Steve Moyle

Performance problem localization in self-healing, service-oriented systems using Bayesian networks

In distributed, service-oriented environments, performance problem localization is required to provide self-healing capabilities and deliver the desired quality of service (QoS). This paper presents an automated approach to identifying system elements causing performance problems. Applying probabilistic inference to collected response time and elapsed time data, the approach 1) infers elapsed time for services where data is missing, 2) estimates the response time degradation caused by different services using the duration, abnormality and response time correlation of their elapsed times, and 3) identifies the services that are the most important causes of slow response time and yield the most benefit if recovered. The approach has been used to localize a performance problem on the test bed of a real-world service-oriented Grid. Evaluation using simulations shows that the approach consistently achieves better accuracy than traditional techniques in various service-oriented settings.

OGSA-based grid workload monitoring

In heterogeneous and dynamic distributed systems like the grid, detailed monitoring of workload and its resulting system performance (e.g. response time) is required to facilitate performance diagnosis and adaptive performance tuning. In this paper, we present a workload monitoring infrastructure for this purpose. The infrastructure classifies and monitors workload across components in grids based on the open grid service architecture (OGSA) in an end-to-end manner. It provides the abilities to assess what components are involved in processing a work unit, to report time elapsed at these components, and to capture concurrency and isolate which components are critical to overall performance observed. These are enclosed in an automatically constructed Response Time Service Petri Net (RT-SPN) model. A tool is provided to accept queries about work units and visualise corresponding RTSPNs. The infrastructure is also designed and implemented so as to be portable, scalable and lightweight.

On the Road to Knowledge

In this chapter we describe our experience with mining a large multi-relational database of traffic accident reports. We applied a range of data mining techniques to this dataset, including text mining, clustering of time series, subgroup discovery, multi-relational data mining, and association rule learning. We also describe a collaborative data mining challenge on part of the dataset.

Collaborative Data Mining

Collaborative Data Mining is a setting where the Data Mining effort is distributed to multiple collaborating agents — human or software. The objective of the collaborative Data Mining effort is to produce solutions to the tackled Data Mining problem which are considered better by some metric, with respect to those solutions that would have been achieved by individual, non-collaborating agents. The solutions require evaluation, comparison, and approaches for combination. Collaboration requires communication, and implies some form of community. The human form of collaboration is a social task. Organizing communities in an effective manner is non trivial and often requires well defined roles and processes. Data Mining, too, benefits from a standard process. This chapter explores the standard Data Mining process CRISP-DM utilized in a collaborative setting.

Using model trees to characterize computer resource usage

Continuous numeric prediction techniques known as model trees which build decision trees and then use linear regression at the terminal nodes are used to characterize resource consumption in a computer system. An advantage of model trees over time series and other traditional statistical models is the ability to add background knowledge to the model. Models are built using production data from several banks in collaboration with domain experts at those institutions. A demonstration of improving the models by adding background expert knowledge is given. An example of using model predictions to allow adaptive elements of an operating system to become more self-managing with respect to memory usage is also presented. Comparisons with other predictive techniques are made and advantages and disadvantages of using this technique in the operating system are discussed.

Machine Learning to Detect Intrusion Strategies

Intrusion detection is the identification of potential breaches in computer security policy. The objective of an attacker is often to gain access to a system that they are not authorized to use. The attacker achieves this by exploiting a (known) software vulnerability by sending the system a particular input. Current intrusion detection systems examine input for syntactic signatures of known intrusions. This work demonstrates that logic programming is a suitable formalism for specifying the semantics of attacks. Logic programs can then be used as a means of detecting attacks in previously unseen inputs. Furthermore the machine learning approach provided by Inductive Logic Programming can be used to induce detection clauses from examples of attacks. Experiments of learning ten different attack strategies to exploit one particular vulnerability demonstrate that accurate detection rules can be generated from very few attack examples.

Collaboration in a Data Mining Virtual Organization

Both data mining and decision support are branches of applied problem solving. Both fields are not simply about technology, but are processes that require highly skilled humans. As with any knowledge intensive enterprise, collaboration — be it local or remote — offers the potential of improved results by harnessing dispersed expertise and enabling knowledge sharing and learning. This was precisely the objective of the SolEuNet Project — to solve problems utilizing teams of geographically dispersed experts. Unfortunately, organizations find that realizing the potential of remote e-collaboration is not an easy process. To assist in the understanding of difficulties in e-collaborative enterprises, a model of the e-collaboration space is reviewed. The SolEuNet Remote Data Mining Virtual Organization and its implemented methodology — a key factor for success — is analyzed with respect to the e-collaboration space model. The case studies of three instances of using the Remote Data Mining Virtual Organization are presented.

Data Mining and Decision Support Integration through the Predictive Model Markup Language Standard and Visualization

The emerging standard for the platform- and system-independent representation of data mining models, PMML (Predictive Model Markup Language), is currently supported by a number of knowledge discovery support engines (KDDSE). The primary purpose of the PMML standard is to separate model generation from model storage in order to enable users to view, post-process, and utilize data mining models independently of the KDDSE that generated the model. In this chapter, an architectural framework for collaborative data mining and decision support that utilizes PMML is described. Important parts of such a general framework are visualization and evaluation methods for data mining models. Two such systems, called VizWiz and PEAR, are described in some detail.

Large and Tall Buildings

Large and Tall buildings can be broadly classified into three groups: sprawling, squat, or tall. The decision to build a particular type of large building can be based on a vast number of attributes. A building construction expert’s analysis of seventy international building projects was used as input to further decision support and data mining analyses. Decision models were developed that incorporated customer values of proposed construction project attributes. Data mining was used to model the feasibility of construction projects from their input attributes. On this basis, we propose a novel way of integrating data mining and decision support methods, where both techniques are used. In this approach both techniques are employed to utilize the same input vectors. While decision support models are designed to assess and possibly maximize utility, data mining models provide a test for feasibility.

Data Mining Processes and Collaboration Principles

Data mining is a process involving the application of human skill as well as technology, and as such it can be supported by clearly defined processes and procedures. This chapter presents the CRISP-DM process, one well developed standard data mining process, which contains clearly defined phases with clearly defined steps and deliverables. The nature of some of the CRISP-DM phases is such that it is possible to perform them in an e-collaboration setting. The principles for extending the CRISP-DM process to support collaborative data mining are described in the RAMSYS approach to data mining. The tools, systems, and evaluation procedures that are required for the RAMSYS approach to reach its potential are described.