Unsupervised Learning and Online Anomaly Detection

The Large Hadron Collider (LHC) demands a huge amount of computing resources to deal with petabytes of data generated from High Energy Physics (HEP) experiments and user logs, which report user activity within the supporting Worldwide LHC Computing Grid (WLCG). An outburst of data and information is expected due to the scheduled LHC upgrade, viz., the workload of the WLCG should increase by 10 times in the near future. Autonomous system maintenance by means of log mining and machine learning algorithms is of utmost importance to keep the computing grid functional. The aim is to detect software faults, bugs, threats, and infrastructural problems. This paper describes a general-purpose solution to anomaly detection in computer grids using unstructured, textual, and unsupervised data. The solution consists in recognizing periods of anomalous activity based on content and information extracted from user log events. This study has particularly compared One-class SVM, Isolation Forest (IF), and Local Outlier Factor (LOF). IF provides the best fault detection accuracy, 69.5%.