Learning Causal Knowledge Graphs from Text Log Data
Aleksandr Eismont
Seminar Novel and Non-mainstream Advances in Data Science (IPD Böhm), 27.01.2022, Karlsruhe
KIT – The Research University in the Helmholtz Association
www.kit.edu
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Agenda
2
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Motivation
Causal discovery allows to:
3
Medicine
Economics
Climatology
Cloud System
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Motivation
“It expresses my firm belief that the current data-fitting direction taken by “Data Science” is temporary (read my lips!), that the future of “Data Science” lies in causal data interpretation…”
4
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Approach Structure
5
Raw Log Data
Event Time-Series
Log Templates
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Approach Structure
6
Raw Log Data
Event Time-Series
Log Templates
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Log Templates Generation
State-of-the-art algorithms:
7
1998 05-30-2016 10:02:30.146 sshd[1234]: Accepted password for ops from 192.0.2.3 port 12345
sshd[***]: Accepted password for *** from *** port ***
[S. Kobayashi et al., “Mining Causality of Network Events in Log Data”, 2018]
Raw Log Data
Log Templates
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Approach Structure
8
Raw Log Data
Event Time-Series
Log Templates
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
9
template_2
[T. Jia et al., “An Approach for Anomaly Diagnosis based on Hybrid Graph Model with Logs for Distributed Services”, 2017]
time
template_1
9
time
Log Templates
Event Time-Series
Frequency Computing
template_2
time
template_1
time
. . . . .
. . . . . .
.
. . . . .
. . . . . . .
.
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Approach Structure
10
Raw Log Data
Event Time-Series
Log Templates
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
11
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
12
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
13
[R.E. Neapolitan, “Learning Bayesian Networks”, 2004]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
14
Events
[P. Spirtes et al., “Causation, Prediction, and Search”, 2001]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
15
Events
Complete graph
[P. Spirtes et al., “Causation, Prediction, and Search”, 2001]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
16
Events
Complete graph
Remove edges between independent events
[P. Spirtes et al., “Causation, Prediction, and Search”, 2001]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
17
Events
Complete graph
Remove edges between independent events
Apply V-structure
[P. Spirtes et al., “Causation, Prediction, and Search”, 2001]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
18
Events
Complete graph
Remove edges between independent events
Apply V-structure
Apply orientation rules
[P. Spirtes et al., “Causation, Prediction, and Search”, 2001]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
19
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Score-based
20
[D.M. Chickering, “Optimal Structure Identification With Greedy Search”, 2002]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Score-based
21
Events
[D.M. Chickering, “Optimal Structure Identification With Greedy Search”, 2002]
Forward Equivalence Search (FES)
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Score-based
22
Events
FSE Local Maximum
[D.M. Chickering, “Optimal Structure Identification With Greedy Search”, 2002]
Forward Equivalence Search (FES)
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Score-based
23
Events
FSE Local Maximum
[D.M. Chickering, “Optimal Structure Identification With Greedy Search”, 2002]
Forward Equivalence Search (FES)
Backward Equivalence Search (BES)
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Score-based
24
Events
FSE Local Maximum
BES Local Maximum
[D.M. Chickering, “Optimal Structure Identification With Greedy Search”, 2002]
Forward Equivalence Search (FES)
Event Time-Series
Causal Knowledge Graph
Backward Equivalence Search (BES)
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Score-based
25
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Functional-based
26
[S. Shimizu et al., “DirectLiNGAM: A Direct Method for Learning a Linear Non-Gaussian Structural Equation Model”, 2011]
X
Y
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Functional-based
27
[S. Shimizu et al., “DirectLiNGAM: A Direct Method for Learning a Linear Non-Gaussian Structural Equation Model”, 2011]
X
Y
Event Time-Series
Causal Knowledge Graph
?
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Functional-based
28
[S. Shimizu et al., “DirectLiNGAM: A Direct Method for Learning a Linear Non-Gaussian Structural Equation Model”, 2011]
Event Time-Series
Causal Knowledge Graph
X
Y
?
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Functional-based
29
[S. Shimizu et al., “DirectLiNGAM: A Direct Method for Learning a Linear Non-Gaussian Structural Equation Model”, 2011]
Event Time-Series
Causal Knowledge Graph
X
Y
?
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Functional-based
30
[S. Shimizu et al., “DirectLiNGAM: A Direct Method for Learning a Linear Non-Gaussian Structural Equation Model”, 2011]
Event Time-Series
Causal Knowledge Graph
X
Y
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Functional-based
31
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Functional-based
32
Events
Complete graph
Remove edges between independent events
[S. Kobayashi et al., “A Quantitative Causal Analysis for Network Log Data”, 2021]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Functional-based
33
Events
Complete graph
Remove edges between independent events
Apply LiNGAM
[S. Kobayashi et al., “A Quantitative Causal Analysis for Network Log Data”, 2021]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Granger Causality
34
[C.W.J. Granger, “Investigating Causal Relations by Econometric Models and Cross-spectral Methods”, 1969]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Approach Structure
35
Raw Log Data
Event Time-Series
Log Templates
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Summary
36
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
References
[1] He, P., Zhu, J., Zheng, Z., Lyu, M.R.: “Drain: An Online Log Parsing Approach with Fixed Depth Tree”, 2017
[2] Makanju, A., Nur Zincir-Heywood, A., Milios, E.: “A Lightweight Algorithm for Message Type Extraction in System Application Logs”, 2012
[3] Nedelkoski, S., Bogatinovski, J., Acker, A., Cardoso, J., Kao, O.: “Self-Supervised Log Parsing”, 2020
[4] Colombo, D., Maathuis, M.H.: “Order-Independent Constraint-Based Causal Structure Learning”, 2012
[5] Le, T.D., Hoang, T., Li, J., Liu, L., Liu, H., Hu, S.: “A Fast PC Algorithm for High Dimensional Causal Discovery with Multi-Core PCs”, 2015
[6] Bühlmann, P., Kalisch, M., Maathuis, M.H.: “Variable selection in high-dimensional linear models: partially faithful distributions and the PC-simple algorithm”, 2009
[7] Aliferis, C.F., Tsamardinos, I., Statnikov, A.: “HITON: A Novel Markov Blanket Algorithm for Optimal Variable Selection”, 2003
[8] Tsagris, M.: “Bayesian Network Learning with the PC Algorithm: An Improved and Correct Variation”, 2018
[9] Hauser, A., Bühlmann, P.: “Characterization and Greedy Learning of Interventional Markov Equivalence Classes of Directed Acyclic Graphs”, 2011
[10] Ramsey, J., Glymour, M., Sanchez-Romero, R., Glymour, C.: “A million variables and
more: The Fast Greedy Equivalence Search algorithm for learning high-dimensional graphical causal models, with an application to functional magnetic resonance images”, 2017
[11] Shimizu, S., Hoyer, P., Hyvärinen, A., Kerminen, A.. “A Linear Non-Gaussian Acyclic Model for Causal Discovery”, 2006
[12] Zhang, K., Hyvärinen, A.: “On the Identifiability of the Post-Nonlinear Causal Model”, 2009
37
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Log Templates Generation
38
1998 05-30-2016 10:02:30.146 sshd[1234]: Accepted password for ops from 192.0.2.3 port 12345
sshd[***]: Accepted password for *** from *** port ***
[S. Nedelkoski et al., “Self-Supervised Log Parsing”, 2020]
Raw Log Data
Log Templates
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
39
time
template_1
39
[T. Jia et al., “An Approach for Anomaly Diagnosis based on Hybrid Graph Model with Logs for Distributed Services”, 2017]
raw log
raw log
raw log
raw log
log_template_1
log_template_2
log_template_3
log frequency
time
template_2
time
template_3
Log Templates
Event Time-Series
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
40
time
template_1
40
[C. Glymour et al., “Review of Causal Discovery Methods Based on Graphical Models”, 2019]
Log Templates
Event Time-Series
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
41
time
template_1
41
[C. Glymour et al., “Review of Causal Discovery Methods Based on Graphical Models”, 2019]
Log Templates
Event Time-Series
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
42
time
template_1
42
[C. Glymour et al., “Review of Causal Discovery Methods Based on Graphical Models”, 2019]
Log Templates
Event Time-Series
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
43
time
template_1
43
time
template_1
[C. Glymour et al., “Review of Causal Discovery Methods Based on Graphical Models”, 2019]
Log Templates
Event Time-Series
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
44
time
template_1
44
time
template_1
[C. Glymour et al., “Review of Causal Discovery Methods Based on Graphical Models”, 2019]
Log Templates
Event Time-Series
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
45
time
template_1
45
time
template_1
[C. Glymour et al., “Review of Causal Discovery Methods Based on Graphical Models”, 2019]
Log Templates
Event Time-Series
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
46
time
template_1
46
time
template_1
[C. Glymour et al., “Review of Causal Discovery Methods Based on Graphical Models”, 2019]
Log Templates
Event Time-Series
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Event Time-Series Creation
a) Sliding window
b) Thresholding
47
time
template_1
47
time
template_1
[C. Glymour et al., “Review of Causal Discovery Methods Based on Graphical Models”, 2019]
Log Templates
Event Time-Series
t
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
48
[A.R. Nogueira et al., “Causal Discovery in Machine Learning: Theories and Applications”, 2021]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
49
Height
Vocabulary
Child
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
50
Age
Height
Vocabulary
Child
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
51
Age
Height
Vocabulary
Child
Height and Vocabulary of Child are
conditional independent given Age of Child
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
52
Age
Height
Vocabulary
Child
Height and Vocabulary of Child are
conditional independent given Age of Child
First throw
Second throw
Dice
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Constraint-based
53
Age
Height
Vocabulary
Child
Height and Vocabulary of Child are
conditional independent given Age of Child
Sum
First throw
Second throw
Dice
The First and the Second throws of Dice are conditional dependent given the Sum of them
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Granger Causality
54
[M. Eichler, “Causal Inference in Time Series Analysis”, 2012]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
Granger Causality
55
[M. Eichler, “Causal Inference in Time Series Analysis”, 2012]
Event Time-Series
Causal Knowledge Graph
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Causal Inference Algorithm
56
Events
FSE Local Maximum
BES Local Maximum
[D.M. Chickering, “Optimal Structure Identification With Greedy Search”, 2002]
Forward Equivalence Search (FES)
Backward Equivalence Search (BES)
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
This talk is about...
asdasdasd
asdasdasd
57
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Example diagram
58
Insights
Predictions
Recommendations
Data
Machine Learning Model
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Example diagram
59
Engineering and �Environmental Systems
Healthcare
Other methods �with implicit domain knowledge
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Use info boxes to deliver main messages
60
Engineering and �Environmental Systems
It is a very heterogeneous field with 400+ use case specific studies.
Recent surveys structure the field by grouping various methods into taxonomies.
Up to date there are no existing energy-related publications.
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Example Workflow
61
Step 1
Step 2
Step 3
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
This talk is about...
Repeat and remind the agenda slide when you switch the sections
asdasd
62
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Summary
asdasd
63
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)
Backup
64
Aleksandr Eismont: Learning Causal Knowledge Graphs from Text Log Data
Seminar Novel and Non-mainstream Advances
in Data Science (IPD Böhm)