Abstract: Techniques are provided for reinforcement learning-based evaluation of software product usage. One method comprises obtaining key performance indicators indicating software product usage by a user; determining, for a predefined time window: (i) a mean and/or a median of the obtained KPIs; (ii) an amount of time that the software product was active; and (iii) an amount of interactions by the user with a user interface; evaluating possible login states of the software product using at least one reinforcement learning agent, wherein the evaluating comprises (a) observing the plurality of possible login states, including a current state comprising a current login state of the software product, and (b) obtaining an expected utility score for changing from the current login state to a different login state of the software product; and determining whether to change from the current login state to a different login state of the software product based on the expected utility score.

Abstract: Techniques are provided for machine learning-based anomaly detection in a monitored location. One method comprises obtaining data from multiple data sources associated with a monitored location for storage into a data repository; processing the data to generate substantially continuous time-series data for multiple distinct features within the data; applying the substantially continuous time-series data for the distinct features to a machine learning baseline behavioral model to obtain a probability distribution representing a behavior of the monitored location over time; and evaluating a probability score generated by the machine learning baseline behavioral model to identify an anomaly at the monitored location. The machine learning baseline behavioral model is trained, for example, to identify anomalies in correlations between the plurality of distinct features at each timestamp.

Abstract: Techniques are provided for system operational analytics using normalized likelihood scores. In one embodiment, an exemplary method comprises: obtaining data from data sources associated with a monitored system; applying at least one function to the log data to obtain a plurality of time-series counters for a plurality of distinct features within the data; processing the plurality of time-series counters using at least one machine learning model to obtain a plurality of log likelihood values representing a behavior of the monitored system over time; determining a z-score for each of the plurality of log likelihood values over a predefined short-term time window; monitoring a distribution of the z-scores for the plurality of log likelihood values over a predefined long-term time window to map the z-scores to percentile values; and mapping the percentile values to a health score for the monitored system based on predefined percentile ranges and/or a transformation function.

Abstract: Data compression optimization based on client clusters is described. A system identifies a cluster of similar client devices in a group of client devices, by comparing data compression factors that correspond to each client device in the group of client devices. The system identifies a relationship between data compression factors corresponding to the cluster and data compression ratios corresponding to the cluster. The system identifies a client device, in the cluster, which corresponds to a data compression ratio that is inefficient relative to other compression ratios corresponding to other client devices in the cluster. The system outputs a data compression recommendation for the client device, based on data compression factors corresponding to the client device and the identified relationship between the data compression factors corresponding to the cluster and the data compression ratios corresponding to the cluster.

Abstract: Techniques are provided for identifying anomalies in an Internet of Things (IoT) activity profile of a user using an analytic engine. An exemplary method comprises obtaining data from a plurality of IoT devices of a user, wherein at least one IoT device comprises an agent device that performs an action on behalf of the user; applying the obtained data to a feature engineering module to convert the obtained data into time-series features that capture behavior and/or characteristics of an IoT environment of the user, and applying the time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in the IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned patterns.

Abstract: Techniques are provided for system operational analytics using normalized likelihood scores. In one embodiment, an exemplary method comprises: obtaining data from data sources associated with a monitored system; applying at least one function to the log data to obtain a plurality of time-series counters for a plurality of distinct features within the data; processing the plurality of time-series counters using at least one machine learning model to obtain a plurality of log likelihood values representing a behavior of the monitored system over time; determining a z-score for each of the plurality of log likelihood values over a predefined short-term time window; monitoring a distribution of the z-scores for the plurality of log likelihood values over a predefined long-term time window to map the z-scores to percentile values; and mapping the percentile values to a health score for the monitored system based on of predefined percentile ranges and a transformation function.

Abstract: Techniques are provided for system operational analytics using additional features over time-series counters for health score computation. An exemplary method comprises: obtaining log data from data sources of a monitored system; applying a counting function to the log data to obtain time-series counters for a plurality of distinct features within the log data; applying an additional function to the time-series counters for the plurality of distinct features; and processing an output of the additional function using a machine learning model to obtain a health score for the monitored system based on the output of the additional function.

Abstract: Predicting individual drive failures is achieved using machine learning models of drive behavior history based on samples of SMART data attributes collected over distinct time-periods. The drive behavior history is a historical feature added to drive features modeled based on a last sample of SMART data attributes. The drive behavior history feature is used in successive modeling of drive behavior history to increase accuracy in predicting an individual drive's failure over time. Consecutive individual drive failure predictions are aggregated to further increase accuracy in predicting an individual drive's failure. In one embodiment, the system models drive behavior history and other drive features using a machine learning model. Individual drives classified as predicted to fail within a certain period of time are incorporated into a drive replacement strategy that factors in a field-based replacement cost associated with the drive.

Abstract: An apparatus comprises a processing platform configured to implement an analytic engine for evaluation of at least one of a converged infrastructure environment and one or more components of the converged infrastructure environment. The analytic engine comprises an extraction module configured to extract one or more features corresponding to the converged infrastructure environment, a learning and modeling module configured to predict an expected quantitative performance value of at least one of the converged infrastructure environment and the one or more components of the converged infrastructure environment based on the extracted one or more features, and comparison and ranking modules. The comparison module is configured to calculate a difference between an actual quantitative performance value of at least one of the converged infrastructure environment and the one or more components of the converged infrastructure environment and the expected quantitative performance value.