Hanzhang Wang

Technologies are disclosed herein for enhancing machine learning (?ML?) -based anomaly detection systems using knowledge graphs. The disclosed technologies generate a connected graph that defines a topology of infrastructure components along with associated alarms generated by a ML component. The ML component generates the alarms by applying ML techniques to real-time data metrics generated by the infrastructure components. Scores are computed for the infrastructure components based upon the connected graph. A root cause of an anomaly affecting infrastructure components can then be identified based upon the scores, and remedial action can be taken to address the root cause of the anomaly. A user interface is also provided for visualizing aspects of the connected graph.

Process flow graphs are generated from system trace data by obtaining raw distributed trace data for a system, aggregating the raw distributed trace data into aggregated distributed trace data, generating a plurality of process flow graphs from the aggregated distributed trace data, and storing the plurality of process flow graphs in a graphical store. A first critical path can be determined from the plurality of process flow graphs based on an infrastructure design for the system and a process flow graph corresponding to the first critical path provided for graphical display. Certain examples can determine a second critical path involving a selected element of the first critical path and provide the process flow graph for the second critical path for display. Some examples pre-process the aggregated distributed trace data to repair incorrect traces. Other examples merge included process flow graphs into longer graphs.

Technologies are disclosed herein for enhancing machine learning (?ML?) -based anomaly detection systems using knowledge graphs. The disclosed technologies generate a connected graph that defines a topology of infrastructure components along with associated alarms generated by a ML component. The ML component generates the alarms by applying ML techniques to real-time data metrics generated by the infrastructure components. Scores are computed for the infrastructure components based upon the connected graph. A root cause of an anomaly affecting infrastructure components can then be identified based upon the scores, and remedial action can be taken to address the root cause of the anomaly. A user interface is also provided for visualizing aspects of the connected graph.