Abstract: The invention is notably directed to a computer-implemented method of clustering anomalies detected in a computerized system. The proposed method makes use of an unsupervised cognitive model, executed based on input datasets to obtain clusters of anomalies. The method accesses input datasets, which correspond to detected anomalies of the computerized system. These anomalies span respective time windows. Each input dataset comprises a set of timeseries of key performance indicators. The key performance indicators of each input dataset extend over a respective time window. That is, each anomaly corresponds to a respective time window. This model includes a first stage, which includes an encoder designed to learn fixed-size representations of input datasets, and a second stage, which is a clustering stage. The model is executed based on the input datasets accessed, the first stage learning fixed-size representations of the input datasets and the second stage clustering the learned representations.

Abstract: An embodiment for root cause analysis of computerized system anomalies is provided. The embodiment may include monitoring key performance indicators (KPIs) for a computerized system, wherein KPI values of the monitored KPIs form respective timeseries. The embodiment may include detecting an anomaly in the computerized system based on the monitored KPIs. The embodiment may include determining a troubleshooting time window extending over a given time period. The embodiment may include identifying a strict subset of the monitored KPIs based on portions of the respective timeseries spanning the given time period. The strict subset comprises abnormal KPIs (aKPIs) and potential explanatory KPIs (xKPIs). The embodiment may include obtaining a causal graph of vertices mapping KPIs of the strict subset by running a causality algorithm to evaluate weights of directed edges connecting the vertices and accordingly obtain one or more directed paths. The embodiment may include returning the obtained causal graph.

Abstract: An embodiment for root cause analysis of computerized system anomalies is provided. The embodiment may include monitoring key performance indicators (KPIs) for a computerized system, wherein KPI values of the monitored KPIs form respective timeseries. The embodiment may include detecting an anomaly in the computerized system based on the monitored KPIs. The embodiment may include determining a troubleshooting time window extending over a given time period. The embodiment may include identifying a strict subset of the monitored KPIs based on portions of the respective timeseries spanning the given time period. The strict subset comprises abnormal KPIs (aKPIs) and potential explanatory KPIs (xKPIs). The embodiment may include obtaining a causal graph of vertices mapping KPIs of the strict subset by running a causality algorithm to evaluate weights of directed edges connecting the vertices and accordingly obtain one or more directed paths. The embodiment may include returning the obtained causal graph.

Abstract: The invention is directed to characterizing a computerized system. Access key performance indicators (KPIs), for the computerized system. Each of the KPIs is a timeseries of KPI values and is categorized into one of n types. KPI values are channeled through n buffer channels. Each buffer channel buffers KPI values of one of n types. Finally, reconstructions errors are obtained by feeding initial KPI values to n respective input channels of a cognitive model, implemented as an autoencoder by a trained neural network including an encoder and a decoder. Encoder has temporal convolutional layer blocks connected by each input channel. Decoder has deconvolution layer blocks connected by encoder. Initial KPI values are independently processed in n input channels, then compressed by encoder, prior to being reconstructed by decoder. Reconstruction errors are obtained by comparing reconstructed KPI values with initial KPI values. Computerized system is characterized based on reconstruction errors obtained.

Abstract: The invention is directed to characterizing a computerized system based on key performance indicators (KPIs). Channel the KPIs through n buffer channels, where n?2. The KPIs are channeled by: accessing KPIs; clustering the KPIs accessed to obtain k clusters; and, for each cluster of the k clusters obtained, identifying n representative KPIs in each cluster as objects of n respective types and buffering KPI values of the n representative KPIs identified in respective ones of the n buffer channels. The KPI values buffered in the n buffer channels are then fed into respective input channels of a trained neural network. The neural network independently processes the KPIs in the input channels and produces output values in output of the inner layers. Eventually, the computerized system is characterized based on the output values produced, e.g., to detect an anomaly in the system.

Abstract: A computer-implemented method forecasts a timeseries. The method includes loading and running a machine learning model. The machine learning model includes an encoder recurrent neural network (RNN) mapping an input sequence into a fixed-dimensionality vector c and a decoder RNN decoding the vector to produce an intermediate sequence. The model includes a fully connected feed-forward layer (FC-FFL) to produce an output sequence. The machine learning model is run concomitantly. Values of a given input sequence are coupled to produce a given output sequence in output of the FC-FFL. Values of a feedback sequence are stored in a location-addressable memory bank. The memory addresses of the memory bank are mapped onto a temporal sequence of the feedback sequence. Values stored are read to retrieve values of the feedback sequence. The retrieved values are fed to the decoder RNN as the model is being run to obtain the given output sequence.

Abstract: A computer-implemented method, computer program product and computer system of characterizing a computerized system, where data can be written to or read from the system via write channels and read channels. Including accessing first data, pertaining to the write channels, and second data, pertaining to the read channels and may continually collect, aggregate, and access data. The first data and the second data are separately fed into a convolutional or recurrent neural network, which includes two input channels defining independent subsets of one or more layers and an output layer connected by each subsets of layers. Data ingestion is performed for the neural network to separately process the first data and the second data and produce one or more values in the output layer. A current state can be characterized based on the values produced. A potential anomaly is detected in the system, and action may be taken.

Abstract: A computer-implemented method for detecting an anomaly in a computer system. The method comprises accessing a first timeseries of measured values of a quantity related to the operation of the computer system, wherein the first timeseries spans a first time period. Timeseries forecasting is performed to infer a second timeseries of values for the quantity. The second timeseries spans a second time period up to a given time horizon. Aa third timeseries of measured values of the quantity is accessed, wherein the third timeseries spans the second time period up to the time horizon. The second timeseries inferred is subsequently compared with the third timeseries accessed to obtain a comparison outcome. An anomaly score is determined based on the comparison outcome obtained, to potentially detect an anomaly in the computer system. The invention is further directed to an anomaly detection unit and a computer program product.

Abstract: Distinct sets of non-stationary data seen on a switch in data communication with one or more of computerized units in a network, are mirrored via two switch ports, which include a first port and a second port. A dual analysis is performed while mirroring said distinct sets of data. First data obtained from data mirrored at the first port are analyzed (e.g., using a trained machine learning model) and, based on the first data analyzed, the switch is reconfigured for the second port to mirror second data, which are selected from non-stationary data as seen on the switch (e.g., data received and/or transmitted by the switch). The second data mirrored at the second port is analyzed (e.g., using a different analysis scheme, suited for the selected data).

Abstract: A system for hierarchical occupancy based congestion management includes a buffer embodied in a computer readable storage medium including a plurality of buffer units for storing packets of a data flow received from sources. The system includes a buffer manager that stores information about the packets stored in the buffer, including a selection criterion associated with each of the plurality of sources and a congestion estimator that monitors a congestion level in the buffer. The system also includes a occupancy sampler that randomly selects at least two occupied buffer units from the plurality of buffer units and identifies the source of the packet stored in each of the occupied buffer units and a congestion notification message generator that generates a congestion notification message; wherein if the congestion level in the buffer exceeds a threshold value the congestion notification message is sent to the identified source with a higher selection criteria.

Abstract: A method for hierarchical occupancy based congestion management includes receiving, by a computing device, a plurality of data flows, each of the plurality of data flows is received from a source and includes a plurality of data packets and storing the plurality of data packets in a buffer including multiple storage units. The method includes determining if the buffer is congested, responsive to determining the buffer is congested randomly selecting at least two occupied units of the buffer and identifying a source of each of the data packets stored in the occupied units of the buffer and generating a congestion notification message. The method also includes comparing a selection criterion associated with each identified source to determine which identified source has a higher selection criterion and sending the congestion notification message to the identified source with the higher selection criterion.

Abstract: A method for hybrid arrival-occupancy based congestion management includes increasing a recent arrivals counter associated with a data flow from one or more sources in response to receiving a data packet from one of the sources and storing the data packet in a buffer including multiple storage units. The method includes determining if a buffer is congested, randomly selecting an occupied unit of the buffer and determining the source of the packet stored in the occupied unit of the buffer, generating a congestion notification message, sending the congestion notification message to the source of the packet stored in the occupied unit of the buffer if the recent arrivals counter exceeds a threshold value and decreasing the recent arrivals counter associated with the source of the packet stored in the occupied unit of the buffer and discarding the congestion notification message if the recent arrivals counter has a zero value.

Abstract: A method for buffer occupancy based congestion management includes receiving, by a computing device, a data stream including a plurality of packets from a plurality of sources and storing the packets in a buffer that includes multiple storage units. The method also includes determining if the buffer is congested, responsive to determining that the buffer is congested randomly selecting an occupied unit of the buffer and determining the source of the packet stored in the occupied unit of the buffer and sending a congestion notification message to the source of the packet stored in the occupied unit of the buffer.

Abstract: A method for buffer occupancy based congestion management includes receiving, by a computing device, a data stream including a plurality of packets from a plurality of sources and storing the packets in a buffer that includes multiple storage units. The method also includes determining if the buffer is congested, responsive to determining that the buffer is congested randomly selecting an occupied unit of the buffer and determining the source of the packet stored in the occupied unit of the buffer and sending a congestion notification message to the source of the packet stored in the occupied unit of the buffer.

Abstract: A method for hierarchical occupancy based congestion management includes receiving, by a computing device, a plurality of data flows, each of the plurality of data flows is received from a source and includes a plurality of data packets and storing the plurality of data packets in a buffer including multiple storage units. The method includes determining if the buffer is congested, responsive to determining the buffer is congested randomly selecting at least two occupied units of the buffer and identifying a source of each of the data packets stored in the occupied units of the buffer and generating a congestion notification message. The method also includes comparing a selection criterion associated with each identified source to determine which identified source has a higher selection criterion and sending the congestion notification message to the identified source with the higher selection criterion.

Abstract: A method for hybrid arrival-occupancy based congestion management includes increasing a recent arrivals counter associated with a data flow from one or more sources in response to receiving a data packet from one of the sources and storing the data packet in a buffer including multiple storage units. The method includes determining if a buffer is congested, randomly selecting an occupied unit of the buffer and determining the source of the packet stored in the occupied unit of the buffer, generating a congestion notification message, sending the congestion notification message to the source of the packet stored in the occupied unit of the buffer if the recent arrivals counter exceeds a threshold value and decreasing the recent arrivals counter associated with the source of the packet stored in the occupied unit of the buffer and discarding the congestion notification message if the recent arrivals counter has a zero value.

Abstract: A system for hierarchical occupancy based congestion management includes a buffer embodied in a computer readable storage medium including a plurality of buffer units for storing packets of a data flow received from sources. The system includes a buffer manager that stores information about the packets stored in the buffer, including a selection criterion associated with each of the plurality of sources and a congestion estimator that monitors a congestion level in the buffer. The system also includes a occupancy sampler that randomly selects at least two occupied buffer units from the plurality of buffer units and identifies the source of the packet stored in each of the occupied buffer units and a congestion notification message generator that generates a congestion notification message; wherein if the congestion level in the buffer exceeds a threshold value the congestion notification message is sent to the identified source with a higher selection criteria.

Abstract: A network switch device receives a communication packet having a source MAC address s and a destination MAC address d at a switch port p. Then, the network switch device determines whether a valid routing table entry (s, p) exists, there by indicating that the source MAC address s is reachable via a switch port p. The network switch device further determines for the destination MAC address d whether there is at least one switch port q for which a valid routing table entry (d, q) exists, there by indicating that d is reachable via a switch port q. When the routing table entries (s, p) and (d, q) exist, the network switch device routes the communication packet to the switch port q.

Abstract: A network switch device receives a communication packet having a source MAC address s and a destination MAC address d at a switch port p. Then, the network switch device determines whether a valid routing table entry (s, p) exists, there by indicating that the source MAC address s is reachable via a switch port p. The network switch device further determines for the destination MAC address d whether there is at least one switch port q for which a valid routing table entry (d, q) exists, there by indicating that d is reachable via a switch port q. When the routing table entries (s, p) and (d, q) exist, the network switch device routes the communication packet to the switch port q.