TY - GEN
T1 - A Method for the Joint Analysis of Numerical and Textual IT-System Data to Predict Critical System States
AU - Kubiak, Patrick
AU - Rass, Stefan
AU - Pinzger, Martin
AU - Schneider, Stephan
PY - 2021/7/1
Y1 - 2021/7/1
N2 - We present a method for the joint analysis of textual and numerical IT-system data usable to predict possibly critical system states. Towards a comparative discussion culminating in a justified model and method choice, we apply logistic regression, random forest and neural networks to the prediction of critical system states. Our models consume a set of different monitoring performance metrics and log file events. To ease the analysis of IT-systems, our models judge the future system state using one binary outcome variable for the system state’s criticality as “alarm” or “no alarm”. Moreover, we use feature importance measures to give IT-operators guidance on which system parameters, i.e., features, to consider primarily when responding to an alarm. We evaluate our models using different configurations, including (among others) the demanded lead time window for incident response, and a set of common performance measures. This paper is an extension to previous work that adds details on how to jointly process textual and numerical data.
AB - We present a method for the joint analysis of textual and numerical IT-system data usable to predict possibly critical system states. Towards a comparative discussion culminating in a justified model and method choice, we apply logistic regression, random forest and neural networks to the prediction of critical system states. Our models consume a set of different monitoring performance metrics and log file events. To ease the analysis of IT-systems, our models judge the future system state using one binary outcome variable for the system state’s criticality as “alarm” or “no alarm”. Moreover, we use feature importance measures to give IT-operators guidance on which system parameters, i.e., features, to consider primarily when responding to an alarm. We evaluate our models using different configurations, including (among others) the demanded lead time window for incident response, and a set of common performance measures. This paper is an extension to previous work that adds details on how to jointly process textual and numerical data.
UR - https://www.scopus.com/pages/publications/85113501753
U2 - 10.1007/978-3-030-83007-6_12
DO - 10.1007/978-3-030-83007-6_12
M3 - Conference proceedings
SN - 978-3-030-83007-6
T3 - Communications in Computer and Information Science
SP - 242
EP - 261
BT - Software Technologies - 15th International Conference, ICSOFT 2020, Revised Selected Papers
A2 - van Sinderen, Marten
A2 - Maciaszek, Leszek A.
A2 - Fill, Hans-Georg
PB - Springer Verlag GmbH
CY - Berlin, Heidelberg, New York
ER -
