System and methods for risk assessment in a multi-tenant cloud environment

1. A method of reducing incidents in a future time window in a computing environment that implements a multi-tenant cloud environment, the method comprising:

capturing, by a processor in the computing environment, a plurality of data metrics relating to the multi-tenant cloud environment;

automatically generating, by the processor, derived features from the plurality of data metrics, the derived features including one or more features that describe temporal patterns of one or more data metrics and their compounding effect over time;

automatically selecting, by the processor, relevant features from the derived features and the captured data metrics, the selected relevant features being sufficient to explain temporal variations of a potential incident occurrence that is to be predicted;

automatically training, by the processor, an incident risk assessment model using machine learning techniques with a portion of the selected relevant features;

automatically testing and evaluating, by the processor, the incident risk assessment model with another portion of the selected relevant features, the incident risk assessment model being trained to predict the risk of a potential incident in the multi-tenant cloud environment within a specified time window in the future, provide an explanation of possible root causes of the potential incident, and assign a strength level to each possible root cause;

receiving, by the processor, human feedback for adjusting the trained incident risk assessment model;

improving, by the processor, the trained incident risk assessment model based on the human feedback by improving data or labels used to train the incident risk assessment model;

capturing, by the processor, a plurality of newly captured data metrics;

automatically generating, by the processor, newly derived features from the plurality of newly captured data metrics, the newly derived features including one or more features that describe the temporal patterns of one or more newly captured data metrics and their compounding effect over time;

automatically selecting, by the processor, newly selected risk assessment features from the newly derived features and the newly captured data metrics;

applying, by the processor, the newly selected risk assessment features as inputs to the trained incident risk assessment model;

providing, by the processor, an output from the trained incident risk assessment model for use by a multi-tenant service provider that predicts the risk of a predicted incident in the multi-tenant cloud environment within a specified time window in the future and one or more possible root causes of the predicted incident; and

performing, by the multi-tenant service provider, one or more of predictive maintenance, root cause triaging, or proactive resource allocation in the multi-tenant cloud environment based on the output to prevent, reduce a likelihood of, recover more quickly from, or reduce the effect of the predicted incident.

2. The method of claim 1 , further comprising: assigning a strength level to each possible root cause by applying the newly selected risk assessment features to the trained incident risk assessment model.

3. The method of claim 1 , wherein the capturing a plurality of data metrics relating to the multi-tenant cloud environment comprises capturing a plurality of data metrics relating to an infrastructure area, a business area, and a product area associated with the multi-tenant cloud environment.

4. The method of claim 3 , wherein the plurality of data metrics relating to the infrastructure area include data metrics relating to the infrastructure of the multi-tenant cloud environment, the plurality of data metrics relating to the business area include data metrics relating to client use of the multi-tenant cloud environment, and the plurality of data metrics in the product area relating to the product area include data metrics relating to product development in the multi-tenant cloud environment.

5. The method of claim 4 , wherein the automatically generating derived features from the plurality of data metrics comprises automatically generating derived features from the plurality of data metrics relating to the infrastructure area, the business area, and the product area.

6. The method of claim 5 , wherein the capturing a plurality of newly captured data metrics comprises capturing a plurality of newly captured data metrics relating to the infrastructure area, the business area, and the product area.

7. The method of claim 6 , wherein the automatically generating newly derived features from the plurality of newly captured data metrics comprises automatically generating newly derived features from the plurality of newly captured data metrics relating to the infrastructure area, the business area, and the product area.

8. A computing environment that implements a multi-tenant cloud environment, the computing environment comprising one or more processors configured by programming instructions on non-transitory computer readable media, the computing environment configured by the programming instruction to:

capture a plurality of data metrics relating to the multi-tenant cloud environment;

automatically generate derived features from the plurality of data metrics, the derived features including one or more features that describe temporal patterns of one or more data metrics and their compounding effect over time;

automatically select relevant features from the derived features and the captured data metrics, the selected relevant features being sufficient to explain temporal variations of a potential incident occurrence that is to be predicted;

automatically train an incident risk assessment model using machine learning techniques with a portion of the selected relevant features;

test and evaluate the incident risk assessment model with another portion of the selected relevant features, the incident risk assessment model being trained to predict the risk of a potential incident in the multi-tenant cloud environment within a specified time window in the future, provide an explanation of possible root causes of the potential incident, and assign a strength level to each possible root cause;

receive human feedback for adjusting the trained incident risk assessment model;

improve the trained incident risk assessment model based on the human feedback by improving data or labels used to train the incident risk assessment model;

capture a plurality of newly captured data metrics;

automatically generate newly derived features from the plurality of newly captured data metrics, the newly derived features including one or more features that describe the temporal patterns of one or more newly captured data metrics and their compounding effect over time;

automatically select newly selected risk assessment features from the newly derived features and the newly captured data metrics;

apply the newly selected risk assessment features as inputs to the trained incident risk assessment model; and

provide an output from the trained incident risk assessment model for use by a multi-tenant service provider that predicts the risk of a predicted incident in the multi-tenant cloud environment within a specified time window in the future and one or more possible root causes of the predicted incident;

wherein the multi-tenant service provider performs one or more of predictive maintenance, root cause triaging, or proactive resource allocation in the multi-tenant cloud environment based on the output.

9. The system of claim 8 , further configured to: assign a strength level to each possible root cause by applying the newly selected risk assessment features to the trained incident risk assessment model.

10. The system of claim 8 , wherein the system is configured to capture a plurality of data metrics relating to the multi-tenant cloud environment by capturing a plurality of data metrics relating to an infrastructure area, a business area, and a product area associated with the multi-tenant cloud environment.

11. The system of claim 10 , wherein the plurality of data metrics relating to the infrastructure area include data metrics relating to the infrastructure of the multi-tenant cloud environment, the plurality of data metrics relating to the business area include data metrics relating to client use of the multi-tenant cloud environment, and the plurality of data metrics in the product area relating to the product area include data metrics relating to product development in the multi-tenant cloud environment.

12. The system of claim 11 , wherein the system is configured to automatically generate derived features from the plurality of data metrics by automatically generating derived features from the plurality of data metrics relating to the infrastructure area, the business area, and the product area.

13. The system of claim 12 , wherein the system is configured to capture a plurality of newly captured data metrics by capturing a plurality of newly captured data metrics relating to the infrastructure area, the business area, and the product area.

14. The system of claim 13 , wherein the system is configured to automatically generate newly derived features from the plurality of newly captured data metrics by automatically generating newly derived features from the plurality of newly captured data metrics relating to the infrastructure area, the business area, and the product area.

15. A method of reducing incidents in a future time window in a computing environment that implements a multi-tenant cloud environment, the method comprising:

capturing, by a processor in the computing environment, a plurality of newly captured data metrics;

automatically generating, by the processor, newly derived features from the plurality of newly captured data metrics, the newly derived features including one or more features that describe temporal patterns of one or more newly captured data metrics and their compounding effect over time;

automatically selecting, by the processor, newly selected risk assessment features from the newly derived features and the newly captured data metrics;

applying, by the processor, the newly selected risk assessment features as inputs to a trained incident risk assessment model, the trained incident risk assessment model having been trained using a method comprising:

capturing, by the processor, a plurality of data metrics relating to the multi-tenant cloud environment;

automatically generating, by the processor, derived features from the plurality of data metrics, the derived features including one or more features that describe the temporal patterns of one or more data metrics and their compounding effect over time;

automatically selecting, by the processor, relevant features from the derived features and the captured data metrics, the selected relevant features being sufficient to explain temporal variations of an incident occurrence that is to be predicted;

automatically training, by the processor, an incident risk assessment model using machine learning techniques with a portion of the selected relevant features; and

automatically testing and evaluating, by the processor, the incident risk assessment model with another portion of the selected relevant features, the incident risk assessment model being trained to predict the risk of an incident in the multi-tenant cloud environment within a specified time window in the future, provide an explanation of possible root causes of the incident, and assign a strength level to each possible root cause;

receiving, by the processor, human feedback for adjusting the trained incident risk assessment model;

improving, by the processor, the trained incident risk assessment model based on the human feedback by improving data or labels used to train the incident risk assessment model;

providing an output from the trained incident risk assessment model, by the processor, for use by a multi-tenant service provider, that predicts the risk of a predicted incident in the multi-tenant cloud environment within a specified time window in the future and one or more possible root causes of the predicted incident; and

performing, by the multi-tenant service provider, one or more of predictive maintenance, root cause triaging, or proactive resource allocation in the multi-tenant cloud environment based on the output to prevent, reduce a likelihood of, recover more quickly from, or reduce the effect of the predicted incident.

16. The method of claim 15 , further comprising: assigning, by the processor, a strength level to each possible root cause by applying the newly selected risk assessment features to the trained incident risk assessment model.

17. The method of claim 15 , wherein the capturing a plurality of data metrics relating to the multi-tenant cloud environment comprises capturing a plurality of data metrics relating to an infrastructure area, a business area, and a product area associated with the multi-tenant cloud environment.

18. The method of claim 17 , wherein the plurality of data metrics relating to the infrastructure area include data metrics relating to the infrastructure of the multi-tenant cloud environment, the plurality of data metrics relating to the business area include data metrics relating to client use of the multi-tenant cloud environment, and the plurality of data metrics in the product area relating to the product area include data metrics relating to product development in the multi-tenant cloud environment.

19. The method of claim 18 , wherein the automatically generating derived features from the plurality of data metrics comprises automatically generating derived features from the plurality of data metrics relating to the infrastructure area, the business area, and the product area.

20. The method of claim 19 , wherein:

the capturing a plurality of newly captured data metrics comprises capturing a plurality of newly captured data metrics relating to the infrastructure area, the business area, and the product area; and

the automatically generating newly derived features from the plurality of newly captured data metrics comprises automatically generating newly derived features from the plurality of newly captured data metrics relating to the infrastructure area, the business area, and the product area.