Time modulated generative probabilistic models for automated causal discovery

Abstract

Dependencies between different channels or different services in a client or server may be determined from the observation of the times of the incoming and outgoing of the packets constituting those channels or services. A probabilistic model may be used to formally characterize these dependencies. The probabilistic model may be used to list the dependencies between input packets and output packets of various channels or services, and may be used to establish the expected strength of the causal relationship between the different events surrounding those channels or services. Parameters of the probabilistic model may be either based on prior knowledge, or may be fit using statistical techniques based on observations about the times of the events of interest. Expected times of occurrence between events may be observed, and dependencies may be determined in accordance with the probabilistic model.

1 . A method for determining dependencies between a plurality of typed events pertaining to channels or services in a networked computing environment comprising a plurality of computers comprising:
 monitoring a plurality of timing characteristics comprising times of incoming and outgoing packets constituting a channel or a service for the plurality of typed events in the computers in the computer network; and   determining which of the typed events are dependent on which other of the typed events based on the timing characteristics.   
     
     
         2 . The method of  claim 1 , wherein the determining comprises fitting the timing characteristics of the plurality of typed events to a model. 
     
     
         3 . The method of  claim 2 , wherein the determining comprises using the model to determine which of the typed events are dependent on which other of the typed events based on the timing characteristics. 
     
     
         4 . The method of  claim 3 , wherein the determining comprises predetermining at least one behavior characteristic based on at least one timing characteristic, and using the behavior characteristic to determine which of the typed events are dependent on which other of the typed events based on the timing characteristics. 
     
     
         5 . The method of  claim 1 , wherein the determining comprises predetermining an expected structure of a timing characteristic. 
     
     
         6 . The method of  claim 1 , wherein the determining comprises hypothesis testing. 
     
     
         7 . The method of  claim 1 , wherein the determining comprises using maximum a posteriori on an expected number of dependent events. 
     
     
         8 . The method of  claim 1 , further comprising storing information pertaining to which of the typed events are dependent on which other of the typed events based on the timing characteristics. 
     
     
         9 . A system for determining at least one dependency between a plurality of events in a networked computing environment, the system comprising:
 an identification subsystem to identify possible dependencies between a plurality of input packets and a plurality of output packets for a plurality of channels or a plurality of services in the computer network;   an observation subsystem to observe a plurality of times of occurrence among the plurality of events in the computer network; and   a determination subsystem to determine the at least one dependency based on the times of occurrence among the plurality of events.   
     
     
         10 . The system of  claim 9 , wherein the identification subsystem utilizes a probabilistic model. 
     
     
         11 . The system of  claim 10 , wherein the probabilistic model uses a non-homogeneous Poisson process. 
     
     
         12 . The system of  claim 9 , wherein the determination subsystem predetermines an expected structure for the times of occurrence. 
     
     
         13 . The system of  claim 9 , further comprising an estimation subsystem to estimate an expected strength of a causal relationship between the events in the computer network. 
     
     
         14 . The system of  claim 9 , further comprising a detection subsystem to detect whether abnormal system behavior exists in the computer network. 
     
     
         15 . A computer-readable medium comprising computer-readable instructions for determining at least one dependency in a networked computing environment, the computer-readable instructions comprising instructions that:
 monitor an output channel and an input channel in the computer network;   identify a plurality of timing characteristics comprising times of incoming and outgoing packets constituting a channel or a service for the computers in the computer network; and   determine whether the output channel depends on the input channel.   
     
     
         16 . The computer-readable medium of  claim 15 , wherein the instructions that determine whether the output channel depends on the input channel utilizes a probabilistic model. 
     
     
         17 . The computer-readable medium of  claim 16 , wherein the probabilistic model is adapted in real-time. 
     
     
         18 . The computer-readable medium of  claim 16 , wherein the probabilistic model is used to model a plurality of periods of inactivity and models a plurality of time delays between the input packets and the output packets. 
     
     
         19 . The computer-readable medium of  claim 15 , further comprising instructions that:
 monitor additional input channels; and   for each additional input channel, determine whether the output channel depends on the additional input channel.   
     
     
         20 . The computer-readable medium of  claim 15 , further comprising instructions that:
 monitor additional output channels; and   for each additional output channel, determine whether the additional output channel depends on the input channel.