Fully unsupervised pipeline for clustering anomalies detected in computerized systems
The invention is notably directed to a computer-implemented method of clustering anomalies detected in a computerized system. The proposed method makes use of an unsupervised cognitive model, executed based on input datasets to obtain clusters of anomalies. The method accesses input datasets, which correspond to detected anomalies of the computerized system. These anomalies span respective time windows. Each input dataset comprises a set of timeseries of key performance indicators. The key performance indicators of each input dataset extend over a respective time window. That is, each anomaly corresponds to a respective time window. This model includes a first stage, which includes an encoder designed to learn fixed-size representations of input datasets, and a second stage, which is a clustering stage. The model is executed based on the input datasets accessed, the first stage learning fixed-size representations of the input datasets and the second stage clustering the learned representations.
1 . A computer-implemented method of clustering anomalies detected in a computerized system, wherein the method comprises:
accessing input datasets corresponding to detected anomalies of the computerized system, wherein the anomalies span respective time windows and each of the corresponding input datasets comprises a set of timeseries of key performance indicators extending over a respective one of the time windows;
loading an unsupervised cognitive model, wherein the model includes a first stage and a second stage, wherein the first stage includes an encoder designed to learn fixed-size representations of given datasets and the second stage is a clustering stage, wherein the unsupervised cognitive model is trained in an iterative and alternate manner, based on a combined loss functions, using an early stopping strategy, wherein the model is established by combining a stacked dilated causal convolutional neural network (CNN) encoder-only architecture with a composed loss function with cosine similarity-based negative sampling and the iterative training; and
executing the unsupervised cognitive model based on the input datasets accessed for the first stage to learn fixed-size representations of the input datasets and the second stage to cluster the learned representations, to obtain clusters of anomalies.
2 . The method according to claim 1 , wherein:
the unsupervised cognitive model is executed using a composed loss function combining a first loss function and a second loss function; and
the first loss function and the second loss function are respectively designed for optimizing the representations and the clusters.
3 . The method according to claim 2 , wherein:
the first loss function is designed as a triplet loss function ensuring that the representation learned for a reference portion of each dataset of the input datasets is, on average, closer to the representations learned for distinct portions of said each dataset than to the representations learned for other portions of other ones of the input datasets, wherein each of the reference portion, the distinct portions, and the other portions, corresponds to a respective time segment.
4 . The method according to claim 2 , wherein:
the unsupervised cognitive model is executed by alternately executing the first stage and the second stage, iteratively, with an objective to decrease the composed loss function, such that the representations learned, and the clusters obtained are alternately optimized through several iterations.
5 . The method according to claim 4 , wherein:
the unsupervised cognitive model is executed so as to achieve predefined structural properties of the clusters.
6 . The method according to claim 5 , wherein:
the predefined structural properties are achieved based on silhouette scores of the clusters.
7 . The method according to claim 6 , wherein each of said iterations comprises:
at the first stage:
obtaining representations of the input datasets; and
computing a first loss with the first loss function, based on the representations obtained;
at the second stage:
running a k-means algorithm based on the previously obtained representations;
optimizing a number of clusters based on the silhouette scores obtained for the clusters;
computing a second loss with the second loss function; and
computing a current composed loss based on the first loss and the second loss; and
deciding whether to stop the training by comparing the current composed loss with a previous composed loss, as obtained during a previous one of the iterations.
8 . The method according to claim 1 , wherein:
the encoder is configured as an exponentially dilated, causal convolutional neural network.
9 . The method according to claim 8 , wherein:
the unsupervised cognitive model is designed as a single network, and
the second stage is implemented by outer neural layers of the cognitive model, the outer neural layers connected in output of the first stage.
10 . The method according to claim 9 , wherein:
the first stage includes at least two convolution blocks; and
each of the at least two convolution blocks comprises one or more dilated causal convolutional layers.
11 . The method according to claim 10 , wherein:
the first stage further includes a hierarchy of neural layers arranged in output of each of the dilated causal convolutional layers.
12 . The method according to claim 11 , wherein:
the hierarchy of neural layers includes a weight normalization layer and an activation layer.
13 . The method according to claim 12 , wherein:
the activation layer is a leaky rectified linear unit.
14 . The method according to claim 12 , wherein:
the first stage further comprises a global max pooling layer arranged in an output of the at least two convolution blocks.
15 . The method according to claim 14 , wherein:
the first stage further comprises a linear transformation layer in an output of the global max pooling layer.
16 . The method according to claim 1 , wherein the method further comprises:
identifying types of anomalies corresponding to each of the clusters obtained.
17 . The method according to claim 1 , wherein:
the method further comprises, prior to accessing the input datasets and executing the unsupervised cognitive model, monitoring the computerized system to detect said anomalies.
18 . A computer program for clustering anomalies detected in a computerized system, the computer program product comprising:
one or more computer-readable tangible storage media and program instructions stored on at least one of the one or more tangible storage media, the program instructions executable by a processor capable of performing a method, the method comprising:
accessing input datasets corresponding to detected anomalies of the computerized system, wherein the anomalies span respective time windows and each of the corresponding input datasets comprises a set of timeseries of key performance indicators extending over a respective one of the time windows;
loading an unsupervised cognitive model, wherein the model includes a first stage and a second stage, wherein the first stage includes an encoder designed to learn fixed-size representations of given datasets and the second stage is a clustering stage, wherein the unsupervised cognitive model is trained in an iterative and alternate manner, based on a combined loss functions, using an early stopping strategy, wherein the model is established by combining a stacked dilated causal convolutional neural network (CNN) encoder-only architecture with a composed loss function with cosine similarity-based negative sampling and the iterative training; and
executing the unsupervised cognitive model based on the input datasets accessed for the first stage to learn fixed-size representations of the input datasets and the second stage to cluster the learned representations, to obtain clusters of anomalies.
19 . The computer program according to claim 18 , wherein:
the unsupervised cognitive model involves a composed loss function combining a first loss function and a second loss function, wherein the first loss function and the second loss function are designed for optimizing the representations and the clusters, respectively, and,
in operation, executing the first stage and the second stage, iteratively, to decrease the composed loss function.
20 . The computer program according to claim 18 , wherein:
the first loss function is designed as a triplet loss function ensuring that the representation learned for a reference portion of each dataset of the input datasets is, on average, closer to the representations learned for distinct portions of said each dataset than to the representations learned for other portions of other ones of the input datasets, wherein each of the reference portion, the distinct portions, and the other portions, corresponds to a respective time segment.