to herein as "processing devices." Some of these processing devices are also generally referred to herein as "computers." The client devices 104 may also or alternately comprise virtualized computing resources, such as VMs, software containers, etc.
The client devices 104 in some embodiments comprise respective computers associated with a particular company, organization or other enterprise. In addition, at least portions of the system 100 may also be referred to herein as collectively comprising an "enterprise." Numerous other operating scenarios involving a wide variety of different types and arrangements of processing nodes are possible, as will be appreciated by those skilled in the art.
The network 106 is assumed to comprise a global computer network such as the Internet, although other types of networks can be part of the network 106, including a wide area network (WAN), a local area network (LAN), a satellite network, a telephone or cable network, a cellular network, a wireless network such as a WiFi or WiMAX network, or various portions or combinations of these and other types of networks.
The asset database 108, as discussed above, is configured to store and record information relating to diagnostic and instrumentation data, or more generally telemetry data, that is collected from assets in the IT infrastructure 110. The asset database 108 may also store various models generated from such telemetry data, such as a binary classifier model, a delta model, etc. as will be described in further detail below. Various other information may be stored in the asset database 108 in other embodiments as discussed in further detail below.
The asset database 108 in some embodiments is implemented using one or more storage systems or devices associated with the IT infrastructure monitoring system 102. In some embodiments, one or more of the storage systems utilized to implement the asset database 108 comprises a scale-out all-flash content addressable storage array or other type of storage array.
The term "storage system" as used herein is therefore intended to be broadly construed, and should not be viewed as being limited to content addressable storage systems or flash-based storage systems. A given storage system as the term is broadly used herein can comprise, for example, network-attached storage (NAS), storage area networks (SANs), direct-attached storage (DAS) and distributed DAS, as well as combinations of these and other storage types, including software-defined storage.
Other particular types of storage products that can be used in implementing storage systems in illustrative embodiments include all-flash and hybrid flash storage arrays, software-defined storage products, cloud storage products, object-based storage products, and scale-out NAS clusters. Combinations of multiple ones of these and other storage products can also be used in implementing a given storage system in an illustrative embodiment.
Although not explicitly shown in FIG. 1, one or more input-output devices such as keyboards, displays or other types of input-output devices may be used to support one or more user interfaces to the IT infrastructure monitoring system 102, as well as to support communication between the IT infrastructure monitoring system 102 and other related systems and devices not explicitly shown.
The client devices 104 are configured to access or otherwise utilize assets of the IT infrastructure 110 (e.g., applications that are running on or hosted by such assets). In some embodiments, the assets (e.g., physical and virtual computing resources) of the IT infrastructure 110 are operated by or otherwise associated with one or more companies, businesses, organizations, enterprises, or other entities. For example, in some embodiments the assets of the IT infrastructure 110 may be operated by a single entity, such as in the case of a private data center of a particular company. In other embodiments, the assets of the IT infrastructure 110 may be associated with multiple different entities, such as in the case where the assets of the IT infrastructure 110 provide a cloud computing platform or other data center where resources are shared amongst multiple different entities.
The term "user" herein is intended to be broadly construed so as to encompass numerous arrangements of human, hardware, software or firmware entities, as well as combinations of such entities.
In the present embodiment, alerts or notifications generated by the IT infrastructure monitoring system 102 are provided over network 106 to client devices 104, or to a system administrator, IT manager, or other authorized personnel via one or more host agents. Such host agents may be implemented via the client devices 104 or by other computing or processing devices associated with a system administrator, IT manager or other authorized personnel. Such devices can illustratively comprise mobile telephones, laptop computers, tablet computers, desktop computers, or other types of computers or processing devices configured for communication over network 106 with the IT infrastructure monitoring system 102. For example, a given host agent may comprise a mobile telephone equipped with a mobile application configured to receive alerts or notifications from the software testing framework 102 (e.g., when anomalous behavior is detected, when remedial actions are recommended or applied, etc.). The given host agent provides an interface for responding to such various alerts or notifications as described elsewhere herein.
It should be noted that a "host agent" as this term is generally used herein may comprise an automated entity, such as a software entity running on a processing device. Accordingly, a host agent need not be a human entity.
The IT infrastructure monitoring system 102 in the FIG. 1 embodiment is assumed to be implemented using at least one processing device. Each such processing device generally comprises at least one processor and an associated memory, and implements one or more functional modules for controlling certain features of the IT infrastructure monitoring system 102. In the FIG. 1 embodiment, the IT infrastructure monitoring system 102 comprises a multi-modal time series analysis module 112, a deep learning anomalous behavior detection module 114, and an anomalous behavior remediation module 116.
The IT infrastructure monitoring system 102 is configured to obtain time series diagnostic data associated with a plurality of assets in the IT infrastructure 110 (e.g., from IoT devices monitoring the IT infrastructure 110). The time series diagnostic data may comprise feature values for a plurality of features measured for a plurality of time periods. The multi-modal time series analysis module 112 is configured to generate first and at least second modality information for the time series diagnostic data. The first modality information comprises behavior labels assigned to each of the plurality of time periods. The behavior labels, in some embodiments, are assigned using a binary classifier that analyzes, for a given time period, the measured feature values for the plurality of features collectively to determine whether such values correspond to a first type of behavior (e.g., normal behavior) or a second type of behavior (e.g., abnormal behavior). The second modality information comprises feature deltas characterizing differences between measured feature values for interdependent pairs of the plurality of features in each of the plurality of time periods.
The multi-modal time series analysis module 112 utilizes the first and second modality information to train a machine learning model (e.g., a deep learning model, such as a long short term memory (LSTM) type recurrent neural network (RNN) implemented using the deep learning anomalous behavior detection module 114. The deep learning anomalous behavior detection module 114 utilizes the trained machine learning model to detect behavior patterns in the time series diagnostic data.
The anomalous behavior remediation module 116 is configured to initiate remedial action in the IT infrastructure 110 responsive to detecting anomalous behavior patterns in the time series diagnostic data. This advantageously enables proactive remediation of anomalous behavior, in that streams of diagnostic data (e.g., from IoT devices in the IT infrastructure 110) may be continually or periodically analyzed using the trained machine learning model to predict when anomalous behavior patterns are or will occur. The anomalous behavior patterns may correspond to device or environment state indicative of security threats, potential failure of assets, etc. The anomalous behavior remediation module 116 may be configured to identify assets in the IT infrastructure 110 that are or will be affected by the detected anomalous behavior patterns and apply remedial actions to such affected assets (e.g., applying security hardening procedures, modifying asset configuration, etc.).
It is to be appreciated that the particular arrangement of the IT infrastructure monitoring system 102, client devices 104, asset database 108 and IT infrastructure 110 illustrated in the FIG.
1 embodiment is presented by way of example only, and alternative arrangements can be used in other embodiments. For example, the IT infrastructure monitoring system 102, or one or more portions thereof such as the multi-modal time series analysis module 112, the deep learning anomalous behavior detection module 114, and the anomalous behavior remediation module 116, may in some embodiments be implemented internal to one or more of the client devices 104 or the IT infrastructure 110. As another example, the functionality associated with the multi-modal time series analysis module 112, the deep learning anomalous behavior detection module 114, and the anomalous behavior remediation module 116 may be combined into one module, or separated across more than three modules with the multiple modules possibly being implemented with multiple distinct processors or processing devices.
At least portions of the multi-modal time series analysis module 112, the deep learning anomalous behavior detection module 114, and the anomalous behavior remediation module 116 may be implemented at least in part in the form of software that is stored in memory and executed by a processor.
It is to be understood that the particular set of elements shown in FIG. 1 for detecting behavior patterns utilizing a machine learning model trained based at least in part on multi-modal time series analysis of diagnostic data is presented by way of illustrative example only, and in other embodiments additional or alternative elements may be used. Thus, another embodiment may include additional or alternative systems, devices and other network entities, as well as different arrangements of modules and other components.
The IT infrastructure monitoring system 102 may be part of or otherwise associated with another system, such as a governance, risk and compliance (GRC) system, a security operations center (SOC), a critical incident response center (CIRC), a security analytics system, a security information and event management (STEM) system, etc.
The IT infrastructure monitoring system 102, and other portions of the system 100, in some embodiments, may be part of cloud infrastructure as will be described in further detail below. The cloud infrastructure hosting the IT infrastructure monitoring system 102 may also host any combination of the IT infrastructure monitoring system 102, one or more of the client devices 104, the asset database 108 and the IT infrastructure 110.
The IT infrastructure monitoring system 102 and other components of the information processing system 100 in the FIG. 1 embodiment, are assumed to be implemented using at least one processing platform comprising one or more processing devices each having a processor coupled to a memory. Such processing devices can illustratively include particular arrangements of compute, storage and network resources.
The client devices 104 and the IT infrastructure monitoring system 102 or components thereof (e.g., the multi-modal time series analysis module 112, the deep learning anomalous behavior detection module 114, and the anomalous behavior remediation module 116) may be implemented on respective distinct processing platforms, although numerous other arrangements are possible. For example, in some embodiments at least portions of the IT infrastructure monitoring system 102 and one or more of the client devices 104 are implemented on the same processing platform. A given client device (e.g., 104-1) can therefore be implemented at least in part within at least one processing platform that implements at least a portion of the IT infrastructure monitoring system 102. Similarly, at least a portion of the IT infrastructure monitoring system 102 may be implemented at least in part within at least one processing platform that implements at least a portion of the IT infrastructure 110.
The term "processing platform" as used herein is intended to be broadly construed so as to encompass, by way of illustration and without limitation, multiple sets of processing devices and associated storage systems that are configured to communicate over one or more networks. For example, distributed implementations of the system 100 are possible, in which certain components of the system reside in one data center in a first geographic location while other components of the system reside in one or more other data centers in one or more other geographic locations that are potentially remote from the first geographic location. Thus, it is possible in some implementations of the system 100 for the IT infrastructure monitoring system 102, the client devices 104, the asset database 108 and the IT infrastructure 110, or portions or components thereof, to reside in different data centers. Numerous other distributed implementations are possible. The IT infrastructure monitoring system 102 can also be implemented in a distributed manner across multiple data centers.
Additional examples of processing platforms utilized to implement the IT infrastructure monitoring system 102 in illustrative embodiments will be described in more detail below in conjunction with FIGS. 10 and 11.
It is to be appreciated that these and other features of illustrative embodiments are presented by way of example only, and should not be construed as limiting in any way.
An exemplary process for detecting behavior patterns utilizing a machine learning model trained based at least in part on multi-modal time series analysis of diagnostic data will now be described in more detail with reference to the flow diagram of FIG. 2. It is to be understood that this particular process is only an example, and that additional or alternative processes for detecting behavior patterns utilizing a machine learning model trained based at least in part on multi-modal time series analysis of diagnostic data can be carried out in other embodiments.
In this embodiment, the process includes steps 200 through 208. These steps are assumed to be performed by the IT infrastructure monitoring system 102 utilizing the multi-modal time series analysis module 112, the deep learning anomalous behavior detection module 114, and the anomalous behavior remediation module 116. The process begins with step 200, obtaining time series diagnostic data associated with a plurality of assets in an IT infrastructure (e.g., IT infrastructure 110). The time series diagnostic data comprises feature values for a plurality of features measured for a plurality of time periods. In some embodiments, the time series diagnostic data is obtained from one or more IoT devices and comprises information characterizing device health of the IoT devices or of other assets of the IT infrastructure.
Step 200, in some embodiments, includes separating the time series diagnostic data into two or more chunks, where the two or more chunks of the time series diagnostic data comprise feature data for the plurality of features collected from the plurality of assets in the information technology infrastructure. The feature data collected from different ones of the plurality of assets in the information technology infrastructure may have different sample lengths per a designated time unit (e.g., one hour, one day, etc.). Step 200 may further include transforming the feature data in the two or more chunks of the time series diagnostic data to have an equal sample length per the designated time unit. Each of the plurality of time periods may have a duration equal to the designated time unit. Transforming the feature data in the two or more chunks of the time series diagnostic data to have the equal sample length per the designated time unit may comprise computing a mean sample length of the feature data across the two or more chunks of the time series diagnostic data, truncating sample lengths for feature data in the two or more chunks of the time series diagnostic data that are longer than the mean time sample length, and padding dummy data for feature data in the two or more chunks of the time series diagnostic data that are shorter than the mean time sample length.
The FIG. 2 process continues with step 202, generating first modality information for the time series diagnostic data. The first modality information comprises behavior labels assigned to each of the plurality of time periods. A given behavior label for a given one of the plurality of time periods is based at least in part on measured feature values for the plurality of features collectively in the given time period. In some embodiments, the behavior labels are assigned on a per-asset or per-device basis (e.g., such that individual IoT devices or assets, or groups thereof, may be labeled as experiencing normal or abnormal behavior in each time period). Step 202, in some embodiments, includes assigning the asset behavior labels for each of the plurality of time periods utilizing a binary classifier model. The binary classifier model is configured to label asset behavior during each of the plurality of time periods as one of normal behavior and abnormal behavior.
In step 204, second modality information is generated for the time series diagnostic data. The second modality information comprising feature deltas characterizing differences between measured feature values for interdependent pairs of the plurality of features in each of the plurality of time periods. Step 204 may include analyzing the time series diagnostic data to generate a feature dependency matrix (FDM) characterizing interdependencies between pairs of the plurality of features, and identifying the interdependent pairs of the plurality of features based at least in part on the FDM. A given interdependent pair of the plurality of features may comprises a first one of the plurality of features and a second one of the plurality of features, and the feature deltas for the given interdependent pair of the plurality of features may characterize relative differences between the first feature and the second feature across the plurality of time periods. The feature deltas for the given interdependent pair of the plurality of features may be non-absolute and independent of positioning in the time series diagnostic data.
Multi-modal analysis of the time series diagnostic data is performed in step 206 to detect behavior patterns in the time series diagnostic data utilizing a machine learning model trained using the first modality information and the second modality information. In step 208, at least one remedial action is initiated in the IT infrastructure responsive to detecting an anomalous behavior pattern in the time series diagnostic data in step 206. Step 208 may include one or more of: applying one or more security hardening procedures to one or more of the plurality of assets associated with the detected anomalous behavior; modifying a configuration of one or more of the plurality of assets associated with the detected anomalous behavior; and modifying access, by one or more of a plurality of users, to one or more of the plurality of assets associated with the detected anomalous behavior.
The machine learning model may comprise an LSTM model or other type of RNN or other deep learning model that is configured to detect behavior patterns in the time series diagnostic data based at least in part on (i) first patterns in the generated first modality information corresponding to feature values of the plurality of features across the plurality of time periods and (ii) second patterns in the generated second modality information corresponding to differences between the interdependent pairs of features across the plurality of time periods. Utilizing the trained machine learning model to detect behavior patterns in the time series diagnostic data may comprise identifying at least a subset of the plurality of assets in the IT infrastructure affected by the detected anomalous behavior pattern in the time series diagnostic data. Step 208 may include applying the at least one remedial action to the identified subset of the plurality of assets in the information technology infrastructure affected by the detected anomalous behavior pattern in the time series diagnostic data.
IoT and edge devices may provide a robust set of diagnostics and instrumentation data metrics for monitoring device state and health (e.g. of the IoT or edge devices themselves, or other assets in an environment that the IoT or edge devices are configured to monitor). The diagnostics and instrumentation data metrics may include, for example, device hardware, firmware or application code metrics. The diagnostics and instrumentation data metrics may also or alternatively represent some external environment metrics for the environment in which a particular IoT or edge device is operating and relates to it. Diagnostics and instrumentation data metrics are also referred to herein as telemetry data. Telemetry data on operational and device performance may come in the form of time series data streams with proper time stamps. With increased growth in IoT devices (e.g., exponential growth that is projected to be in the billions in the near future), however, it is increasingly challenging to remotely monitor such devices in the field. Such remote monitoring is desired for accurately predicting anomalous behavior to enable proactive rather than reactive remediation.
Illustrative embodiments provide techniques for detecting anomalous behavior in IoT data streams (e.g., or other data streams obtained from edge devices or other types of assets that are in or are configured to monitor IT infrastructure) by performing a multi-modal data analysis. The multi-modal data analysis uses an ensemble of a binary classification model and a feature delta model. Deep learning techniques are then applied on the combined ensemble model to predict abnormal device behavior. Such predictions may be used to perform proactive remediation in associated devices or other assets in an IT infrastructure.
In some embodiments, FDMs are used to represent interdependent relationships between features. In the description below, it is assumed that the devices being analyzed are IoT devices. As discussed above, however, the techniques described herein may also be used for data collected from or otherwise associated with edge devices or, more generally, data that is collected from or otherwise associated with physical and virtual computing resources (e.g., assets in IT infrastructure 110). IoT device data is analyzed, identified and tested to determine which feature dependencies best represent the device behavior in a model. Once identified, such feature dependencies are updated in an FDM
FIG. 3 shows an example FDM 300. The FDM 300 shows interdependency relationships for six features denoted F1 through F6. While FIG. 3 shows an example where there are only six features, embodiments are not limited to use with six features. More or less than six features may be used in other embodiments. In FDM 300, a value of 1 denotes that a dependent relationship exists between a pair of features, and a value of 0 denotes that a dependent relationship does not exist between a pair of features. FDMs may be built using automated or manual feature selection approaches, using techniques similar to those used for feature engineering or dimensionality reduction processes in machine learning. FDMs may be used for building feature delta data models as described in further detail below.
The FDMs used in some embodiments capture data patterns between correlated features, and may be symmetrical or asymmetrical. In a symmetrical FDM, all features are either bidirectionally related or not related at all. In an asymmetrical FDM, features may be directionally related, bidirectionally related, or not related at all. Consider, as an example, sensor data obtained from a vehicle and features of speed and engine temperature. If these features are directionally related or correlated, for example, an increase in speed may affect (e.g., increase) engine temperature, but the opposite relationship is not true (e.g., an increase in engine temperature is not necessarily correlated with increase in speed). As another example, features of speed and distance covered may be bidirectionally correlated, in that if speed increases the distance covered will also increase in most scenarios, and vice versa. Feature delta models described in further detail below may capture feature deltas for both directional and bidirectional relationships separately.
FIG. 4 shows a system flow for performing time series analysis of IoT data streams. As shown, a set of IoT edge devices 401 (e.g., devices D1 through D6) provide device diagnostics and instrumentation data through telemetry for storage in a diagnostic instrumentation datastore 403 (e.g., which may be part of the asset database 108). The multi-modal time series analysis module 112 utilizes the telemetry data stored in diagnostic instrumentation datastore 403. In block 405, chunks of IoT diagnostic data are collected from the diagnostic instrumentation datastore 403. The chunks of the IoT diagnostic data are assumed to be time period bound (e.g., to some pre-defined time period such as minutes, hours, days, etc.).
Each chunk of the IoT diagnostic data may include a set of features per unit of time interval (e.g., minute, hour, day, etc.). Assume, for example, that the chunk time interval is one hour. Each of the IoT edge devices 401 may have different speeds at which they send feature data, including situations in which the same IoT edge device provides feature data for a first feature at a different speed or rate than it provides feature data for a second feature. Consider, as an example, a situation in which IoT edge device D1 sends 100 data points per hour for a given feature, while IoT edge device D2 sends 75 data points per hour for the given feature, depending on speed and latency. To synchronize this and maintain consistency, the chunks of data may be transformed to have equal length per some designated pre-defined time period unit (e.g., a minute, an hour, a day) in block 407.
The block 407 transformation, in some embodiments, includes optional block 409 where a mean length of the samples is computed, followed by truncating longer-length samples and padding shorter-length samples with dummy data (e.g., 0s) or otherwise imputing missing values. Block 409 is an example of imputation used to fill in gaps or to substitute some data to maintain uniformity from a modeling perspective.
In block 411, binary classification is performed to label each sample as normal or abnormal behavior based at least in part on historical data. In some embodiments, "1" is used as a label for normal behavior and "−1" is used as a label for abnormal behavior. The results of block 411 are used as training data for a time series binary classifier 413 as will be described in further detail below with respect to FIG. 5. The time series binary classifier 413 is configured to classify data elements into two classes or categories based on a set of features. Various classification algorithms may be used in implementing the time series binary classifier 413, including classification algorithms that utilize logistic regression, decision tree, random forest, support-vector machine (SVM) k-nearest neighbor (KNN), etc. The results of block 409 are used as training data for a delta model generator 415, as will be described in further detail below with respect to FIGS. 6A-6C and 7. The time series binary classifier 413 and delta model generator 415 may store associated training data in a machine learning training datastore 417 (e.g., which may be part of the asset database 108).
FIG. 5 shows a table 500 with sample data for features 1 through 6 at different dates and times. The set of features for a particular date and time is assigned a class label (e.g., 1 for normal behavior, −1 for abnormal behavior). The features 1 through 6 (also referred to as features F1 through F6) may represent various features or other metrics that are measured and obtained from IoT devices. Different IoT device platforms and manufacturers may provide different metrics characterizing device health status. The actual features used in a particular implementation may be based at least in part on the available metrics for the IoT devices being monitored. In addition, while FIG. 5 shows an example where there are only six features, embodiments are not limited to use with six features. More or less than six features may be used in other embodiments.
In some embodiments, the features or metrics may include one or more of: a number of device-to-cloud telemetry messages attempted to be sent to an IoT hub; a number of device-to-cloud telemetry messages sent successfully to the IoT hub; a number of cloud-to-device messages abandoned by the device; a number of expired cloud-to-device messages; a number of times messages were successfully delivered to all endpoints using IoT hub routing (where, if a message is routed to multiple endpoints, this value increases by one for each successful delivery, and where, if a message is delivered to the same endpoint multiple times, this value increases by one for each successful delivery); a number of times messages were dropped by the IoT hub routing due to dead endpoints (where this value does not count messages delivered to fallback routes as dropped messages are not delivered there); a number of times messages were orphaned by the IoT hub routing because they didn't match any routing rules (including the fallback rule); a number of times the IoT hub routing failed to deliver messages due to an incompatibility with the endpoint (where this value does not include retries); a number of times the IoT hub routing delivered messages to the endpoint associated with the fallback route; an average latency (in milliseconds) between message ingress to the IoT hub and message ingress into an event hub endpoint; an amount of data (in bytes) that IoT hub routing delivered to storage endpoints; etc. It should be appreciated that the above metrics are presented by way of example only, and that various other metrics may be used in addition to or in place of one or more of the above-described metrics.
FIGS. 6A-6C show tables 600, 605 and 610, respectively, illustrative calculation of feature deltas for pairs of the features F1-F6 that have interdependency relationships (e.g., as determined using an FDM such as FDM 300). The feature delta model is built on delta variations of the IoT device metrics or features over a finite time series, and tracks anomalous patterns in the delta series rather than the data series itself. It should be noted that this is different than tracking patterns in the feature data itself, and the delta variation patterns are non-absolute and independent of positioning on the time series. This difference is highlighted in plots 700 and 705 shown in FIG. 7. Plot 700 shows data patterns in the feature data itself, while plot 705 shows the data patterns in the feature deltas. The feature data in the FIG. 7 examples includes two features, Feature 1 and Feature 2. The Feature 1 values are: 23, 34, 45, 34, 67, 43, 67, 45, 23, 87, 56, 87, 98, 65, 45, 98, 56, 43, 67, 45, 33, 76, 45. The Feature 2 values are: 43, 34, 33, 65, 34, 23, 67, 44, 76, 77, 87, 56, 67, 56, 65, 78, 67, 89, 67, 87, 45, 34, 45. The feature delta, ΔA=51 Feature 1−Feature 2|=20, 0, 12, 31, 33, 20, 0, 1, 53, 10, 31, 31, 31, 9, 20, 20, 11, 46, 0, 42, 12, 42, 0. As illustrated, the patterns in the feature deltas are relative, non-absolute, and independent of positioning on the time series. This increases the chances of a deep learning model (e.g., an LSTM model as described in further detail below) to pick up anomalous behavior patterns more accurately.
FIG. 8 shows a system flow for identifying anomalous behavior patterns in IoT data stream (e.g., from IoT edge devices 401) using deep learning. The deep learning behavior detection module 114 is configured to utilize, as training data 801, the binary classifier model 413 and feature delta model 415 stored in the machine learning datastore 417. The training data 801 is used for training a deep learning model which, in the FIG. 8 example, is an LSTM algorithm or model 803. The LSTM algorithm 803 is used by a predictive model 805 to characterize telemetry data (e.g., diagnostic instrumentation data for IoT edge devices 401 stored in the diagnostic instrumentation datastore 403) as normal or anomalous. The output of the predictive model 805, in some embodiments, is utilized as additional training data 801 such that, as more and more IoT data streams are analyzed, more and more data becomes available for model training and accuracy increases over time.
LSTM models are an enhanced version of RNNs, and fill in gaps where RNNs may fail (e.g., some non-LSTM RNNs are unable to work with longer sequences to remember long-term learning and dependencies, making them suffer from short-term memory and resultant inaccuracies). The design of LSTM enables LSTM models to hold on to long term memories. LSTM models may use a gating mechanism within each cell. Unlike non-LSTM RNNs, at each step the LSTM cell takes in three different pieces of information: (i) the current input data; (ii) the short-term memory from the previous cell (e.g., hidden states); and (iii) the long-term memory (e.g., cell state). Gates are used to regulate which information is to be kept and which is to be discarded at each step before passing on the long-term and short-term information to the next LSTM cell. These gates are trained to accurately filter the useful information which could be used for future prediction. There are three types of gates used in LSTM cells, referred to as the input gate, the forget gate, and the output gate. The input gate decides what new information will be stored in the long-term memory and it only works with the information from the current input and the short-term memory from the previous time step. The input gate discards or filters information deemed not useful. The forget gate decides which information from the long-term memory should be discarded. The forget gate uses the incoming long term memory and multiplies it by a forget vector generated from the current input and incoming short-term memory. The output gate takes the current input, previous short-term memory and newly computed long-term memory to produce the new short-term memory, which will be passed on to the LSTM cell in the next time step. The short-term and long-term memory produced by these gates will then be carried over to the next LSTM cell for the process to be repeated.
The anomalous behavior remediation module 116, in block 807, detects and identifies anomalous behavior patterns in the IoT data streams of the IoT edge devices 401 using the predictive model 805 and LSTM algorithm 803. In block 809, the anomalous behavior remediation module 116 selects one or more remedial actions based at least in part on the anomalous behavior patterns identified in block 809. In block 811, the anomalous behavior remediation module 116 applies the selected remedial actions to the IoT edge devices 401.
Various types of remedial actions may be selected and applied to the IoT edge devices 401 based at least in part on the type of detected anomalous behavior. For example, if the detected anomalous behavior in block 807 is indicative of security threats (e.g., viruses, malware, etc.), the remedial action selected in block 809 may include applying one or more security hardening procedures to affected ones of the IoT edge devices 401. Alternatively, the remedial action selected in block 809 may include modifying access by users (e.g., of client devices 102) to particular ones of the IoT edge devices 401, modifying configurations of the IoT edge devices 401, etc. Remedial actions may also be applied to one or more devices and systems that are associated with the IoT edge devices 401, rather than the IoT edge devices 401 themselves. As discussed above, the IoT edge devices 401 in some embodiments may be used to monitor an associated environment (e.g., such as environmental conditions in a data center, warehouse, etc.). When the telemetry data collected from the IoT edge devices 401 is indicative of abnormal behavior in the associated environment, the remedial actions may be applied to devices and systems in the environment other than the IoT edge devices 401 (e.g., including assets such as physical and virtual computing resources in IT infrastructure 110, where such assets may be different than the IoT edge devices 401 that the IoT data streams are collected from).
FIGS. 9A-9C show respective portions 900, 905 and 910 of pseudocode for implementing a deep learning model for identifying anomalous behavior in IoT data streams. While the pseudocode 900, 905 and 910 in FIGS. 9A-9C utilizes the Python programming language, it should be appreciated that various other programming languages may be utilized. Pseudocode 900 illustrates code for performing steps of collecting the IoT stream data and preparing the training data set. Pseudocode 905 illustrates code for building the training data set as well as validation and test data sets. Pseudocode 910 illustrates code for deep learning model training and execution.
Advantageously, the techniques described herein provide various improvements for time series analysis (e.g., of IoT data streams) by building a multi-modal ensemble data model for training a deep learning system to predict anomalous IoT or other device behavior. The multi-modal ensemble data model relies, in part, on delta patterns in feature data rather than feature data pattern itself. Thus, the multi-modal ensemble data model is at least in part non-absolute, relative and independent of the time-space positioning.
It is to be appreciated that the particular advantages described above and elsewhere herein are associated with particular illustrative embodiments and need not be present in other embodiments. Also, the particular types of information processing system features and functionality as illustrated in the drawings and described above are exemplary only, and numerous other arrangements may be used in other embodiments.
Illustrative embodiments of processing platforms utilized to implement functionality for detecting behavior patterns utilizing a machine learning model trained based at least in part on multi-modal time series analysis of diagnostic data will now be described in greater detail with reference to FIGS. 10 and 11. Although described in the context of system 100, these platforms may also be used to implement at least portions of other information processing systems in other embodiments.
FIG. 10 shows an example processing platform comprising cloud infrastructure 1000. The cloud infrastructure 1000 comprises a combination of physical and virtual processing resources that may be utilized to implement at least a portion of the information processing system 100 in FIG. 1. The cloud infrastructure 1000 comprises multiple virtual machines (VMs) and/or container sets 1002-1, 1002-2, . . . 1002-L implemented using virtualization infrastructure 1004. The virtualization infrastructure 1004 runs on physical infrastructure 1005, and illustratively comprises one or more hypervisors and/or operating system level virtualization infrastructure. The operating system level virtualization infrastructure illustratively comprises kernel control groups of a Linux operating system or other type of operating system.
The cloud infrastructure 1000 further comprises sets of applications 1010-1, 1010-2, . . . 1010-L running on respective ones of the VMs/container sets 1002-1, 1002-2, . . . 1002-L under the control of the virtualization infrastructure 1004. The VMs/container sets 1002 may comprise respective VMs, respective sets of one or more containers, or respective sets of one or more containers running in VMs.
In some implementations of the FIG. 10 embodiment, the VMs/container sets 1002 comprise respective VMs implemented using virtualization infrastructure 1004 that comprises at least one hypervisor. A hypervisor platform may be used to implement a hypervisor within the virtualization infrastructure 1004, where the hypervisor platform has an associated virtual infrastructure management system. The underlying physical machines may comprise one or more distributed processing platforms that include one or more storage systems.
In other implementations of the FIG. 10 embodiment, the VMs/container sets 1002 comprise respective containers implemented using virtualization infrastructure 1004 that provides operating system level virtualization functionality, such as support for Docker containers running on bare metal hosts, or Docker containers running on VMs. The containers are illustratively implemented using respective kernel control groups of the operating system.
As is apparent from the above, one or more of the processing modules or other components of system 100 may each run on a computer, server, storage device or other processing platform element. A given such element may be viewed as an example of what is more generally referred to herein as a "processing device." The cloud infrastructure 1000 shown in FIG. 10 may represent at least a portion of one processing platform. Another example of such a processing platform is processing platform 1100 shown in FIG. 11.
The processing platform 1100 in this embodiment comprises a portion of system 100 and includes a plurality of processing devices, denoted 1102-1, 1102-2, 1102-3, . . . 1102-K, which communicate with one another over a network 1104.
The network 1104 may comprise any type of network, including by way of example a global computer network such as the Internet, a WAN, a LAN, a satellite network, a telephone or cable network, a cellular network, a wireless network such as a WiFi or WiMAX network, or various portions or combinations of these and other types of networks.
The processing device 1102-1 in the processing platform 1100 comprises a processor 1110 coupled to a memory 1112.
The processor 1110 may comprise a microprocessor, a microcontroller, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a central processing unit (CPU), a graphical processing unit (GPU), a tensor processing unit (TPU), a video processing unit (VPU) or other type of processing circuitry, as well as portions or combinations of such circuitry elements.
The memory 1112 may comprise random access memory (RAM), read-only memory (ROM), flash memory or other types of memory, in any combination. The memory 1112 and other memories disclosed herein should be viewed as illustrative examples of what are more generally referred to as "processor-readable storage media" storing executable program code of one or more software programs.
Articles of manufacture comprising such processor-readable storage media are considered illustrative embodiments. A given such article of manufacture may comprise, for example, a storage array, a storage disk or an integrated circuit containing RAM, ROM, flash memory or other electronic memory, or any of a wide variety of other types of computer program products. The term "article of manufacture" as used herein should be understood to exclude transitory, propagating signals. Numerous other types of computer program products comprising processor-readable storage media can be used.
Also included in the processing device 1102-1 is network interface circuitry 1114, which is used to interface the processing device with the network 1104 and other system components, and may comprise conventional transceivers.
The other processing devices 1102 of the processing platform 1100 are assumed to be configured in a manner similar to that shown for processing device 1102-1 in the figure.
Again, the particular processing platform 1100 shown in the figure is presented by way of example only, and system 100 may include additional or alternative processing platforms, as well as numerous distinct processing platforms in any combination, with each such platform comprising one or more computers, servers, storage devices or other processing devices.
For example, other processing platforms used to implement illustrative embodiments can comprise converged infrastructure.
It should therefore be understood that in other embodiments different arrangements of additional or alternative elements may be used. At least a subset of these elements may be collectively implemented on a common processing platform, or each such element may be implemented on a separate processing platform.
As indicated previously, components of an information processing system as disclosed herein can be implemented at least in part in the form of one or more software programs stored in memory and executed by a processor of a processing device. For example, at least portions of the functionality for detecting behavior patterns utilizing a machine learning model trained based at least in part on multi-modal time series analysis of diagnostic data as disclosed herein are illustratively implemented in the form of software running on one or more processing devices.
It should again be emphasized that the above-described embodiments are presented for purposes of illustration only. Many variations and other alternative embodiments may be used. For example, the disclosed techniques are applicable to a wide variety of other types of information processing systems, devices, diagnostic metrics, machine learning models, etc. Also, the particular configurations of system and device elements and associated processing operations illustratively shown in the drawings can be varied in other embodiments. Moreover, the various assumptions made above in the course of describing the illustrative embodiments should also be viewed as exemplary rather than as requirements or limitations of the disclosure. Numerous other alternative embodiments within the scope of the appended claims will be readily apparent to those skilled in the art.
What is claimed is:
1. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to perform steps of:
obtaining time series diagnostic data associated with a plurality of assets in an information technology infrastructure, the time series diagnostic data comprising feature values for a plurality of features measured for a plurality of time periods;
generating first modality information for the time series diagnostic data, the first modality information comprising behavior labels assigned to each of the plurality of time periods, a given behavior label for a given one of the plurality of time periods being based at least in part on measured feature values for the plurality of features collectively in the given time period;
generating second modality information for the time series diagnostic data, the second modality information comprising feature deltas characterizing differences between measured feature values for interdependent pairs of the plurality of features in each of the plurality of time periods;
performing multi-modal analysis of the time series diagnostic data to detect behavior patterns in the time series diagnostic data utilizing a machine learning model trained using the first modality information and the second modality information; and
initiating at least one remedial action in the information technology infrastructure responsive to detecting an anomalous behavior pattern in the time series diagnostic data.
2. The apparatus of claim 1 wherein the time series diagnostic data is obtained from a plurality of Internet of Things (IoT) devices associated with the information technology infrastructure, and wherein the time series diagnostic data characterizes device health of one or more of the plurality of assets of the information technology infrastructure.
3. The apparatus of claim 1 wherein obtaining the time series diagnostic data associated with the plurality of assets comprises:
separating the time series diagnostic data into two or more chunks, wherein the two or more chunks of the time series diagnostic data comprise feature data for the plurality of features collected from the plurality of assets in the information technology infrastructure, the feature data collected from different ones of the plurality of assets in the information technology infrastructure having different sample lengths per a designated time unit; and
transforming the feature data in the two or more chunks of the time series diagnostic data to have an equal sample length per the designated time unit.
4. The apparatus of claim 3 wherein the designated time unit comprises a duration of each of the plurality of time periods.
5. The apparatus of claim 3 wherein transforming the feature data in the two or more chunks of the time series diagnostic data to have the equal sample length per the designated time unit comprises:
computing a mean sample length of the feature data across the two or more chunks of the time series diagnostic data;
truncating sample lengths for feature data in the two or more chunks of the time series diagnostic data that are longer than the mean time sample length; and
padding dummy data for feature data in the two or more chunks of the time series diagnostic data that are shorter than the mean time sample length.
6. The apparatus of claim 1 wherein generating the first modality information for the time series diagnostic data comprises assigning the asset behavior labels for each of the plurality of time periods utilizing a binary classifier model.
7. The apparatus of claim 6 wherein the binary classifier model is configured to label asset behavior during each of the plurality of time periods as one of normal behavior and abnormal behavior.
8. The apparatus of claim 1 wherein generating the second modality information for the time series diagnostic data comprises:
analyzing the time series diagnostic data to generate a feature dependency matrix characterizing interdependencies between pairs of the plurality of features; and
identifying the interdependent pairs of the plurality of features based at least in part on the feature dependency matrix.
9. The apparatus of claim 1 wherein a given interdependent pair of the plurality of features comprises a first one of the plurality of features and a second one of the plurality of features, and wherein feature deltas for the given interdependent pair of the plurality of features characterizes relative differences between the first feature and the second feature across the plurality of time periods.
10. The apparatus of claim 9 wherein the feature deltas for the given interdependent pair of the plurality of features are non-absolute and independent of positioning in the time series diagnostic data.
11. The apparatus of claim 1 wherein the machine learning model comprises a long short term memory (LSTM) model configured to detect behavior patterns in the time series diagnostic data based at least in part on (i) first patterns in the generated first modality information corresponding to feature values of the plurality of features across the plurality of time periods and (ii) second patterns in the generated second modality information corresponding to differences between the interdependent pairs of features across the plurality of time periods.
12. The apparatus of claim 11 wherein utilizing the trained machine learning model to detect behavior patterns in the time series diagnostic data comprises identifying at least a subset of the plurality of assets in the information technology infrastructure affected by the detected anomalous behavior pattern in the time series diagnostic data.
13. The apparatus of claim 12 wherein initiating the at least one remedial action in the information technology infrastructure responsive to detecting the anomalous behavior pattern in the time series diagnostic data comprises applying the at least one remedial action to the identified subset of the plurality of assets in the information technology infrastructure affected by the detected anomalous behavior pattern in the time series diagnostic data.
14. The apparatus of claim 1 wherein initiating the at least one remedial action comprises at least one of:
applying one or more security hardening procedures to one or more of the plurality of assets associated with the detected anomalous behavior;
modifying a configuration of one or more of the plurality of assets associated with the detected anomalous behavior; and
modifying access, by one or more of a plurality of users, to one or more of the plurality of assets associated with the detected anomalous behavior.
15. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform steps of:
16. The computer program product of claim 15 wherein generating the second modality information for the time series diagnostic data comprises:
17. The computer program product of claim 15 wherein a given interdependent pair of the plurality of features comprises a first one of the plurality of features and a second one of the plurality of features, and wherein feature deltas for the given interdependent pair of the plurality of features characterizes relative differences between the first feature and the second feature across the plurality of time periods.
18. A method comprising:
initiating at least one remedial action in the information technology infrastructure responsive to detecting an anomalous behavior pattern in the time series diagnostic data;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
19. The method of claim 18 wherein generating the second modality information for the time series diagnostic data comprises:
20. The method of claim 18 wherein a given interdependent pair of the plurality of features comprises a first one of the plurality of features and a second one of the plurality of features, and wherein feature deltas for the given interdependent pair of the plurality of features characterizes relative differences between the first feature and the second feature across the plurality of time periods.
US16/877,631 2020-05-19 2020-05-19 Detecting behavior patterns utilizing machine learning model trained with multi-modal time series analysis of diagnostic data Pending US20210365762A1 (en)
US16/877,631 US20210365762A1 (en) 2020-05-19 2020-05-19 Detecting behavior patterns utilizing machine learning model trained with multi-modal time series analysis of diagnostic data
US20210365762A1 true US20210365762A1 (en) 2021-11-25
US16/877,631 Pending US20210365762A1 (en) 2020-05-19 2020-05-19 Detecting behavior patterns utilizing machine learning model trained with multi-modal time series analysis of diagnostic data
US (1) US20210365762A1 (en)
2020-05-19 US US16/877,631 patent/US20210365762A1/en active Pending
US10262145B2 (en) 2019-04-16 Systems and methods for security and risk assessment and testing of applications
US11023325B2 (en) 2021-06-01 Resolving and preventing computer system failures caused by changes to the installed software
US10592666B2 (en) 2020-03-17 Detecting anomalous entities
Pannu et al. 2012 A self-evolving anomaly detection framework for developing highly dependable utility clouds
Fu et al. 2012 A hybrid anomaly detection framework in cloud computing using one-class and two-class support vector machines
Duenas et al. 2018 Applying event stream processing to network online failure prediction
US10372572B1 (en) 2019-08-06 Prediction model testing framework
US9860109B2 (en) 2018-01-02 Automatic alert generation
US20150120921A1 (en) 2015-04-30 Techniques for workload toxic mapping
US20200364595A1 (en) 2020-11-19 Configuration assessment based on inventory
US20210365762A1 (en) 2021-11-25 Detecting behavior patterns utilizing machine learning model trained with multi-modal time series analysis of diagnostic data
US20200372367A1 (en) 2020-11-26 Cognitive methods and systems for responding to computing system incidents
US10938847B2 (en) 2021-03-02 Automated determination of relative asset importance in an enterprise system
US10929258B1 (en) 2021-02-23 Method and system for model-based event-driven anomalous behavior detection
US20160379134A1 (en) 2016-12-29 Cluster based desktop management services
US11169905B2 (en) 2021-11-09 Testing an online system for service oriented architecture (SOA) services
US20180060987A1 (en) 2018-03-01 Identification of abnormal behavior in human activity based on internet of things collected data
US20210124661A1 (en) 2021-04-29 Diagnosing and remediating errors using visual error signatures
US11115428B2 (en) 2021-09-07 Systems and methods for determining network data quality and identifying anomalous network behavior
Song et al. 2014 Scalable data analytics platform for enterprise backup management
US11212162B2 (en) 2021-12-28 Bayesian-based event grouping
US10809936B1 (en) 2020-10-20 Utilizing machine learning to detect events impacting performance of workloads running on storage systems
EP3889777A1 (en) 2021-10-06 System and method for automating fault detection in multi-tenant environments
US20210136098A1 (en) 2021-05-06 Root cause analysis in multivariate unsupervised anomaly detection
US20210319348A1 (en) 2021-10-14 Artificial Intelligence Techniques for Prediction of Data Protection Operation Duration
2020-05-19 AS Assignment
Owner name: DELL PRODUCTS L.P., TEXAS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:RAFEY, MOHAMMAD;REEL/FRAME:052696/0728
Effective date: 20200425
Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, NORTH CAROLINA
Free format text: SECURITY AGREEMENT;ASSIGNORS:DELL PRODUCTS L.P.;EMC IP HOLDING COMPANY LLC;REEL/FRAME:053531/0108
Owner name: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT, TEXAS
Free format text: SECURITY INTEREST;ASSIGNORS:DELL PRODUCTS L.P.;EMC IP HOLDING COMPANY LLC;REEL/FRAME:053578/0183
2021-08-20 STPP Information on status: patent application and granting procedure in general
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION
Owner name: EMC IP HOLDING COMPANY LLC, TEXAS
Free format text: RELEASE OF SECURITY INTEREST AT REEL 053531 FRAME 0108;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:058001/0371