Oracle International Corporation

Intel Corporation

Andrew Brownsword

Felix Schmidt

Nipun Agarwal

Craig Schelp

Guy Lewis Steele, Jr

Matteo Casserini

David Lawrence Rager

Saeid Allahdadian

Onur Kocberber

Guang-Tong Zhou

Manel Fernandez Gomez

Milos Vasic

Hossein Hajimirsadeghi

Juan Fernandez Peinador

Rod Reddekopp

Kenny C Gross

Kalyanaraman Vaidyanathan

Stuart Wray

Amin Suzani

Pavan Chandrashekar

Aaron R Kunze

John Patrick Connelly

Tayler Hetherington

Karoon Rashedi Nia

Matthew Perry Abrams

Pravin Shinde

Hamed Ahmadi

Ron Nordan

Akhilesh Singhania

Robert Otto Barnes, Ii

Dillon Sharlet

Rahul Dilip Jagad

Herein are machine learning techniques that adjust reconstruction loss of a reconstructive model such as an autoencoder based on importances of values of features. In an embodiment and before, during, or after training, the reconstructive model that more or less accurately reconstructs its input, a computer measures, for each distinct value of each feature, a respective importance that is not based on the reconstructive model. For example, importance may be based solely on a training corpus. For each feature during or after training, a respective original loss from the reconstructive model measures a difference between a value of the feature in an input and a reconstructed value of the feature generated by the reconstructive model. For each feature, the respective importance of the input value of the feature is applied to the respective original loss to generate a respective weighted loss. The weighted losses of the features of the input are collectively detected as anomalous or non-anomalous.

Balancing feature distributions using an importance factor

Disclosed are techniques for processing user profiles using data structures that are specialized for processing by a GPU. More particularly, the disclosed techniques relate to systems and methods for evaluating characteristics of user profiles to determine whether to offload certain user profiles to the GPU for processing or to process the user profiles locally by one or more central processing units (CPUs). Processing user profiles may include comparing the interest tags included in the user profiles with logic trees, for example, logic trees representing marketing campaigns, to identify user profiles that match the campaigns.

Enhanced processing of user profiles using data structures specialized for graphical processing units (GPUs)

Techniques for implementing a semi-supervised framework for purpose-oriented anomaly detection are provided. In one technique, a data item in inputted into an unsupervised anomaly detection model, which generates first output. Based on the first output, it is determined whether the data item represents an anomaly. In response to determining that the data item represents an anomaly, the data item is inputted into a supervised classification model, which generates second output that indicates whether the data item is unknown. In response to determining that the data item is unknown, a training instance is generated based on the data item. The supervised classification model is updated based on the training instance.

Semi-supervised framework for purpose-oriented anomaly detection

Techniques are provided for sparse ensembling of unsupervised machine learning models. In an embodiment, the proposed architecture is composed of multiple unsupervised machine learning models that each produce a score as output and a gating network that analyzes the inputs and outputs of the unsupervised machine learning models to select an optimal ensemble of unsupervised machine learning models. The gating network is trained to choose a minimal number of the multiple unsupervised machine learning models whose scores are combined to create a final score that matches or closely resembles a final score that is computed using all the scores of the multiple unsupervised machine learning models.

Sparse ensembling of unsupervised models

Herein are feature extraction mechanisms that receive parsed log messages as inputs and transform them into numerical feature vectors for machine learning models (MLMs). In an embodiment, a computer extracts fields from a log message. Each field specifies a name, a text value, and a type. For each field, a field transformer for the field is dynamically selected based the field's name and/or the field's type. The field transformer converts the field's text value into a value of the field's type. A feature encoder for the value of the field's type is dynamically selected based on the field's type and/or a range of the field's values that occur in a training corpus of an MLM. From the feature encoder, an encoding of the value of the field's typed is stored into a feature vector. Based on the MLM and the feature vector, the log message is detected as anomalous.

Multi-stage feature extraction for effective ML-based anomaly detection on structured log data

Techniques are provided herein for contextual embedding of features of operational logs or network traffic for anomaly detection based on sequence prediction. In an embodiment, a computer has a predictive recurrent neural network (RNN) that detects an anomalous network flow. In an embodiment, an RNN contextually transcodes sparse feature vectors that represent log messages into dense feature vectors that may be predictive or used to generate predictive vectors. In an embodiment, graph embedding improves feature embedding of log traces. In an embodiment, a computer detects and feature-encodes independent traces from related log messages. These techniques may detect malicious activity by anomaly analysis of context-aware feature embeddings of network packet flows, log messages, and/or log traces.

Malicious activity detection by cross-trace analysis and deep learning

Techniques are described herein for estimating CPU, memory, and I/O utilization for a workload via out-of-band sensor readings using a machine learning model. The framework involves receiving sensor data associated with executing benchmark applications, obtaining ground truth utilization values for the benchmarks, preprocessing the training data to select a set of enhanced sequences, and using the enhanced sequences to train a random forest model to estimate CPU, memory, and I/O utilization given sensor monitoring data. Prior to the training phase, a machine learning model is trained using a set of predefined hyper-parameters. The trained models are used to generate estimations for CPU, memory, and I/O utilizations values. The utilization values are used with workload context information to assess the deployment and generate one or more recommendations for machine types that will best serve the workload in terms of system utilization.

Out of band server utilization estimation and server workload characterization for datacenter resource optimization and forecasting

Herein are techniques for training a parser by categorizing and generalizing messages and abstracting message templates for parsing after training. In an embodiment, a computer generates a message signature based on a message sequence of tokens that were extracted from a training message. The message signature is matched to a cluster signature that represents messages of one of many clusters that have distinct signatures. The training message is added to the cluster. Based on a data type of the cluster signature, a value is extracted from a second message, such as a live message after training. Fuzzy signatures may be probabilistically matched to select a best matching cluster for a message. The value range of a token may be broadened or narrowed by adding or removing candidate data types, by adding or removing literals to a data type, and/or by promoting a narrow data type to a broader data type.

Parsing of unstructured log data into structured data and creation of schema

Context-aware feature embedding and anomaly detection of sequential log data using deep recurrent neural networks

The disclosed embodiments relate to a technique for training a prognostic pattern-recognition system to detect incipient anomalies that arise during execution of a computer system. During operation, the system gathers and stores telemetry data obtained from n sensors in the computer system during operation of the computer system. Next, the system uses the telemetry data gathered from the n sensors to train a baseline model for the prognostic pattern-recognition system. The prognostic pattern-recognition system then uses the baseline model in a surveillance mode to detect incipient anomalies that arise during execution of the computer system. The system also uses the stored telemetry data to train a set of additional models, wherein each additional model is trained to operate with one or more missing sensors. Finally, the system stores the additional models to be used in place of the baseline model when one or more sensors fail in the computer system.

Robust training technique to facilitate prognostic pattern recognition for enterprise computer systems

Herein are techniques for analysis of data streams. In an embodiment, a computer associates each software actor with data streams. Each software actor has its own backlog queue of data to analyze. In response to receiving some stream content and based on the received stream content, data is distributed to some software actors. In response to determining that the data satisfies completeness criteria of a particular software actor, an indication of the data is appended onto the backlog queue of the particular software actor. The particular software actor is reset to an initial state by loading an execution snapshot of a previous initial execution of an embedded virtual machine. Based on the particular software actor, execution of the execution snapshot of the previous initial execution is resumed to dequeue and process the indication of the data from the backlog queue of the particular software actor to generate a result.

Engine for reactive execution of massively concurrent heterogeneous accelerated scripted streaming analyses

Growing community of inventors

Bowen Island, Canada

Andrew Brownsword