Oracle International Corporation

Saeid Allahdadian

Felix Schmidt

Matteo Casserini

Andrew Brownsword

Milos Vasic

Nipun Agarwal

Amin Suzani

Arno Schneuwly

Hamed Ahmadi

Here is message compression using schema inference for condensing semantic content by removal of syntactic structure in multiple kinds of content. Topological structures of different trees are generalized to generate a merged tree. Because compression discards redundant content and often only semantic content is retained, the signal-to-noise ratio is increased, which increases accuracy of downstream semantic analytics such as machine learning. Compression based on the merged tree removes redundant information from new messages that, without obscuring semantic content, decreases the data volume for downstream analytics or archiving. This compression extracts semantic values that can be assembled into a sequence of lexical tokens that is suitable for natural language processing (NLP), and the sequence of lexical tokens does not contain tokens that represent syntax or structure. Thus, compression provides fewer tokens to be processed by a downstream language model, which is suitable for efficient processing of a live data stream.

Payload size reduction and reassembly of recursively parsable structures

Herein are machine learning techniques that adjust reconstruction loss of a reconstructive model such as an autoencoder based on importances of values of features. In an embodiment and before, during, or after training, the reconstructive model that more or less accurately reconstructs its input, a computer measures, for each distinct value of each feature, a respective importance that is not based on the reconstructive model. For example, importance may be based solely on a training corpus. For each feature during or after training, a respective original loss from the reconstructive model measures a difference between a value of the feature in an input and a reconstructed value of the feature generated by the reconstructive model. For each feature, the respective importance of the input value of the feature is applied to the respective original loss to generate a respective weighted loss. The weighted losses of the features of the input are collectively detected as anomalous or non-anomalous.

Balancing feature distributions using an importance factor

Techniques for implementing a semi-supervised framework for purpose-oriented anomaly detection are provided. In one technique, a data item in inputted into an unsupervised anomaly detection model, which generates first output. Based on the first output, it is determined whether the data item represents an anomaly. In response to determining that the data item represents an anomaly, the data item is inputted into a supervised classification model, which generates second output that indicates whether the data item is unknown. In response to determining that the data item is unknown, a training instance is generated based on the data item. The supervised classification model is updated based on the training instance.

Semi-supervised framework for purpose-oriented anomaly detection

Techniques are provided for sparse ensembling of unsupervised machine learning models. In an embodiment, the proposed architecture is composed of multiple unsupervised machine learning models that each produce a score as output and a gating network that analyzes the inputs and outputs of the unsupervised machine learning models to select an optimal ensemble of unsupervised machine learning models. The gating network is trained to choose a minimal number of the multiple unsupervised machine learning models whose scores are combined to create a final score that matches or closely resembles a final score that is computed using all the scores of the multiple unsupervised machine learning models.

Sparse ensembling of unsupervised models

Herein are feature extraction mechanisms that receive parsed log messages as inputs and transform them into numerical feature vectors for machine learning models (MLMs). In an embodiment, a computer extracts fields from a log message. Each field specifies a name, a text value, and a type. For each field, a field transformer for the field is dynamically selected based the field's name and/or the field's type. The field transformer converts the field's text value into a value of the field's type. A feature encoder for the value of the field's type is dynamically selected based on the field's type and/or a range of the field's values that occur in a training corpus of an MLM. From the feature encoder, an encoding of the value of the field's typed is stored into a feature vector. Based on the MLM and the feature vector, the log message is detected as anomalous.

Growing community of inventors

Vancouver, Canada

Saeid Allahdadian