Adaptive Anomaly Grouping
In one aspect, a machine learning system for performing anomaly grouping is disclosed. The machine learning system includes a processor; a memory; and one or more modules stored in the memory and executable by a processor to perform operations including: receive stack traces associated with corresponding anomaly events; automatically generate initial rules for grouping the anomaly events responsive to the received stack traces; apply the generated initial rules to the anomaly events; receive additional stack traces, user input, or both; update the initial rules based on the received additional stack traces, user input, or both; organize the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules; and provide a user interface to display the one or more groups of anomaly events.
1 . A machine learning system for performing anomaly grouping, the machine learning system including:
a processor;
a memory; and
one or more modules stored in the memory and executable by a processor to perform operations including:
receive stack traces associated with corresponding anomaly events;
automatically generate initial rules for grouping the anomaly events responsive to the received stack traces;
apply the generated initial rules to the anomaly events;
receive additional stack traces, user input, or both;
update the initial rules based on the received additional stack traces, user input, or both;
organize the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules;
and
provide a user interface to display the one or more groups of anomaly events.
2 . The system of claim 1 , wherein the one or more modules are executable by a processor to generate the initial rules including apply weights to properties of the received stack traces.
3 . The system of claim 1 , wherein the one or more modules are executable by a processor to update the initial rules including adjust the weights of the properties of the received stack traces based on the user input.
4 . The system of claim 1 , wherein the one or more modules are executable by a processor to update the initial rules including adjust the weights of the properties of the received stack traces based on the new stack traces.
5 . The system of claim 4 , wherein the one or more modules are executable by a processor to identify new properties based on the new stack traces and apply weights to the new properties.
6 . The system of claim 1 , wherein the one or more modules are executable by a processor to enable users to share the generated initial rules or adjusted rules with each other.
7 . The system of claim 6 , wherein the one or more modules are executable by a processor to update the initial rules including adjust the weights of the properties of the received stack traces based on the shared rules or adjusted rules.
8 . A method for performing machine learned anomaly grouping, the method including:
receiving stack traces associated with corresponding anomaly events;
automatically generating initial rules for grouping the anomaly events responsive to the received stack traces;
applying the generated initial rules to the anomaly events;
receiving additional stack traces, user input, or both;
updating the initial rules based on the received additional stack traces, user input, or both;
organizing the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules; and
providing a user interface to display the one or more groups of anomaly events.
9 . The method of claim 8 , wherein generating the initial rules include applying weights to properties of the received stack traces.
10 . The method of claim 8 , wherein updating the initial rules include adjusting the weights of the properties of the received stack traces based on the user input.
11 . The method of claim 8 , wherein updating the initial rules include adjusting the weights of the properties of the received stack traces based on the new stack traces.
12 . The method of claim 11 , including identifying new properties based on the new stack traces and apply weights to the new properties.
13 . The method of claim 8 , including enabling users to share the generated initial rules or adjusted rules with each other.
14 . The method of claim 13 , wherein updating the initial rules include adjusting the weights of the properties of the received stack traces based on the shared rules or adjusted rules.
15 . A non-transitory computer readable medium embodying instructions when executed by a processor to cause operations to be performed including:
receiving stack traces associated with corresponding anomaly events;
automatically generating initial rules for grouping the anomaly events responsive to the received stack traces;
applying the generated initial rules to the anomaly events;
receiving additional stack traces, user input, or both;
updating the initial rules based on the received additional stack traces, user input, or both;
organizing the anomaly events corresponding to the received stack traces and additional stack traces into one or more groups of anomaly events using the updated rules; and
providing a user interface to display the one or more groups of anomaly events.
16 . The non-transitory computer readable medium of claim 15 , wherein the operations for generating the initial rules include applying weights to properties of the received stack traces.
17 . The non-transitory computer readable medium of claim 15 , wherein the operations for updating the initial rules include adjusting the weights of the properties of the received stack traces based on the user input.
18 . The non-transitory computer readable medium of claim 17 , wherein the operations for updating the initial rules include adjusting the weights of the properties of the received stack traces based on the new stack traces.
19 . The non-transitory computer readable medium of claim 18 , wherein the operations include identifying new properties based on the new stack traces and apply weights to the new properties.
20 . The non-transitory computer readable medium of claim 15 , wherein the operations include enabling users to share the generated initial rules or adjusted rules with each other.