1
$\begingroup$

The ps aux command in Unix machines prints out a list of process currently running, along with memory usage and CPU.

I'm trying to determine if it is viable to create a neural network that uses that information during a practical period of time, let's say a week, and learns what is 'normal behavior'. The idea is that when something changes, a new process name appears, or a known process starts consuming more resources than usual the network detects it.

So the output layer is one node, > .8 let's say everything is normal, below that something is out of the ordinary behavior.

Since computer systems can behave differently depending on the weekday, and from morning to night (ex. Friday is used for backups routines, and/or Wednesdays mornings there is always a peak in network traffic), it will be also useful in the input layer to include date information.

The process names are dynamic so I suppose the input layer of this network will vary depending on the training data, but to be honest it puzzles me how to manage the inputs and what type of hidden layer will perform better, especially because I did run a simple prototype that just monitors memory and CPU of a single process during normal behaviour and it fails to detect anomalies, the topology I used was a simple perceptron 2, 10, 10, 1.

$\endgroup$
1
  • $\begingroup$ You will need to define inputs to the network. $\endgroup$ Nov 26, 2017 at 9:41

1 Answer 1

1
$\begingroup$

My suggestion is to use an RNN or LSTM to model the temporal dynamics of the system. (Or some seq2seq attention-based model could be good as well).

Generally, these models an input at every time step and give an output: $$ z_t,\theta_t = f(x_t|\theta_{t-1}) $$ where $x_t,z_t$ are the input & output at $t$, and $\theta_t$ are the time-varying parameters used to track the current state of the system essentially. As you need the algorithm to change depending on the time, you should certainly feed in the time; however, the nice thing about the $\theta_t$ is that it allows the network to be conditioned on the local temporal environment as well, which should help it learn to behave differently at different times of the day even without explicitly referring to the time.

The real question is what the input and outputs should be, exactly. One simple suggestion is to let $z_t$ simply be an anomaly detector, i.e. a binary classification of $x_t$ given $\theta_t$. This is quite similar to your own initial approach.

As for $x_t$, you seem to have rather heterogeneous data, e.g. date and time (can be written as a real-valued vector, including say the day of the week, the current time time of the day, etc...) and the set of running processes, including their names and memory/processor consumption. For the process names, unless there is a fixed finite set of them, perhaps you can use character-level embeddings (similar to word embeddings); for the process consumptions, they can be represented as real-valued vectors. Simply concatenate these together every $\Delta t$ seconds to get $x_t$, and them send them to the network; in response it will return $z_t$ (whether the current system is anomalous) and update its internal state.

Note that training naively requires supervision in this formulation just above. If you do not have labeled datasets, then you will need to do unsupervised anomaly detection. One way to do this is to have your RNN act as an embedding network, meaning $z_t$ is now simply a latent vector, which you can reconstruct with another network (i.e. a regular fully connected network). (This is similar to VAEs). Then, to test the network, we can feed it data and use the embedding information to determine whether it is anomalous, in the sense that it is very different than the processes seen in training. For instance, if we assumed (VAE-style) a latent prior $p(z)$, then if $z_t$ was sufficiently far from zero, we could label it as an anomaly. Or, we could have the encoder (or decoder even) be a Bayesian Neural Network. Such networks allow the prediction to be a random variable such that we can estimate its predictive variance, i.e. $$ V_t = \mathbb{V}_{w\sim \mathcal{D}}[f(x_t|\theta_{t-1})] $$ where $w\sim \mathcal{D}$ indicates the distribution of the network parameters. When $V_t$ is too high, the input was likely anomalous. This can be done very efficiently by approximate Bayesian inference, which can be extended even to RNNs (e.g. this work).

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .