Profile-enriched explanations of data-driven models
In an embodiment, a computer stores, in memory or storage, many explanation profiles, many log entries, and definitions of many features that log entries contain. Some features may contain a logic statement such as a database query, and these are specially aggregated based on similarity. Based on the entity specified by an explanation profile, statistics are materialized for some or all features. Statistics calculation may be based on scheduled batches of log entries or a stream of live log entries. At runtime, an inference that is based on a new log entry is received. Based on an entity specified in the new log entry, a particular explanation profile is dynamically selected. Based on the new log entry and statistics of features for the selected explanation profile, a local explanation of the inference is generated. In an embodiment, an explanation text template is used to generate the local explanation.
1 . A method comprising:
storing:
definitions of a plurality of features, wherein each feature in the plurality of features has a type and
a plurality of explanation profiles, wherein each explanation profile in the plurality of explanation profiles specifies an entity and a feature subset of the plurality of features;
receiving or storing a plurality of log entries, wherein each log entry in the plurality of log entries specifies a time, an entity, and values for the plurality of features;
generating, for each explanation profile in the plurality of explanation profiles, based on the entity of the explanation profile, a respective summary value of each feature of the feature subset of the explanation profile that is based on said type of the feature;
receiving an inference that is based on a new log entry that specifies an entity selected from a group consisting of: a database table, a database column, a logic statement that contains a particular value, and a textual fingerprint that contains a wildcard;
selecting, based on the entity of the new log entry, a particular profile from the plurality of explanation profiles; and
generating, based on the new log entry and said summary values of the feature subset of the particular profile, an explanation of the inference;
wherein the method is performed by one or more computers.
2 . The method of claim 1 wherein the new log entry further specifies a second entity selected from a group consisting of: a user, a role, a group, a geographic region, a software application, and a time range.
3 . The method of claim 1 wherein the entity is a logic statement that is a database statement.
4 . The method of claim 1 further comprising matching the value of a particular feature from the feature subset of the particular profile to the entity, wherein the entity is a particular fingerprint from a plurality of textual fingerprints.
5 . The method of claim 4 further comprising processing the type of the particular feature as a category whose members are the plurality of textual fingerprints.
6 . The method of claim 1 wherein the inference is that the new log entry is anomalous.
7 . The method of claim 1 wherein the new log entry indicates at least one selected from a group consisting of a count of database connections, a new connection to a database, and authentication of a user.
8 . The method of claim 1 wherein said generating the summary value of a particular feature of the feature subset of the particular profile comprises summation of one selected from a group consisting of: bytes received, bytes sent, table rows accessed, and table rows transferred.
9 . The method of claim 1 wherein the summary value of a particular feature of the feature subset of the particular profile comprises at least one selected from a group consisting of a statistical mode, a histogram, skewness, and kurtosis.
10 . The method of claim 1 wherein:
the particular profile specifies an explanation text template;
said generating the explanation of the inference comprises combining the explanation text template, the summary values of the feature subset of the particular profile, and values from the new log entry for the feature subset of the particular profile.
11 . One or more computer-readable non-transitory media storing instructions that, when executed by one or more processors, cause:
storing:
definitions of a plurality of features, wherein each feature in the plurality of features has a type and
a plurality of explanation profiles, wherein each explanation profile in the plurality of explanation profiles specifies an entity and a feature subset of the plurality of features;
receiving or storing a plurality of log entries, wherein each log entry in the plurality of log entries specifies a time, an entity, and values for the plurality of features;
generating, for each explanation profile in the plurality of explanation profiles, based on the entity of the explanation profile, a respective summary value of each feature of the feature subset of the explanation profile that is based on said type of the feature;
receiving an inference that is based on a new log entry that specifies an entity selected from a group consisting of: a database table, a database column, a logic statement that contains a particular value, and a textual fingerprint that contains a wildcard;
selecting, based on the entity of the new log entry, a particular profile from the plurality of explanation profiles; and
generating, based on the new log entry and said summary values of the feature subset of the particular profile, an explanation of the inference.
12 . The one or more computer-readable non-transitory media of claim 11 wherein the new log entry further specifies a second entity selected from a group consisting of: a user, a role, a group, a geographic region, a software application, and a time range.
13 . The one or more computer-readable non-transitory media of claim 11 wherein the entity is a logic statement that is a database statement.
14 . The one or more computer-readable non-transitory media of claim 11 wherein the instructions further cause matching the value of a particular feature from the feature subset of the particular profile to the entity, wherein the entity is a particular fingerprint from a plurality of textual fingerprints.
15 . The one or more computer-readable non-transitory media of claim 14 wherein the instructions further cause processing the type of the particular feature as a category whose members are the plurality of textual fingerprints.
16 . The one or more computer-readable non-transitory media of claim 11 wherein the inference is that the new log entry is anomalous.
17 . The one or more computer-readable non-transitory media of claim 11 wherein the new log entry indicates at least one selected from a group consisting of a count of database connections, a new connection to a database, and authentication of a user.
18 . The one or more computer-readable non-transitory media of claim 11 wherein said generating the summary value of a particular feature of the feature subset of the particular profile comprises summation of one selected from a group consisting of: bytes received, bytes sent, table rows accessed, and table rows transferred.
19 . The one or more computer-readable non-transitory media of claim 11 wherein the summary value of a particular feature of the feature subset of the particular profile comprises at least one selected from a group consisting of a statistical mode, a histogram, skewness, and kurtosis.
20 . The one or more computer-readable non-transitory media of claim 11 wherein:
the particular profile specifies an explanation text template;
said generating the explanation of the inference comprises combining the explanation text template, the summary values of the feature subset of the particular profile, and values from the new log entry for the feature subset of the particular profile.