model-based clustering for online crisis identification in ... · modeling computation and decision...

Background and OverviewModeling

Computation and Decision MakingSimulation Study

Application to the Exchange Hosted ServicesConclusions

Model-Based Clustering for Online CrisisIdentification in Distributed Computing

Dawn WoodardOperations Research and Information Engineering

Cornell University

with Moises GoldszmidtMicrosoft Research

Outline1 Background and Overview2 Modeling3 Computation and Decision Making

Offline ComputationOnline ComputationDecision Making

4 Simulation StudyOfflineOnline

5 Application to the Exchange Hosted ServicesOfflineOnline

6 Conclusions2

6 Conclusions3

Distributed Computing

Commercial distributed computing providers:

Offer remotely-hosted computing services

E.g. Microsoft’s Exchange Hosted Services (EHS)

24/7 email processing incl. spam filtering, encryption

This processing is performed by farming out to many servers

Often, tens of thousands of servers in multiple locations

Client Provider

Server 1

Server 2

Server 3

Can have occasional severe violation of performance goals (“crises”)

E.g. due to:

servers becoming overloaded in periods of high demand

performance problems in lower-level computing centers on which theservers rely (e.g. for performing authentication)

If the problem lasts for more than a few minutes, must pay cashpenalties to clients, have potential loss of contracts

% of servers violating a performance goal, for a 10-day periodin EHS:

0 200 400 600 800 1000

Exceeding the dotted line constitutes a crisis.

Need to rapidly recognize the recurrence of a problem

If an effective intervention is known for this problem, can apply it

Due to large scale and interdependence, manual problem diagnosis isdifficult and slow

Have a set of status measurements for each server. E.g., for EHS:

CPU utilization

Memory utilization

For each spam filter, the length of the queue and the throughput

Goal: Match a currently occurring (i.e., incompletely observed) crisis toprevious crises of mixed known and unknown cause

I.e., are any previous crises of the same type as the new crisis? Whichones?

This is an online clustering problem with:

partial labeling

incomplete data for the new crisis

We use model-based clustering based on a Dirichlet process mixture(e.g. Escobar & West 1995)

The evolution of each process is modeled as a time series10

Cost-Optimal Decision Making

Wish to perform optimal (expected-cost-minimizing) decision making during acrisis...

...while accounting for uncertainty in the crisis type assignments and theparameters of those types

This requires fully Bayesian inference

Fully Bayesian Inference

We apply fully Bayesian inference (via MCMC) in the long periodsbetween crises

Due to posterior multimodality, we combine a collapsed-space split-mergemethod with parallel tempering

As a new crisis begins, update rapidly using an approximation

Related Work

Ours is the first instance of fully Bayesian online clustering

Online model-based clustering was performed by Zhang, Ghahramani,and Yang (2004) for documents

Obtain a single cluster assignment based on the posterior; insufficient foroptimal decision making

Fully Bayesian clustering: Bensmail, Celeux, Raftery, and Robert(1997); Pritchard, Stephens, and Donnelly (2000); Lau and Green(2007)

Many examples of fully Bayesian mixture modeling

6 Conclusions14

DataMedians of 3 metrics across servers, for a 10-day period (EHS):

DataCrises are highlighted; color indicates their known type:

The medians of the metrics are very informative as to crisis type

specifically, whether the median is low, normal, or high

We fit our models to the median values of the metrics, discretized into 1:low, 2: normal, and 3: high

Crisis Modeling

Time series model for crisis evolution:

Yilj: value of metric j in the lth time period after the start of crisis i

Assume that metrics are independent conditional on the crisis type

For crisis type k, Yi1j is drawn from a discrete dist’n with probabilityvector γ(jk)

...and Yilj evolves according to a Markov chain with transition matrix T(jk)··

Crisis Modeling

⇒ Complete-data likelihood fn:

π“D | {Zi}I

i=1, {γ(jk), T(jk)·· }j,k

Qi,j,t

"“γ

(j Zi)t

”1(Yi1j=t) Qs

“T(j Zi)

”nijst

#. (1)

conditioning on the unknown type indicators Zi of each crisis i = 1, . . . , I.

nijst: the number of transitions of the jth metric from state s to state t during crisis i

Cluster Modeling

Dirichlet process mixture (DPM) prior:

Natural for online clustering

Allows number of clusters to increase with the number of crises

Crises are exchangeable

Parameterized by

α: controls the expected number of clusters occurring in a fixed number ofcrises

G0: the prior G0(d{γ(jk), T(jk)·· }j) for the parameters associated with each

cluster k

Cluster Modeling

The DPM prior for the cluster indicators {Zi}Ii=1 and the cluster parameters

γ(jk), T(jk)·· :

π({Zi}Ii=1) =

π(Zi | {Zi′}i′<i)

α+i−1 1(Zi=mi−1+1)+ 1α+i−1

Pi′<i

1(Zi=Zi′)#

where mi = max{Zi′ : i′ ≤ i} for i > 0 and m0 = 0, and

d{γ(jk),T(jk)·· }j,k | {Zi}I

mIQk=1

“d{γ(jk),T(jk)

·· }j

”. (3)

Cluster ModelingAlso called the “Chinese Restaurant Process”:

π (Zi = k | {Zi′}i′<i) ∝

8><>:α : k is a new typePi′<i

1 (Zi′ = k) : else

Each observation i is a new guest who either sits at an occupied table withprob. proportional to the number of guests at that table, or sits at an emptytable:

Cluster Modeling

Now we can evaluate the posterior density (up to a normalizingconstant):

π({Zi}I

i=1, {γ(jk), T(jk)·· }j,k | D

π({Zi}I

({γ(jk), T(jk)

·· }j,k | {Zi}Ii=1

(D | {Zi}I

i=1, {γ(jk), T(jk)·· }j,k

Cluster Modeling

Partially labeled case:

We have given the prior for the case where none of the crisis types Zi

are known

If we know that Zi = Zi′ for some crises i ∼ i′, multiply (2) byQi∼i′

1(Zi = Zi′)

Cluster Modeling

Independent Dirichlet priors for γ(jk) for each j

Independent product Dirichlet priors for T(jk)·· for each j

6 Conclusions26

6 Conclusions27

Offline Computation

The cluster parameters {γ(jk), T(jk)·· }j,k can be integrated analytically out

of the posterior

Run a Markov chain with target dist’n π({Zi}Ii=1 | D)

Jain and Neal (2004) use a Gibbs sampler, with an additionalsplit-merge move on clusters

We add parallel tempering (Geyer 1991)

6 Conclusions29

Online Inference

Wish to identify a crisis in real time

Have data D from previous crises and data Dnew so far for the new crisis

E.g., wish to estimate π(Znew = Zi | D,Dnew) for each previous crisisi = 1, . . . , I

...and π(Znew 6= Zi ∀i | D,Dnew)

Exact Online InferenceMethod 1:

Just apply the Markov chain method to the data from the I + 1 crises

Gives posterior sample vectors“{Z(l)

i }Ii=1, Z(l)

”for l = 1, . . . , L

Monte Carlo estimates of the desired probabilities:

π̂(Znew = Zi | D,Dnew) = 1L

1(Z(l)new = Z(l)

π̂(Znew 6= Zi ∀i | D,Dnew) = 1L

1(Z(l)new 6= Z(l)

i ∀i)

But running the Markov chain is too slow for real-time decision making!

Approximate Online Inference

We give a method using the approximation:

π(Znew = Zi | D,Dnew) =X

{Zi}Ii=1

π(Znew = Zi | {Zi}Ii=1,D,Dnew)π({Zi}I

i=1 | D,Dnew)

{Zi}Ii=1

π(Znew = Zi | {Zi}Ii=1,D,Dnew)π({Zi}I

i=1 | D)

* Assumes that Dnew does not tell us much about the past crisis types

Method 2: Approximate Online Inference

1 After the end of each crisis, rerun the Markov chain, yielding samplevectors {Z(l)

i }Ii=1 from the posterior π({Zi}I

i=1 | D).2 When a new crisis begins, use its data Dnew to calculate the Monte Carlo

estimates:

π̂(Znew = Zi | D,Dnew) =1L

π(Znew = Z(l)i | {Z(l)

i′ }Ii′=1,D,Dnew)

π̂(Znew 6= Zi ∀i | D,Dnew) =1L

π(Znew 6= Z(l)i ∀i | {Z(l)

i′ }Ii′=1,D,Dnew).

Part 2 is O(LIJ), very fast

6 Conclusions35

Optimal Decision Making

Want expected-cost-minimizing decision making during a crisis

The total cost of the new crisis is a function Cˆφ, {Z∗

i }Ii=1, Z∗

The intervention φ

The true type Z∗new of the current crisis

The vector of past crisis types {Z∗i }Ii=1, which give the context for Z∗new

Finding the expected cost of the crisis for intervention φ requiresintegrating C over the posterior distribution of

`{Zi}I

i=1, Znew´

Can be done exactly using Method 1, or approximately using Method 2

OfflineOnline

6 Conclusions37

OfflineOnline

6 Conclusions38

OfflineOnline

Simulation Study

Offline:

Simulate I crises from model

Compare MBC with distance-based clustering

OfflineOnline

Simulation Study

Offline Accuracy Criteria:

1 Pairwise Sensitivity: For pairs of crises of the same type, % assignedto the same cluster

for MBC, having prob. > 0.5 of being in the same cluster.

2 Pairwise Specificity: For pairs of crises not of the same type, %assigned to different clusters

for MBC, having prob. ≤ 0.5 of being in the same cluster.

3 Error of No. Crisis Types: The % error of the estimated number ofcrisis types

for MBC, post. mean is used to estimate No. of types.40

OfflineOnline

Simulation StudyNo. Crises No. Metrics Method Pairwise Pairwise % Error

Sensitivity Specificity No. Types15 10 MBC 94.6 (2.08) 99.0 (0.50) 9.3 (1.87)

K-Means 1 47.8 (4.26) 95.3 (0.57) –K-Means 2 74.8 (5.39) 77.9 (1.73) –

15 15 MBC 99.0 (1.00) 99.4 (0.41) 3.7 (0.95)K-Means 1 69.6 (4.76) 97.0 (0.54) –K-Means 2 88.3 (4.01) 78.2 (2.13) –

35 15 MBC 99.5 (0.24) 99.9 (0.03) 3.4 (0.67)K-Means 1 59.3 (4.07) 97.8 (0.27) –K-Means 2 81.1 (4.74) 86.7 (1.48) – 41

OfflineOnline

Simulation Study

MBC does far better than K-means

More metrics ⇒ better accuracy of MBC

More crises 6⇒ better accuracy of MBC

OfflineOnline

6 Conclusions43

OfflineOnline

Simulation Study

Online:

Compare Method 1 (“MBC-EX”) to Method 2 (“MBC”)

OfflineOnline

Simulation Study

Online Accuracy Criteria:

1 Full-data misclassification rate: % of crises with incorrect predictedtype, using all of the data for the new crisis.

2 p-period misclassification rate: % of crises with incorrect predictedtype, using the first p time periods of data for the new crisis.

3 Average time to correct identification: Avg. No. of time periodsrequired to obtain the correct identification

(“correct” predicted type: π̂(Znew 6= Zi ∀i | D,Dnew) > 0.5 if Z∗new 6= Z∗

i ∀i and otherwiseπ̂(Znew = Zi | D,Dnew) > 0.5 for some i ≤ I such that Z∗

new = Z∗i )

OfflineOnline

Simulation Study

Online Accuracy:

No. No. Method Full-data 3-period Avg. Time toCrises Metrics Misclassification Misclassification Identification15 10 MBC 6.7 (3.0) 10.7 (4.5) 1.31 (0.11)

MBC-EX 8 (2.5) 10.7 (4.5)15 15 MBC 6.7 (5.2) 9.3 (6.2) 1.13 (0.08)

MBC-EX 5.3 (3.9) 8.0 (4.9)25 10 MBC 13.6 (2.7) 15.2 (2.7) 1.33 (0.13)

MBC-EX 9.6 (2.0) 15.2 (3.4)25 15 MBC 2.4 (1.6) 4.0 (1.8) 1.15 (0.06)

MBC-EX 3.2 (1.5) 3.2 (1.5)

OfflineOnline

Simulation Study

Classification accuracy high (> 80%) for both MBC & MBC-EX

MBC not significantly worse than MBC-EX

3-period misclassification is not much > than full-data misclassification

Very early identification!

OfflineOnline

6 Conclusions48

OfflineOnline

Application to EHS

27 crises in EHS during Jan-Apr 2008.

The causes of some of these were diagnosed later:

ID Cause No. of knowncrises

A overloaded front-end 2B overloaded back-end 8C database configuration error 1D configuration error 1E performance issue 1F middle-tier issue 1G whole DC turned off and on 1H workload spike 1I request routing error 1

OfflineOnline

6 Conclusions50

OfflineOnline

Offline Application to EHS

Apply the Markov chain method to the set of 27 crises without the labels

Compare to those labels

OfflineOnline

Offline Application to EHSTrace plots of parallel tempering Markov chain samples of Z22:

0 2000 4000 6000 8000 10000

Geweke diag. p-value: 0.44 Gelman-Rubin scale factor: 1.0152

OfflineOnline

Post. mode cluster assignment has 58% prob.

Sizes of clusters:ID Cause No. of known No. identified No. MBC crises

crises by MBC matching knownA overloaded front-end 2 3 2B overloaded back-end 8 14 8C database configuration error 1 2 1D configuration error 1 0 0 (labeled as A)E performance issue 1 0 0 (labeled as B)F middle-tier issue 1 0 0 (labeled as I)G whole DC turned off and on 1 0 0 (labeled as B)H workload spike 1 1 1I request routing error 1 6 1

OfflineOnline

Post. mode crisis labels mostly match known clusters

The largest 5 clusters are correctly labelled

Four uncommon crisis types are clustered with more common types

Crises having different causes can have the same patterns in their metrics

Need to add metrics that distinguish these types effectively

OfflineOnline

6 Conclusions55

OfflineOnline

Online Application to EHSEvaluate online accuracy, treating the posterior mode from the offlinecontext as the gold standard.

Original ordering:

1 Full-data misclassification: 7.4%

2 3-period misclassification: 14.8%

3 Avg. time to correct iden.: 1.81

Permuting the crises:

1 Full-data misclassification: 5.9% (SE =3.4%)

2 3-period misclassification: 11.8% (SE =3.2%)

3 Avg. time to correct iden.: 1.56 (SE =0.07)

6 Conclusions57

Conclusions

Gave a method for fully Bayesian real-time crisis identification indistributed computing

Described how to use this to perform rapid expected-cost-minimizingcrisis intervention

Very accurate on both simulated data and data from a productioncomputing center

A copy of this paper and seminar are available at:http://people.orie.cornell.edu/woodard

ReferencesEscobar, M. D. and West, M. (1995).Bayesian density estimation and inference using mixtures.Journal of the American Statistical Association, 90, 577-588.

Geyer, C. J. (1991).Markov chain Monte Carlo maximum likelihood.in Computing Science and Statistics, Vol. 23: Proc. of the 23rd Symp. on theInterface, ed. E. Keramidas, pp. 156-163.

Jain, S. and Neal, R. M. (2004).A split-merge Markov chain Monte Carlo procedure for the Dirichlet processmixture model.Journal of Computational and Graphical Statistics, 13, 158-182.

Lau, J. W. and Green, P. J. (2007).Bayesian model-based clustering procedures.Journal of Computational and Graphical Statistics, 16, 526-558.

Zhang, J., Ghahramani, Z., and Yang, Y. (2004).A probabilistic model for online document clustering with application to noveltydetection.in Advances in Neural Information Processing Systems, ed. Y. Weiss. 59

Prior Constants

Prior hyperparameters chosen by combining information in data withexpert opinion

Reflect the fact that the server status measurements are chosen to beindicative of crisis type

Results far better than a “default” prior specification, which contradictsdata and experts

Prior Constantsα:

Prob. that 2 randomly chosen crises are of same type: 1/(α + 1)

EHS experts estimate as 0.1, giving α = 9

⇒ ∼13 types in 27 crises

γ(jk) ∼ Dir(a(j)). To choose a(j):

Prior mean of γ(jk) taken as empirical dist’n of Yi1j over i and j

Substantial prob. that one of the γ(jk) is “close” to 1:

π“(γ

(jk)1 > .85) OR (γ

(jk)2 > .95) OR (γ

(jk)3 > .85)

”= 0.5

Analogous for T(jk)··

Want expected-cost-minimizing decision making during a crisis

The total cost of the new crisis is a function Cˆφ, {Z∗

i }Ii=1, Z∗

The intervention φ

The true type Z∗new of the current crisis

The vector of past crisis types {Z∗i }I

i=1, which give the context for Z∗new

If we knew C,

given posterior sample vectors“{Z(l)

i }Ii=1, Z(l)

”from the exact Method

...the expected cost can be estimated as:

E(C) ≈ 1L

Chφ, ({Z(l)

i }Ii=1, Z(l)

new)i.

Have a similar expression for approximate inferences from Method 2

Don’t know C in practice

For interventions φ taken during previous crises can estimate C fromrealized costs

Otherwise can estimate C from expert knowledge

Since the goal is optimal intervention

...and since this requires the entire posterior distribution over`{Zi}I

i=1, Znew´...

we will avoid choosing a “best” cluster assignment

instead focusing on the accuracy of the “soft identification”, i.e. theposterior distribution over

`{Zi}I

i=1, Znew´

Simulation Study

K-means:

Criteria for choosing the number of clusters do not work well in ourcontext

So we apply K-means using the true number of clusters (“K-means 1”)

and half the true number of clusters (“K-means 2”)

This is unrealistically optimistic...

...but K-means still does terribly

model-based clustering for online crisis identification in ... · modeling computation and decision...

Documents

does standardization affect science linkage? …purpose,...

communities, spectral clustering, and random...

deﬁning conservation units in a stocking-induced genetic...

distributing computation to large gpu clusters | gtc...

security kim soo jin. 2 contents background introduction...

contents hebb. learn. patt. assoc. associator correlations...

weighted similarity estimation in data streams ·...

data mining techniques for dna microarray data › rocha ›...

method for increasing the computation speed of an ... ·...

clustering k-mean clustering

automatic computation of using fuzzy clustering

z ≤ 2.2 sdss...

clustering 2: hierarchical clustering

contents time series prediction ts & nns rbf model cs 476:...

zeno effect for quantum computation and...

clustering. overview definition of clustering existing...

texas learning and computation center high performance...

contents pca gha apex kernel pca cs 476: networks of neural...

alloy: clustering with crowds and computation ·...

guest lecture:...