US 11,669,735 B2
System and method for automatically generating neural networks for anomaly detection in log data from distributed systems
Ala Shaabana, Toronto (CA); Arvind Mohan, Raleigh, NC (US); Vikram Nair, Mountain View, CA (US); Anant Agarwal, San Jose, CA (US); Aalap Desai, Newark, CA (US); Ravi Kant Cherukupalli, San Ramon, CA (US); and Pawan Saxena, Pleasanton, CA (US)
Assigned to VMWARE, INC., Palo Alto, CA (US)
Filed by VMware, Inc., Palo Alto, CA (US)
Filed on Jan. 23, 2020, as Appl. No. 16/751,127.
Prior Publication US 2021/0232906 A1, Jul. 29, 2021
Int. Cl. G06N 3/08 (2023.01); G06F 11/14 (2006.01); G06N 3/044 (2023.01); G06N 3/045 (2023.01); G06N 3/006 (2023.01); G06N 3/088 (2023.01); G06N 3/082 (2023.01)
CPC G06N 3/08 (2013.01) [G06F 11/1476 (2013.01); G06N 3/006 (2013.01); G06N 3/044 (2023.01); G06N 3/045 (2023.01); G06N 3/088 (2013.01); G06N 3/082 (2013.01)] 20 Claims
OG exemplary drawing
 
15. A system for automatically generating recurrent neural networks for log anomaly detection, the system comprising:
memory; and
at least one processor configured to:
create a training dataset of logs and a validation dataset of logs, wherein the logs in the training and validation datasets relate to operations of at least one component running in a computing environment;
for each input set of controller parameters that is applied to a controller recurrent neural network:
generate an output set of hyperparameters at the controller recurrent neural network;
apply the output set of hyperparameters to a target recurrent neural network to produce a child recurrent neural network for log anomaly detection with an architecture that is defined by the output set of hyperparameters;
train the child recurrent neural network using the training dataset of logs to classify each of the logs as one of an anomalous log and a non-anomalous log; and
compute a log classification accuracy of the child recurrent neural network with respect to correct classification of anomalous logs and non-anomalous logs using the validation dataset of logs; and
using a current log classification accuracy of a corresponding child recurrent neural network, adjust at least one of the controller parameters used to generate the corresponding child recurrent neural network to produce a different input set of controller parameters to be applied to the controller recurrent neural network so that a different child recurrent neural network for log anomaly detection with a different architecture can be generated,
wherein the child recurrent neural network is a long short term memory (LSTM) recurrent neural network that includes first LSTM cells and wherein the controller recurrent neural network is a LSTM recurrent neural network that includes second LSTM cells.