EFFICIENT TRAINING OF MACHINE LEARNING MODELS FOR LOG RECORD ANALYSIS

1 . A computer program product, the computer program product being tangibly embodied on a non-transitory computer-readable storage medium and comprising instructions that, when executed by at least one computing device, are configured to cause the at least one computing device to:

receive a plurality of log records characterizing operations occurring within a technology landscape;

cluster the plurality of log records into at least a first cluster of log records and a second cluster of log records, using at least one similarity algorithm;

identify a first dissimilar subset of log records within the first cluster of log records, using the at least one similarity algorithm;

identify a second dissimilar subset of log records within the second cluster of log records, using the at least one similarity algorithm; and

train at least one machine learning model to process new log records characterizing the operations occurring within the technology landscape, using the first dissimilar subset and the second dissimilar subset.

2 . The computer program product of claim 1 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

select a first cluster seed log record from the plurality of log records;

determine a similarity score between the first cluster seed log record and a first compared log record, using the at least one similarity algorithm; and

add the first compared log record to the first cluster when the similarity score is at or above a similarity score threshold.

3 . The computer program product of claim 1 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

select a first cluster seed log record from the plurality of log records;

determine a first similarity score between the first cluster seed log record and a first compared log record, using the at least one similarity algorithm; and

designate the first compared log record as a second cluster seed log record for the second cluster when the first similarity score is below a similarity score threshold.

4 . The computer program product of claim 3 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

add a second compared log record to the second cluster when a second similarity score between the second compared log record and the second cluster seed log record is at or above the similarity score threshold.

5 . The computer program product of claim 1 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

identify first similarity scores between a cluster seed log record of the first cluster and each remaining log record of the first cluster;

identify a lowest similarity score of the first similarity scores; and

include a first dissimilar log record having the lowest similarity score in the first dissimilar subset.

6 . The computer program product of claim 5 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

identify second similarity scores between the first dissimilar log record and each remaining log record of the first cluster;

calculate average similarity scores for remaining log record with respect to the cluster seed log record and the first dissimilar log record, using the first similarity scores and the second similarity scores; and

select a second dissimilar log record to include in the first dissimilar subset, the second dissimilar log record having a lowest average similarity score of the average similarity scores.

7 . The computer program product of claim 1 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

train at least one reference machine learning model using the plurality of log records; and

designate a size of each of the first dissimilar subset and the second dissimilar subset based on a comparison of accuracy of the at least one machine learning model and the at least one reference machine learning model.

8 . The computer program product of claim 1 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

process the new log records using the at least one machine learning model to detect at least one anomaly in the technology landscape.

9 . The computer program product of claim 1 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

retrieve, following the training, at least one additional log record; and

replace at least one log record in the first cluster of log records with the at least one additional record.

10 . The computer program product of claim 1 , wherein the instructions, when executed, are further configured to cause the at least one computing device to:

retrieve, following the training, at least one additional log record; and

replace at least one log record in the first dissimilar subset with the at least one additional record.

11 . A computer-implemented method, the method comprising:

receiving a plurality of log records characterizing operations occurring within a technology landscape;

clustering the plurality of log records into at least a first cluster of log records and a second cluster of log records, using at least one similarity algorithm;

identifying a first dissimilar subset of log records within the first cluster of log records, using the at least one similarity algorithm;

identifying a second dissimilar subset of log records within the second cluster of log records, using the at least one similarity algorithm; and

training at least one machine learning model to process new log records characterizing the operations occurring within the technology landscape, using the first dissimilar subset and the second dissimilar subset.

12 . The method of claim 11 , further comprising:

selecting a first cluster seed log record from the plurality of log records;

determining a similarity score between the first cluster seed log record and a first compared log record, using the at least one similarity algorithm; and

adding the first compared log record to the first cluster when the similarity score is at or above a similarity score threshold.

13 . The method of claim 11 , further comprising:

selecting a first cluster seed log record from the plurality of log records;

determining a first similarity score between the first cluster seed log record and a first compared log record, using the at least one similarity algorithm; and

designating the first compared log record as a second cluster seed log record for the second cluster when the first similarity score is below a similarity score threshold.

14 . The method of claim 13 , further comprising:

adding a second compared log record to the second cluster when a second similarity score between the second compared log record and the second cluster seed log record is at or above the similarity score threshold.

15 . The method of claim 11 , further comprising:

identifying first similarity scores between a cluster seed log record of the first cluster and each remaining log record of the first cluster;

identifying a lowest similarity score of the first similarity scores; and

including a first dissimilar log record having the lowest similarity score in the first dissimilar subset.

16 . The method of claim 15 , further comprising:

identifying second similarity scores between the first dissimilar log record and each remaining log record of the first cluster;

calculating average similarity scores for remaining log record with respect to the cluster seed log record and the first dissimilar log record, using the first similarity scores and the second similarity scores; and

selecting a second dissimilar log record to include in the first dissimilar subset, the second dissimilar log record having a lowest average similarity score of the average similarity scores.

17 . The method of claim 11 , further comprising:

training at least one reference machine learning model using the plurality of log records; and

designating a size of each of the first dissimilar subset and the second dissimilar subset based on a comparison of accuracy of the at least one machine learning model and the at least one reference machine learning model.

18 . A system comprising:

at least one memory including instructions; and

at least one processor that is operably coupled to the at least one memory and that is arranged and configured to execute instructions that, when executed, cause the at least one processor to:

receive a plurality of log records characterizing operations occurring within a technology landscape;

cluster the plurality of log records into at least a first cluster of log records and a second cluster of log records, using at least one similarity algorithm;

identify a first dissimilar subset of log records within the first cluster of log records, using the at least one similarity algorithm;

identify a second dissimilar subset of log records within the second cluster of log records, using the at least one similarity algorithm; and

train at least one machine learning model to process new log records characterizing the operations occurring within the technology landscape, using the first dissimilar subset and the second dissimilar subset.

19 . The system of claim 18 , wherein the instructions, when executed, are further configured to cause the at least one processor to:

select a first cluster seed log record from the plurality of log records;

determine a similarity score between the first cluster seed log record and a first compared log record, using the at least one similarity algorithm; and

add the first compared log record to the first cluster when the similarity score is at or above a similarity score threshold.

20 . The system of claim 18 , wherein the instructions, when executed, are further configured to cause the at least one processor to:

identify first similarity scores between a cluster seed log record of the first cluster and each remaining log record of the first cluster; and

identify a lowest similarity score of the first similarity scores; and

include a first dissimilar log record having the lowest similarity score in the first dissimilar subset.