Event mining for system and service management

Modern IT infrastructures are constructed by large scale computing systems and administered by IT service providers. Manually maintaining such large computing systems is costly and inefficient. Service providers often seek automatic or semi-automatic methodologies of detecting and resolving system issues to improve their service quality and efficiency. This dissertation investigates several data-driven approaches for assisting service providers in achieving this goal. The detailed problems studied by these approaches can be categorized into the three aspects in the service workflow: 1) preprocessing raw textual system logs to structural events; 2) refining monitoring configurations for eliminating false positives and false negatives; 3) improving the efficiency of system diagnosis on detected alerts. Solving these problems usually requires a huge amount of domain knowledge about the particular computing systems. The approaches investigated by this dissertation are developed based on event mining algorithms, which are able to automatically derive part of that knowledge from the historical system logs, events and tickets. ^ In particular, two textual clustering algorithms are developed for converting raw textual logs into system events. For refining the monitoring configuration, a rule based alert prediction algorithm is proposed for eliminating false alerts (false positives) without losing any real alert and a textual classification method is applied to identify the missing alerts (false negatives) from manual incident tickets. For system diagnosis, this dissertation presents an efficient algorithm for discovering the temporal dependencies between system events with corresponding time lags, which can help the administrators to determine the redundancies of deployed monitoring situations and dependencies of system components. To improve the efficiency of incident ticket resolving, several KNN-based algorithms that recommend relevant historical tickets with resolutions for incoming tickets are investigated. Finally, this dissertation offers a novel algorithm for searching similar textual event segments over large system logs that assists administrators to locate similar system behaviors in the logs. Extensive empirical evaluation on system logs, events and tickets from real IT infrastructures demonstrates the effectiveness and efficiency of the proposed approaches.^

Approximate entropy normalized measures for analyzing social neurobiological systems

When considering time series data of variables describing agent interactions in social neurobiological systems, measures of regularity can provide a global understanding of such system behaviors. Approximate entropy (ApEn) was introduced as a nonlinear measure to assess the complexity of a system behavior by quantifying the regularity of the generated time series. However, ApEn is not reliable when assessing and comparing the regularity of data series with short or inconsistent lengths, which often occur in studies of social neurobiological systems, particularly in dyadic human movement systems. Here, the authors present two normalized, nonmodified measures of regularity derived from the original ApEn, which are less dependent on time series length. The validity of the suggested measures was tested in well-established series (random and sine) prior to their empirical application, describing the dyadic behavior of athletes in team games. The authors consider one of the ApEn normalized measures to generate the 95th percentile envelopes that can be used to test whether a particular social neurobiological system is highly complex (i.e., generates highly unpredictable time series). Results demonstrated that suggested measures may be considered as valid instruments for measuring and comparing complexity in systems that produce time series with inconsistent lengths.

A hierarchical approach to model parameter optimization for developmental systems.

In the context of Systems Biology, computer simulations of gene regulatory networks provide a powerful tool to validate hypotheses and to explore possible system behaviors. Nevertheless, modeling a system poses some challenges of its own: especially the step of model calibration is often difficult due to insufficient data. For example when considering developmental systems, mostly qualitative data describing the developmental trajectory is available while common calibration techniques rely on high-resolution quantitative data. Focusing on the calibration of differential equation models for developmental systems, this study investigates different approaches to utilize the available data to overcome these difficulties. More specifically, the fact that developmental processes are hierarchically organized is exploited to increase convergence rates of the calibration process as well as to save computation time. Using a gene regulatory network model for stem cell homeostasis in Arabidopsis thaliana the performance of the different investigated approaches is evaluated, documenting considerable gains provided by the proposed hierarchical approach.

Achieving Real-Time Mode Estimation through Offline Compilation

As exploration of our solar system and outerspace move into the future, spacecraft are being developed to venture on increasingly challenging missions with bold objectives. The spacecraft tasked with completing these missions are becoming progressively more complex. This increases the potential for mission failure due to hardware malfunctions and unexpected spacecraft behavior. A solution to this problem lies in the development of an advanced fault management system. Fault management enables spacecraft to respond to failures and take repair actions so that it may continue its mission. The two main approaches developed for spacecraft fault management have been rule-based and model-based systems. Rules map sensor information to system behaviors, thus achieving fast response times, and making the actions of the fault management system explicit. These rules are developed by having a human reason through the interactions between spacecraft components. This process is limited by the number of interactions a human can reason about correctly. In the model-based approach, the human provides component models, and the fault management system reasons automatically about system wide interactions and complex fault combinations. This approach improves correctness, and makes explicit the underlying system models, whereas these are implicit in the rule-based approach. We propose a fault detection engine, Compiled Mode Estimation (CME) that unifies the strengths of the rule-based and model-based approaches. CME uses a compiled model to determine spacecraft behavior more accurately. Reasoning related to fault detection is compiled in an off-line process into a set of concurrent, localized diagnostic rules. These are then combined on-line along with sensor information to reconstruct the diagnosis of the system. These rules enable a human to inspect the diagnostic consequences of CME. Additionally, CME is capable of reasoning through component interactions automatically and still provide fast and correct responses. The implementation of this engine has been tested against the NEAR spacecraft advanced rule-based system, resulting in detection of failures beyond that of the rules. This evolution in fault detection will enable future missions to explore the furthest reaches of the solar system without the burden of human intervention to repair failed components.

Estudo do efeito de dipolos em arranjos de antenas adaptativas de sistemas de comunicação DS-CDMA

This master dissertation introduces a study about some aspects that determine the aplication of adaptative arrays in DS-CDMA cellular systems. Some basics concepts and your evolution in the time about celular systems was detailed here, meanly the CDMA tecnique, specialy about spread-codes and funtionaly principies. Since this, the mobile radio enviroment, with your own caracteristcs, and the basics concepts about adaptive arrays, as powerfull spacial filter was aborded. Some adaptative algorithms was introduced too, these are integrants of the signals processing, and are answerable for weights update that influency directly in the radiation pattern of array. This study is based in a numerical analysis of adaptative array system behaviors related to the used antenna and array geometry types. All the simulations was done by Mathematica 4.0 software. The results for weights convergency, square mean error, gain, array pattern and supression capacity based the analisis made here, using RLS (supervisioned) and LSDRMTA (blind) algorithms

Estudo do efeito de dipolos em arranjos de antenas adaptativas de sistemas de comunicação DS-CDMA

This master dissertation introduces a study about some aspects that determine the aplication of adaptative arrays in DS-CDMA cellular systems. Some basics concepts and your evolution in the time about celular systems was detailed here, meanly the CDMA tecnique, specialy about spread-codes and funtionaly principies. Since this, the mobile radio enviroment, with your own caracteristcs, and the basics concepts about adaptive arrays, as powerfull spacial filter was aborded. Some adaptative algorithms was introduced too, these are integrants of the signals processing, and are answerable for weights update that influency directly in the radiation pattern of array. This study is based in a numerical analysis of adaptative array system behaviors related to the used antenna and array geometry types. All the simulations was done by Mathematica 4.0 software. The results for weights convergency, square mean error, gain, array pattern and supression capacity based the analisis made here, using RLS (supervisioned) and LSDRMTA (blind) algorithms.

Multivalued adaptive neuro-fuzzy controller for robot vehicle - art. no. 1406

Robotic vehicle navigation in unstructured and uncertain environments is still a challenge. This paper presents the implementation of a multivalued neurofuzzy controller for autonomous ground vehicle (AGVs) in indoor environments. The control system consists of a hierarchy of mobile robot using multivalued adaptive neuro-fuzzy inference system behaviors.

Simulation of dynamic pinion course using Runge-Kutta's method and impact modeling

Once defined the relationship between the Starter Motor components and their functions, it is possible to develop a mathematical model capable to predict the Starter behavior during operation. One important aspect is the engagement system behavior. The development of a mathematical tool capable of predicting it is a valuable step in order to reduce the design time, cost and engineering efforts. A mathematical model, represented by differential equations, can be developed using physics laws, evaluating force balance and energy flow through the systems degrees of freedom. Another important physical aspect to be considered in this modeling is the impact conditions (particularly on the pinion and ring-gear contact). This work is a report of those equations application on available mathematical software and the resolution of those equations by Runge-Kutta's numerical integration method, in order to build an accessible engineering tool. Copyright © 2011 SAE International.

Secure gossiping techniques and components

Gossip protocols have proved to be a viable solution to set-up and manage largescale P2P services or applications in a fully decentralised scenario. The gossip or epidemic communication scheme is heavily based on stochastic behaviors and it is the fundamental idea behind many large-scale P2P protocols. It provides many remarkable features, such as scalability, robustness to failures, emergent load balancing capabilities, fast spreading, and redundancy of information. In some sense, these services or protocols mimic natural system behaviors in order to achieve their goals. The key idea of this work is that the remarkable properties of gossip hold when all the participants follow the rules dictated by the actual protocols. If one or more malicious nodes join the network and start cheating according to some strategy, the result can be catastrophic. In order to study how serious the threat posed by malicious nodes can be and what can be done to prevent attackers from cheating, we focused on a general attack model aimed to defeat a key service in gossip overlay networks (the Peer Sampling Service [JGKvS04]). We also focused on the problem of protecting against forged information exchanged in gossip services. We propose a solution technique for each problem; both techniques are general enough to be applied to distinct service implementations. As gossip protocols, our solutions are based on stochastic behavior and are fully decentralized. In addition, each technique’s behaviour is abstracted by a general primitive function extending the basic gossip scheme; this approach allows the adoptions of our solutions with minimal changes in different scenarios. We provide an extensive experimental evaluation to support the effectiveness of our techniques. Basically, these techniques aim to be building blocks or P2P architecture guidelines in building more resilient and more secure P2P services.

Methods for modeling and analyzing concurrent software

Concurrent software executes multiple threads or processes to achieve high performance. However, concurrency results in a huge number of different system behaviors that are difficult to test and verify. The aim of this dissertation is to develop new methods and tools for modeling and analyzing concurrent software systems at design and code levels. This dissertation consists of several related results. First, a formal model of Mondex, an electronic purse system, is built using Petri nets from user requirements, which is formally verified using model checking. Second, Petri nets models are automatically mined from the event traces generated from scientific workflows. Third, partial order models are automatically extracted from some instrumented concurrent program execution, and potential atomicity violation bugs are automatically verified based on the partial order models using model checking. Our formal specification and verification of Mondex have contributed to the world wide effort in developing a verified software repository. Our method to mine Petri net models automatically from provenance offers a new approach to build scientific workflows. Our dynamic prediction tool, named McPatom, can predict several known bugs in real world systems including one that evades several other existing tools. McPatom is efficient and scalable as it takes advantage of the nature of atomicity violations and considers only a pair of threads and accesses to a single shared variable at one time. However, predictive tools need to consider the tradeoffs between precision and coverage. Based on McPatom, this dissertation presents two methods for improving the coverage and precision of atomicity violation predictions: 1) a post-prediction analysis method to increase coverage while ensuring precision; 2) a follow-up replaying method to further increase coverage. Both methods are implemented in a completely automatic tool.

Temporal Mining for Distributed Systems

Many systems and applications are continuously producing events. These events are used to record the status of the system and trace the behaviors of the systems. By examining these events, system administrators can check the potential problems of these systems. If the temporal dynamics of the systems are further investigated, the underlying patterns can be discovered. The uncovered knowledge can be leveraged to predict the future system behaviors or to mitigate the potential risks of the systems. Moreover, the system administrators can utilize the temporal patterns to set up event management rules to make the system more intelligent. With the popularity of data mining techniques in recent years, these events grad- ually become more and more useful. Despite the recent advances of the data mining techniques, the application to system event mining is still in a rudimentary stage. Most of works are still focusing on episodes mining or frequent pattern discovering. These methods are unable to provide a brief yet comprehensible summary to reveal the valuable information from the high level perspective. Moreover, these methods provide little actionable knowledge to help the system administrators to better man- age the systems. To better make use of the recorded events, more practical techniques are required. From the perspective of data mining, three correlated directions are considered to be helpful for system management: (1) Provide concise yet comprehensive summaries about the running status of the systems; (2) Make the systems more intelligence and autonomous; (3) Effectively detect the abnormal behaviors of the systems. Due to the richness of the event logs, all these directions can be solved in the data-driven manner. And in this way, the robustness of the systems can be enhanced and the goal of autonomous management can be approached. This dissertation mainly focuses on the foregoing directions that leverage tem- poral mining techniques to facilitate system management. More specifically, three concrete topics will be discussed, including event, resource demand prediction, and streaming anomaly detection. Besides the theoretic contributions, the experimental evaluation will also be presented to demonstrate the effectiveness and efficacy of the corresponding solutions.

Identification of Microturbine Model for Long-term Dynamic Analysis of Distribution Networks

As one of the most successfully commercialized distributed energy resources, the long-term effects of microturbines (MTs) on the distribution network has not been fully investigated due to the complex thermo-fluid-mechanical energy conversion processes. This is further complicated by the fact that the parameter and internal data of MTs are not always available to the electric utility, due to different ownerships and confidentiality concerns. To address this issue, a general modeling approach for MTs is proposed in this paper, which allows for the long-term simulation of the distribution network with multiple MTs. First, the feasibility of deriving a simplified MT model for long-term dynamic analysis of the distribution network is discussed, based on the physical understanding of dynamic processes that occurred within MTs. Then a three-stage identification method is developed in order to obtain a piecewise MT model and predict electro-mechanical system behaviors with saturation. Next, assisted with the electric power flow calculation tool, a fast simulation methodology is proposed to evaluate the long-term impact of multiple MTs on the distribution network. Finally, the model is verified by using Capstone C30 microturbine experiments, and further applied to the dynamic simulation of a modified IEEE 37-node test feeder with promising results.

Methods for Modeling and Analyzing Concurrent Software

Concurrent software executes multiple threads or processes to achieve high performance. However, concurrency results in a huge number of different system behaviors that are difficult to test and verify. The aim of this dissertation is to develop new methods and tools for modeling and analyzing concurrent software systems at design and code levels. This dissertation consists of several related results. First, a formal model of Mondex, an electronic purse system, is built using Petri nets from user requirements, which is formally verified using model checking. Second, Petri nets models are automatically mined from the event traces generated from scientific workflows. Third, partial order models are automatically extracted from some instrumented concurrent program execution, and potential atomicity violation bugs are automatically verified based on the partial order models using model checking. Our formal specification and verification of Mondex have contributed to the world wide effort in developing a verified software repository. Our method to mine Petri net models automatically from provenance offers a new approach to build scientific workflows. Our dynamic prediction tool, named McPatom, can predict several known bugs in real world systems including one that evades several other existing tools. McPatom is efficient and scalable as it takes advantage of the nature of atomicity violations and considers only a pair of threads and accesses to a single shared variable at one time. However, predictive tools need to consider the tradeoffs between precision and coverage. Based on McPatom, this dissertation presents two methods for improving the coverage and precision of atomicity violation predictions: 1) a post-prediction analysis method to increase coverage while ensuring precision; 2) a follow-up replaying method to further increase coverage. Both methods are implemented in a completely automatic tool.

Role of the hypocretin system in cocaine- and alcohol-related behaviors : evidence from hypocretin-deficient mice

RésuméL'addiction aux drogues est une maladie multifactorieile affectant toutes les strates de notre société. Cependant, la vulnérabilité à développer une addiction dépend de facteurs environnementaux, génétiques et psychosociaux. L'addiction aux drogues est décrite comme étant une maladie chronique avec un taux élevé de rechutes. Elle se caractérise par un besoin irrépressible de consommer une drogue et une augmentation progressive de la consommation en dépit des conséquences néfastes. Les mécanismes cérébraux responsables des dépendances aux drogues ne sont que partiellement élucidés, malgré une accumulation croissante d'évidences démontrant des adaptations au niveau moléculaire et cellulaire au sein des systèmes dopaminergique et glutamatergique. L'identification de nouveaux facteurs neurobiologiques responsables de la vulnérabilité aux substances d'abus est cruciale pour le développement de nouveaux traitements thérapeutiques capables d'atténuer et de soulager les symptômes liés à la dépendance aux drogues.Au cours des dernières années, de nombreuses études ont démontré qu'un nouveau circuit cérébral, le système hypocrétinergique, était impliqué dans plusieurs fonctions physiologiques, tel que l'éveil, le métabolisme énergétique, la motivation, le stress et les comportements liés aux phénomènes de récompense. Le système hypocrétinergique est composé d'environ 3000-4000 neurones issus de l'hypothalamus latéral projetant dans tout ie cerveau. Des souris transgéniques pour le gène des hypocrétines ont été générées et leur phénotype correspond à celui des animaux sauvages, excepté le fait qu'elles soient atteintes d'attaques de sommeil similaires à celles observées chez les patients narcoleptiques. H semblerait que les hypocrétines soient requises pour l'acquisition et l'expression de la dépendance aux drogues. Cependant, le mécanisme précis reste encore à être élucidé. Dans ce rapport, nous rendons compte des comportements liés aux phénomènes de récompense liés à l'alcool et à la cocaine chez les souris knock-out (KO), hétérozygotes (HET) et sauvages (WT).Nous avons, dans un premier temps, évalué l'impact d'injections répétées de cocaïne (15 mg/kg, ip) sur la sensibilisation locomotrice et sur le conditionnement place préférence. Nous avons pu observer que les souris WT, HET et KO exprimaient une sensibilisation locomotrice induite par une administration chronique de cocaïne, cependant les souris déficientes en hypocrétines démontraient une sensibilisation retardée et atténuée. Π est intéressant de mentionner que les mâles HET exprimaient une sensibilisation comportementale intermédiaire. Après normalisation des données, toutes les souris exprimaient une amplitude de sensibilisation similaire, excepté les souris mâles KO qui affichaient, le premier jour de traitement, une sensibilisation locomotrice réduite et retardée, reflétant un phénotype hypoactif plutôt qu'une altération de la réponse aux traitements chroniques de cocaïne. Contre toute attente, toutes les souris femelles exprimaient un pattern similaire de sensibilisation locomotrice à la cocaïne. Nous avons ensuite évalué l'effet d'un conditionnement comportemental à un environnement associé à des injections répétées de cocaine (15 mg / kg ip). Toutes les souris, quelque soit leur sexe ou leur génotype, ont manifesté une préférence marquée pour l'environnement apparié à la cocaïne. Après deux semaines d'abstinence à la cocaïne, les mâles et les femelles déficientes en hypocrétines n'exprimaient plus aucune préférence pour le compartiment précédemment associé à la cocaïne. Alors que les souris WT et HET maintenaient leur préférence pour le compartiment associé à la cocaïne. Pour finir, à l'aide d'un nouveau paradigme appelé IntelliCage®, nous avons pu évaluer la consommation de liquide chez les femelles WT, HET et KO. Lorsqu'il n'y avait que de l'eau disponible, nous avons observé que les femelles KO avaient tendance à moins explorer les quatre coins de la cage. Lorsque les souris étaient exposées à quatre types de solutions différentes (eau, ImM quinine ou 0.2% saccharine, alcool 8% et alcool 16%), les souris KO avaient tendance à moins consommer l'eau sucrée et les solutions alcoolisées. Cependant, après normalisation des données, aucune différence significative n'a pu être observée entre les différents génotypes, suggérant que la consommation réduite d'eau sucrée ou d'alcool peut être incombée à l'hypoactivité des souris KO.Ces résultats confirment que le comportement observé chez les souris KO serait dû à des compensations développementales, puisque la sensibilisation locomotrice et le conditionnement comportemental à la cocaïne étaient similaires aux souris HET et WT. En ce qui concerne la consommation de liquide, les souris KO avaient tendance à consommer moins d'eau sucrée et de solutions alcoolisées. Le phénotype hypoactif des souris déficientes en hypocrétine est probablement responsable de leur tendance à moins explorer leur environnement. Il reste encore à déterminer si l'expression de ce phénotype est la conséquence d'un état de vigilance amoindri ou d'une motivation diminuée à la recherche de récompense. Nos résultats suggèrent que les souris déficientes en hypocrétine affichent une motivation certaine à la recherche de récompense lorsqu'elles sont exposées à des environnements où peu d'efforts sont à fournir afin d'obtenir une récompense.AbstractDrug addiction is a multifactorial disorder affecting human beings regardless their education level, their economic status, their origin or even their gender, but the vulnerability to develop addiction depends on environmental, genetic and psychosocial dispositions. Drug addiction is defined as a chronic relapsing disorder characterized by compulsive drug seeking, with loss of control over drug intake and persistent maladaptive decision making in spite of adverse consequences. The brain mechanisms responsible for drug abuse remain partially unknown despite accumulating evidence delineating molecular and cellular adaptations within the glutamatergic and the dopaminergic systems. However, these adaptations do not fully explain the complex brain disease of drug addiction. The identification of other neurobiological factors responsible for the vulnerability to substance abuse is crucial for the development of promising therapeutic treatments able to alleviate signs of drug dependence.For the past few years, growing evidence demonstrated that a recently discovered brain circuit, the hypocretinergic system, is implicated in many physiological functions, including arousal, energy metabolism, motivation, stress and reward-related behaviors. The hypocretin system is composed of a few thousands neurons arising from the lateral hypothalamus and projecting to the entire brain. Hypocretin- deficient mice have been generated, and unexpectedly, their phenotype resembles that of wild type mice excepting sleep attacks strikingly similar to those of human narcolepsy patients. Evidence suggesting that hypocretins are required for the acquisition and the expression of drug addiction has also been reported; however the precise mechanism by which hypocretins modulate drug seeking behaviors remains a matter of debate. Here, we report alcohol and cocaine reward-related behaviors in hypocretin-deficient mice (KO), as well as heterozygous (HET) and wild type (WT) littermates.We first evaluated the impact of repeated cocaine injections (15 mg/kg, ip) on locomotor sensitization and conditioned place preference. We observed that WT, HET and KO mice exhibited behavioral sensitization following repeated cocaine administrations, but hypocretin deficient males displayed a delayed and attenuated response to chronic cocaine administrations. Interestingly, HET males exhibited an intermediate pattern of behavioral sensitization. However, after standardization of the post-injection data versus the period of habituation prior to cocaine injections, all mice displayed similar amplitudes of behavioral sensitization, except a reduced response in KO males on the first day, suggesting that the delayed and reduced cocaine-induced locomotor sensitization may reflect a hypoactive phenotype and probably not an altered response to repeated cocaine administrations. Unexpectedly, all female mice exhibited similar patterns of cocaine-induced behavioral sensitization. We then assessed the behavioral conditioning for an environment repeatedly paired with cocaine injections (15 mg/kg ip). All mice, whatever their gender or genotype, exhibited a robust preference for the environment previously paired with cocaine administrations. Noteworthy, following two weeks of cocaine abstinence, hypocretin-deficient males and females no longer exhibited any preference for the compartment previously paired with cocaine rewards whereas both WT and HET mice continued manifesting a robust preference. We finally assessed drinking behaviors in WT, HET and KO female mice using a novel paradigm, the IntelliCages®. We report here that KO females tended to less explore the four cage comers where water was easily available. When exposed to four different kinds of liquid solutions (water, ImM quinine or saccharine 0.2%, alcohol 8% and alcohol 16%), KO mice tended to less consume the sweet and the alcoholic beverages. However, after data standardization, no significant differences were noticed between genotypes suggesting that the hypoactive phenotype is most likely accountable for the trend regarding the reduced sweet or alcohol intake in KO.Taken together, the present findings confirm that the behavior seen in Hcrt KO mice likely reflects developmental compensations since only a slightly altered cocaine-induced behavioral sensitization and a normal behavioral conditioning with cocaine were observed in these mice compared to HET and WT littermates. With regards to drinking behaviors, KO mice barely displayed any behavioral changes but a trend for reducing sweet and alcoholic beverages. Overall, the most striking observation is the constant hypoactive phenotype seen in the hypocretin-deficient mice that most likely is accountable for their reduced tendency to explore the environment. Whether this hypoactive phenotype is due to a reduced alertness or reduced motivation for reward seeking remains debatable, but our findings suggest that the hypocretin-deficient mice barely display any altered motivation for reward seeking in environments where low efforts are required to access to a reward.

Optimization of the Topology of Electric Energy Distribution Networks by Using Algorithm Inspired on Ant Behaviors

An algorithm inspired on ant behavior is developed in order to find out the topology of an electric energy distribution network with minimum power loss. The algorithm performance is investigated in hypothetical and actual circuits. When applied in an actual distribution system of a region of the State of Sao Paulo (Brazil), the solution found by the algorithm presents loss lower than the topology built by the concessionary company.