Splunk Inc.

Cisco Technology, Inc.

Ram Sriharsha

Mohan Rajagopalan

John C Reed

Amir Malekpour

Chinmay Madhav Kulkarni

Abhinav Mishra

Lin Ma

Zhaohui Wang

Kristal Curtis

Iryna Vogler-Ivashchanka

Clark Eugene Mullen

Abraham Starosta

Karthikeyan Ramasamy

Sichen Zhong

Matteo Merli

Giovanni Mola

Xiao Lin

Chandrima Sarkar

Ryan Gannon

Aungon Nag Radon

Harsha Wasalathanthrige Don

Mark Huang

A computer-implemented method is disclosed that includes operations of receiving a request to store a representation of a machine learning (ML) model in a non-transitory computer-readable medium, validating the representation of the ML model, and storing the representation of the ML model. The representation of the ML model may be a computation graph, and further, the computation graph may be a format for representing ML models through a defined common set of operators and a common file format. Validating the representation of the ML model may include verifying an input schema of the representation of the ML model is compatible with an input schema of the ML model. The method may include further operations of deserializing the representation of the ML model, wherein a successful deserialization indicates that the representation of the ML model is valid and secure.

Systems and methods for securing untrusted code

Systems and methods are described for extracting data fields from logs ingested in a data processing pipeline or otherwise stored. For example, a log can be applied as an input to an artificial intelligence model trained to infer a log sourcetype of logs, and the artificial intelligence model can output an inferred log sourcetype of the log. The inferred log sourcetype can be used to select another artificial intelligence model trained to extract data fields from logs having the inferred log sourcetype, and the log can then be applied as an input to the other artificial intelligence model. The other artificial intelligence model may then output one or more data fields extracted from the log.

Data field extraction by a data intake and query system

Systems and methods are described for processing ingested data in an asynchronous manner as the data is being ingested to detect potential anomalies. For example, one or more streaming data processors can convert data as the data is ingested into a comparable data structure, determine whether the comparable data structure should be assigned to an existing data pattern or a new data pattern, and optionally update a characteristic of the data pattern to which the comparable data structure is assigned. The streaming data processor(s) can perform these operations automatically in real-time or in periodic batches. Once one or more comparable data structures have been assigned to one or more data patterns, the streaming data processor(s) can analyze the comparable data structures assigned to a particular data pattern to determine whether any of the comparable data structures appear to be anomalous.

Processing ingested data to identify anomalies

Various implementations of the present application set forth a computer-implemented method comprising obtaining, by a low-power hub device, a first set of data published by an edge device, where the low-power hub device subscribes to at least a subset of data published by the edge device, generating, by the low-power hub device, a second set of data from the first set of data by inputting the first set of data into a machine learning (ML) model executing on the low-power hub device, and transmitting the second set of data to a remote server computer system.

Real-time machine learning at an edge of a distributed network

A method for deployment of machine-learning based operators within a query is described. For this embodiment, a sequence of operators associated with a query is identified, which includes at least a first operator and at least a second operator. The second operator is configured to perform operations, in accordance with a machine learning (ML) component, on data received as input from execution of the first operator. Schemas associated with the machine learning component is retrieved along with schemas associated with other operators within the sequence. Compatibility between at least an output schema associated with the first operator and an input schema associated with the second operator associated with the ML component is determined. Thereafter, a portion of the sequence of operators including at least the second operator and another operator of the sequence of operators successive to the second operator may be stored within a data store for subsequent use.

Systems and methods for auto-deployment of a machine learning component within a pipelined search query

Disclosed herein is a method that supports queries deploying operators based on multiple programming languages at least through determining schema compatibility between neighboring operators within a query. Upon receipt of a query, a sequence of operators of the query is identified, where the sequence of operators includes at least two neighboring operators including a first operator and a second operator representing a machine learning model. By determining schema compatibility between at least the first and second operators, the method either alerts a user to schema incompatibility before attempting to execute the query or determine that the schemas are compatible such that the query may be executed without the occurrence of errors due to schema incompatibility between neighboring operators. Advantageously, the method enables the integration of a machine learning model into the query while still ensuring schema compatibility.

Determination of schema compatibility between neighboring operators within a search query statement

Embodiments described herein are directed to facilitating performing online data decomposition to identify multiple seasonal components. In accordance with aspects of the present disclosure, a first iterative process is performed to determine a first seasonal component associated with an incoming data point based on a set of previous data points of a time series data set and corresponding data components. In addition, a second iterative process is performed to determine a second seasonal component associated with the incoming data point based on previous data points of the time series data set and corresponding data components. The first seasonal component and the second seasonal component can then be provided for analysis of the incoming data point (e.g., for presentation, for use in determining trend and residual components, etc.).

Multiple seasonality online data decomposition

Embodiments of the present disclosure are directed to facilitating performing online data forecasting. In operation, data decomposition of an incoming data point is performed to determine a trend component associated with the incoming data point. Such a trend component, and previous trend components, can be used to determine a trend component expected for a data point subsequent to the incoming data point. A seasonality component expected for the data point subsequent to the incoming data point can be identified, for example, based on a seasonality component associated with a previous corresponding data point. Thereafter, the expected trend and seasonality components can be used to predict the data point subsequent to the incoming data point. Such a data prediction can be performed in an online processing manner such that a subsequent data point is not used to decompose the incoming data point or forecast the data point.

Online data forecasting

A computerized method is disclosed that includes operations of training a machine learning model using a labeled training set of data, wherein the machine learning model is configured to classify domain name server (DNS) records, obtaining DNS record data including at least a first DNS Txt record, applying the trained machine learning model to the first DNS Txt record to classify the first DNS Txt record and responsive to the classification of the first DNS Txt record, generating a flag for a system administrator. The trained machine learning model may classify the first DNS Txt record using logistic regression. In some instances, applying the trained machine learning model to the first DNS Txt record includes performing a tokenizing operation on the first DNS Txt record to generate a tokenized first DNS Txt record.

Systems and methods for DNS text classification

Systems and methods are described for processing ingested data, detecting anomalies in the ingested data, and providing explanations of a possible cause of the detected anomalies as the data is being ingested. For example, a token or field in the ingested data may have an anomalous value. Tokens or fields from another portion of the ingested data can be extracted and analyzed to determine whether there is any correlation between the values of the extracted tokens or fields and the anomalous token or field having an anomalous value. If a correlation is detected, this information can be surfaced to a user.

Anomaly and outlier explanation generation for data ingested to a data intake and query system

A computer-implemented method is disclosed that includes operations of parsing a query comprised of a sequence of operators to detect each operator of the sequence of operators, where the sequence of operators includes a machine learning (ML) operator representing a trained ML model. Additionally, a schema of the ML operator is determined through metadata. A filter or a projection is generated based on the schema of the ML operator, where the filter or projection is configured to reduce an amount of data retrieved upon application of the filter of the projection to an operator of the sequence of operators comprising the query. The schema of the ML operator indicates a schema of input data to be provided to the ML operator and a schema of output data to be provided by the ML operator following processing.

Systems and methods for decoupling search processing language and machine learning analytics from storage of accessed data

A computerized method is disclosed including operations of receiving a data stream, performing a changepoint detection resulting in a detection of changepoints in the data stream including: maintaining a listing of starting indices for each run within the data stream in a buffer of size L wherein each index of the listing has a run length probability representing a likelihood of being a changepoint, receiving a new data point within the data stream and adding a new index to the buffer resulting in the buffer having size L+1, calculating a posterior run length probability that the new data point is a changepoint, and removing an index from the listing that has a lowest run length probability thereby returning the buffer to size L, and responsive to determining the index removed from the listing does not correspond to the new data point, identifying a changepoint associated with the new data point.

System and method for changepoint detection in streaming data

Systems and methods are described for processing ingested data using an online machine learning algorithm as the data is being ingested. For example, the online machine learning algorithm can be an adaptive thresholding algorithm used to identify outliers in a moving window of data. As another example, the online machine learning algorithm can be a sequential outlier detector that detects anomalous sequences of logs or events. As another example, the online machine learning algorithm can be a sentiment analyzer that determines whether text has a positive, negative, or neutral sentiment. As another example, the online machine learning algorithm can be a drift detector that detects whether ingested data marks the start of a change in the distribution of a time-series.

Online artificial intelligence algorithm for a data intake and query system

The disclosure provides implementations for determining whether domain name server (DNS) beaconing is present within a communication session. Some implementations provide a method that includes multiple analyses directed to analyzing each of a time-to-live (TTL) run length distribution for a plurality of DNS records within the communication session and analyzing whether the communication is comprised of at least a threshold number of transmissions. As used in the analyses, the communication session may be comprised of transmissions between a first source device and a first DNS. When DNS beaconing is detected within the communication session, some implementations of the disclosure provide for generating an alert to an administrator or other user.

Growing community of inventors

Oakland, CA, United States of America

Ram Sriharsha