Behavioral rules discovery for intelligent computing environment administration
View Patent ↗A management system for determining causal relationships among system entities may include a causal relationship detector configured to receive events from a computing environment having a plurality of entities, and detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events, and a rules converter configured to convert one or more of the causal relationships into at least one behavioral rule. The at least one behavioral rule may indicate a causal relationship between at least two entities of the plurality of entities.
1. A management system for determining causal relationships among system entities, the management system comprising:
at least one processor;
a non-transitory computer-readable storage medium including instructions executable by the at least one processor, the instructions configured to implement,
a discoverer configured to periodically start a causal relationship analysis,
a causal relationship detector configured to receive events from a computing environment having a plurality of entities upon start of the causal relationship analysis,
the causal relationship detector configured to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events;
a rules converter configured to convert one or more of the causal relationships into at least one behavioral rule, the at least one behavioral rule indicating a causal relationship between at least two entities including a first entity and a second entity; and
a rule implementer configured to receive performance metrics from the first entity and to apply the performance metrics to the at least one behavioral rule, wherein, when the performance metrics satisfies a condition specified by the at least one behavioral rule, the rule implementer is configured to initiate implementation of an action to alleviate an effect on the computing environment produced by the second entity causally linked to the first entity.
2. The management system of claim 1 , wherein the causal relationship detector includes:
a graph generator configured to generate one or more graphs based on the events, each graph including vertices and arcs connecting temporally adjacent vertices, each vertex representing an event instance of one or more events, and each arc representing a level of causal connectivity between at least two vertices,
wherein the causal relationship detector is configured to detect the causal relationships based on the one or more graphs, wherein at least two connected vertices represents the causal relationship between a set of entities.
3. The management system of claim 1 , wherein the causal relationship detector is configured to detect the causal relationships without using an existing relationship model.
4. The management system of claim 1 , wherein the causal relationship detector includes a graph generator configured to generate a graph based on the events, the graph generator including:
a vertex classifier configured to create vertices based on an initial set of events including a first vertex, a second vertex, and a third vertex, the vertex classifier further configured to arrange the first vertex, the second vertex, and the third vertex in chronological order; and
an arc classifier configured to create arcs between temporally adjacent vertices including a first arc connected between the first vertex and the second vertex and a second arc connected between the second vertex and the third vertex,
wherein the arc classifier is configured to annotate each arc with a coefficient value representing a level of connectivity between the temporally adjacent vertices.
5. The management system of claim 4 , wherein the arc classifier is configured to receive a relationship model providing at least one known relationship between the plurality of entities, and the arc classifier is configured to strengthen at least one arc of the graph based on the at least one known relationship.
6. The management system of claim 4 , wherein the graph generator is configured to update the graph based on a secondary set of events, wherein the arc classifier is configured to strengthen or weaken the arcs of the graph based on, in part, a presence or absence of a repeat pattern of vertices associated with the secondary set of events.
7. The management system of claim 6 , wherein each vertex is represented by a string representation, and the arc classifier is configured to analyze the repeat pattern of vertices by searching the graph for a match with a search pattern that includes a concatenation of string representations corresponding to at least two temporally adjacent vertices associated with the secondary set of sets.
8. The management system of claim 6 , wherein each arc is associated with a time limit and the time limit is dependent upon the coefficient value, wherein the causal relationship detector further includes:
a pruner unit configured to remove at least one arc from the graph when the time limit associated with the at least one arc has been exhausted,
wherein the pruner unit is configured to remove at least one vertex when the at least one vertex is not connected to any other vertex.
9. A non-transitory computer-readable medium storing instructions that when executed cause at least one processor to determine causal relationships among system entities, the instructions comprising instructions to:
periodically start a causal relationship analysis;
receive events from a computing environment having a plurality of entities upon start of the causal relationship analysis;
detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events;
convert one or more of the causal relationships into at least one behavioral rule, the at least one behavioral rule indicating a causal relationship between at least two entities including a first entity and a second entity;
receive performance metrics from the first entity;
apply the performance metrics to the at least one behavioral rule; and
when the performance metrics satisfies a condition specified by the at least one behavioral rule, initiate implementation of an action to alleviate an effect on the computing environment produced by the second entity causally linked to the first entity.
10. The non-transitory computer-readable medium of claim 9 , wherein the instructions to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events includes instructions to:
generate one or more graphs based on the events, each graph including vertices and arcs connecting temporally adjacent vertices, each vertex representing an event instance of one or more events, and each arc representing a level of causal connectivity between at least two vertices; and
detect the causal relationships based on the one or more graphs, wherein at least two connected vertices represents the causal relationship between a set of entities.
11. The non-transitory computer-readable medium of claim 9 , further comprising:
receive performance metrics from a first entity of the plurality of entities;
apply the performance metrics to the at least one behavioral rule,
wherein, when the performance metrics satisfies a condition specified by the at least one behavioral rule, determine an action to alleviate an effect on the computing environment produced by a second entity of the plurality of entities,
wherein the action includes adding or reassigning computer resources to at least one of the first entity and the second entity.
12. The non-transitory computer-readable medium of claim 9 , wherein the instructions to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events includes instructions to:
generate a graph including:
create vertices based on an initial set of events including a first vertex, a second vertex, and a third vertex, and arrange the first vertex, the second vertex, and the third vertex in chronological order;
create arcs between temporally adjacent vertices including a first arc connected between the first vertex and the second vertex and a second arc connected between the second vertex and the third vertex; and
annotate each arc with a coefficient value representing a level of connectivity between the temporally adjacent vertices.
13. The non-transitory computer-readable medium of claim 12 , wherein the instructions further include instructions to:
receive a relationship model providing at least one known relationship between the plurality of entities; and
strengthen at least one arc of the graph based on the at least one known relationship.
14. The non-transitory computer-readable medium of claim 12 , wherein the instruction further include instructions to:
update the graph based on a secondary set of events including strengthening or weakening the arcs of the graph based on, in part, a presence or absence of a repeat pattern of vertices associated with the secondary set of events.
15. The non-transitory computer-readable medium of claim 14 , wherein each vertex is represented by a string representation, and the instructions to update the graph include:
analyze the repeat pattern of vertices by searching the graph for a match with a search pattern that includes a concatenation of string representations corresponding to at least two temporally adjacent vertices associated with the secondary set of sets.
16. The non-transitory computer-readable medium of claim 14 , wherein each arc is associated with a time limit and the time limit is dependent upon the coefficient value, wherein the instructions to update the graph include:
remove at least one arc from the graph when the time limit associated with the at least one arc has been exhausted; and
remove at least one vertex when the at least one vertex is not connected to any other vertex.
17. A method for determining causal relationships among system entities, the method comprising:
periodically starting, by at least one processor, a causal relationship analysis;
receiving, by the at least one processor, events from a computing environment having a plurality of entities upon start of the causal relationship analysis;
detecting, by the at least one processor, causal relationships among the plurality of entities, during runtime of the computing environment, based on the events;
converting, by the at least one processor, one or more of the causal relationships into at least one behavioral rule, the at least one behavioral rule indicating a causal relationship between at least two entities including a first entity and a second entity;
receiving, by the at least one processor, performance metrics from the first entity;
applying, by the at least one processor, the performance metrics to the at least one behavioral rule; and
when the performance metrics satisfies a condition specified by the at least one behavioral rule, initiating implementation of an action, by the at least one processor, to alleviate an effect on the computing environment produced by the second entity causally linked to the first entity a second entity of the plurality of entities.
18. The method of claim 17 , wherein the detecting, by the at least one processor, causal relationships among the plurality of entities, during runtime of the computing environment, based on the events includes:
generating one or more graphs based on the events, each graph including vertices and arcs connecting temporally adjacent vertices, each vertex representing an event instance of one or more events, and each arc representing a level of causal connectivity between at least two vertices; and
detecting the causal relationships based on the one or more graphs, wherein at least two connected vertices represents a causal relationship between a set of entities.
19. The method of claim 18 , wherein the event instance includes a creation of the one or more events, a closure of the one or more events, or an absence of the one or more events where a pattern of appearance has been established.