System Log Data Research Articles

Detecting Overlapping Data in System Logs Based on Ensemble Learning Method

Machine learning techniques are essential for system log anomaly detection. It is prone to the phenomenon of class overlap because of too many similar system log data. The occurrence of this phenomenon will have a serious impact on the anomaly detection of the system logs. To solve the problem of class overlap in system logs, this paper proposes an anomaly detection model for class overlap problem on system logs. We first calculate the relationship between the sample data and the membership of different classes, normal or anomaly, and use the fuzziness to separate the sample data of the overlapping parts of the classes from the data of the other parts. AdaBoost, an ensemble learning approach, is used to detect overlapping data. Compared with machine learning algorithms, ensemble learning can better classify the data of the overlapping parts, so as to achieve the purpose of detecting the anomalies of the system logs. We also discussed the possible impact of different voting methods on ensemble learning results. Experimental results show that our model can be effectively applied in a variety of basic algorithms, and the results of each measure have been improved.

Learning Management System Log Data Analysis via Machine Learning: A Case Study from Flipped Learning

Learning Management System Log Data Analysis via Machine Learning: A Case Study from Flipped Learning

Quantitative analysis of treatments using real-time image gated spot-scanning with synchrotron-based proton beam therapy system log data.

A synchrotron‐based real‐time image gated spot‐scanning proton beam therapy (RGPT) system with inserted fiducial markers can irradiate a moving tumor with high accuracy. As gated treatments increase the beam delivery time, this study aimed to investigate the frequency of intra‐field adjustments corresponding to the baseline shift or drift and the beam delivery efficiency of a synchrotron‐based RGPT system. Data from 118 patients corresponding to 127 treatment plans and 2810 sessions between October 2016 and March 2019 were collected. We quantitatively analyzed the proton beam delivery time, the difference between the ideal beam delivery time based on a simulated synchrotron magnetic excitation pattern and the actual treatment beam delivery time, frequency corresponding to the baseline shift or drift, and the gating efficiency of the synchrotron‐based RGPT system according to the proton beam delivery machine log data. The mean actual beam delivery time was 7.1 min, and the simulated beam delivery time in an ideal environment with the same treatment plan was 2.9 min. The average difference between the actual and simulated beam delivery time per session was 4.3 min. The average frequency of intra‐field adjustments corresponding to baseline shift or drift and beam delivery efficiency were 21.7% and 61.8%, respectively. Based on our clinical experience with a synchrotron‐based RGPT system, we determined the frequency corresponding to baseline shift or drift and the beam delivery efficiency using the beam delivery machine log data. To maintain treatment accuracy within ± 2.0 mm, intra‐field adjustments corresponding to baseline shift or drift were required in approximately 20% of cases. Further improvements in beam delivery efficiency may be realized by shortening the beam delivery time.

Multiclass Classification of Anomalous States of Computer Systems by Means of Intellectual Analysis of System Journals

The increasing importance of analyzing log files in large computer systems requires the development of automated methods for processing unstructured data to extract relevant information from large-scale log files without the need for human intervention. Analysis of unstructured system log data shows that anomalous events in computer systems can be represented in groups due to different causes of their occurrence. As a result, the task of identifying the types of anomalous states of computer systems is reduced not to binary, but to multi-class classification and can be solved by machine learning methods. Given that the number of anomalous events is generally small, it is advisable to use both “abnormal” and “normal” events to teach machine learning algorithms. As a result, the process of classifying the type of anomaly is reduced to a two-stage diagram. The first stage solves the problem of binary classification, which results in two classes: 1 – “anomaly” or 0 – “normal event.” The second stage solves the task of assessing a particular type of anomaly.

Framing the Clinical Encounter: Shared Decision-Making, Mammography Screening, and Decision Satisfaction

The study examines whether physicians’ framing of clinical interactions is related to patient shared decision-making (SDM) satisfaction when using a clinical decision support tool (CDST) concerning mammographic screening. To answer this question, we combined (a) system log data from a CDST, (b) content coding of the physicians’ message framing while using the CDST, and (c) a post-visit patient survey to assess SDM satisfaction concerning screening mammography. Results suggest that two types of message frames — consequence frames and numerical frames — moderated the relationship of the CDST on SDM satisfaction. When the CDST displayed low risk of breast cancer for a patient, physicians were able to improve the cognitive aspects of SDM satisfaction by framing the consequences of mammography screening in positive terms. However, when the physician delivered the numerical information in relative, rather than absolute terms, the patient’s SDM satisfaction was reduced. Our study advances previous message framing effect research in health communication from experimental settings to clinical encounters. It also discusses the importance of delivering risk-congruent frames in clinical settings.

Predicting achievement and providing support before STEM majors begin to fail

Prediction models that underlie “early warning systems” need improvement. Some predict outcomes using entrenched, unchangeable characteristics (e.g., socioeconomic status) and others rely on performance on early assignments to predict the final grades to which they contribute. Behavioral predictors of learning outcomes often accrue slowly, to the point that time needed to produce accurate predictions leaves little time for intervention. We aimed to improve on these methods by testing whether we could predict performance in a large lecture course using only students’ digital behaviors in weeks prior to the first exam. Early prediction based only on malleable behaviors provides time and opportunity to advise students on ways to alter study and improve performance. Thereafter, we took the not-yet-common step of applying this model and testing whether providing digital learning support to those predicted to perform poorly can improve their achievement. Using learning management system log data, we tested models composed of theory-aligned behaviors using multiple algorithms and obtained a model that accurately predicted poor grades. Our algorithm correctly identified 75% of students who failed to earn the grade of B or better needed to advance to the next course. We applied this model the next semester to predict achievement levels and provided a digital learning strategy intervention to students predicted to perform poorly. Those who accessed advice outperformed classmates on subsequent exams, and more students who accessed the advice achieved the B needed to move forward in their major than those who did not access advice.

Online Mingling: Supporting Ad Hoc, Private Conversations at Virtual Conferences

Even though many people have found today’s commonly used videoconferencing systems very useful, these systems do not provide support for one of the most important aspects of in-person meetings: the ad hoc, private conversations that happen before, after, and during the breaks of scheduled events—the proverbial hallway conversations. Here we describe our design of a simple system, called Minglr, which supports this kind of interaction by facilitating the efficient matching of conversational partners. We also describe a study of this system’s use at the ACM Collective Intelligence 2020 virtual conference. Analysis of our survey and system log data provides evidence for the usefulness of this capability, showing, for example, that 86% of people who used the system successfully at the conference thought that future virtual conferences should include a tool with similar functionality. We expect similar functionality to be incorporated in other videoconferencing systems and to be useful for many other kinds of business and social meetings, thus increasing the desirability and feasibility of many kinds of remote work and socializing.

Tools of the trade: a look at educators’ use of assessment systems

ABSTRACT Test-based accountability policy in the US has resulted in increased availability and use of assessment systems to support instructional decision making. Though limited, literature to date suggests an important role for these systems as tools, mediating teacher knowledge and action. We examine system log data from NWEA’s MAP assessment to better understand how and when educators use the system, report features valued by educators, and patterns of use at the individual, school, and district levels. Findings reveal limited engagement with the system, occurring primarily around testing windows with a small subset of reports. We describe the features of those reports as well as how those features relate to use across the school year. We also find use is primarily an individualized practice, with little variability in use accounted for among schools and districts. We conclude with implications for research as well as local policy and practice.

Analyzing enterprise information system’s feature use: a data-driven perspective

PurposeThe purpose of this study is to propose a data-driven perspective to analyze enterprise information system (EIS) feature use for understanding what and how the system features are actually used in the organization.Design/methodology/approachAn empirical study was conducted by analyzing information system (IS) log data collected from a well-known shipbuilding manufacturer in China. The multiple analytical approach employed in this study includes social network analysis, association rules learning and human dynamics.FindingsThis study first classified IS users into 41 core users and 325 general users. Then 24 core modules and 54 general modules were identified by social network analysis, and the correlation between them was analyzed. Finally, we found that the IS use time intervals for different user groups followed a power-law distribution, and IS use displayed strong burstiness and weak memory.Originality/valueThis study proposes a data-driven perspective to investigate how the system features are actually used in the organization. This study contributes to the literature and opens a new avenue for future IS use research. Furthermore, this study informs managers how to diagnose, maintain and optimize the implemented IS in order to maximize IS benefits.

Forecasting health of complex IT systems using system log data

Predicting the health of digital infrastructure is a vital issue to minimize downtime to maintain a high service level. This research work has applied predictive analytics to forecast future health of complex-IT (Information Technology) based infrastructure. Every subset of a complex IT infrastructure is at the level of a single machine, that tracks the run-time status of the system and generates electronic messages, error events, and further manual massages as ticket logs. This research has suggested a 3-step method to build a novel predictive analytics model using text mining algorithm for extracting features from the log data. Then, it provides a model for selecting the critical devices in the system and predicting their failure. The final step suggests a forecasting model to predict the health of infrastructure for a given timestamp. The models in the second step of this integrated approach are built using algorithms such as association rules and rank based algorithm. The time-series model is built using a machine learning methods (ANN and SVR). This approach can be readily applied to many other types of information technology-based medical, banking, energy infrastructure, and other applications.

Identifying key factors affecting college students’ adoption of the e-learning system in mandatory blended learning environments

ABSTRACTThe successful application of the e-learning system is of great significance to the implementation, management and continuous improvement of blended learning in higher education. Hence, we focused on identifying key factors affecting college students’ adoption of the e-learning system in mandatory blended learning environments. In this study, the Unified Technology Acceptance and System Success (UTASS) model was proposed, a method integrating self-reported and system log data was implemented, while the moderator variables of gender and major were considered. Self-reported questionnaires were distributed in the e-learning system-starC and a total of 287 valid questionnaires were collected, meanwhile system log was collected to record students’ actual behavior online. Structural equation modeling analysis revealed that system quality (SQ), social influence (SI) and facilitating conditions (FC) have significant positive effects on behavioral intention (BI) whereas information quality (IQ) has none on BI. There is no significant positive relationship among FC, BI and use behavior (UB), and only moderator effect of gender exists. The results suggested that male college students are more susceptible to the impact of system quality and social influence.

An anomaly prediction framework for financial IT systems using hybrid machine learning methods

In financial field, a robust software system is of vital importance to ensure the smooth operation of financial transactions. However, many financial corporations still depend on operators to identify and eliminate the system failures when financial software systems break down. This traditional operation method is time consuming and extremely inefficient. To improve the efficiency and accuracy of system failure detection and thereby reduce the impact of system failures on financial services, we propose a novel machine learning-based framework to predict the occurrence of system exceptions and failures in a financial software system. In particular, we first extract rich information from system logs and eliminate noises in the data. Then the cleaned data is leveraged as the input of our proposed anomaly prediction framework which consists of three modules: key performance indicator(KPI) data prediction module, anomaly identification module and severity classification module. Notably, we design a hierarchical architecture of alarm classifiers and try to alleviate the influence of class-imbalance problem on the overall performance. Empirically, the experimental results demonstrate the superior performance of our proposed method on a real-world financial software system log data set.

Usage of query-based health information exchange after event notifications.

ObjectivesThis study sought to quantify the association between event notifications and subsequent query-based health information exchange (HIE) use among end users of three different community health information organizations.Materials and MethodsUsing system-log data merged with user characteristics, regression-adjusted estimates were used to describe the association between event notifications and subsequent query-based HIE usage.ResultsApproximately 5% of event notifications were associated with query-based HIE usage within 30 days. In adjusted models, odds of query-based HIE usage following an event notification were higher for older patients and for alerts triggered by a discharge event. Query-based HIE usage was more common among specialty clinics and Federally Qualified Health Centers than primary care organizations.Discussion and ConclusionIn this novel combination of data, 1 in 20 event notifications resulted in subsequent query-based HIE usage. Results from this study suggest that event notifications and query-based HIE can be applied together to address clinical and population health use cases.

Storage and access optimization scheme based on correlation probabilities in the internet of vehicles

Following the rapid development of the Internet of vehicles (IoV), many issues and challenges do come up as the storage of large quantities of vehicle network data and improvement of the retrieval efficiency. A great deal of global positioning system (GPS) log data and vehicle monitoring data is generated on IoV. When many small files in the conventional Hadoop Distributed File System (HDFS) are accessed, a series of problems arise such as high occupancy rate, low access efficiency and low retrieval efficiency, which lead to degrade the performance of IoV. In an attempt to tackle these bottleneck problems, a small Files Correlation Probability (FCP) model is proposed, which is based on the Text Feature Vector (TFV) presented in this paper. The Small Files Merge Scheme based on FCP (SFMS-FCP) and the Small File Prefetching and Caching Strategies (SFPCS) are proposed to optimize the storage and access performance of HDFS. Finally, experiments show that the proposed optimization solutions achieve better performance in terms of high occupancy of HDFS name nodes and low access efficiency, compared with the native HDFS read-write scheme and HAR-based read-write optimization scheme.

Internet of Things (IoT): BLYNK Framework for Smart Home

.

Participation in Online Courses and Interaction With a Virtual Agent

Online learning environments could be well understood as a multifaceted phenomenon affected by different aspects of learner participation including synchronous/asynchronous interactions. The aim of this study was to investigate learners’ participation in online courses, synchronous interaction with a conversational virtual agent, their relationships with learner performance, and the participation/interaction factor identification. To examine learner participation, we collected learning management system (LMS) log data that included the frequency and length of course access, discussion board postings, and final grades. To examine synchronous learner interaction, we collected learners’ conversation logs from the conversational agent. We calculated the quantity and quality of discussion postings and conversations with the agent. The results showed that the frequency and length of course access, the quantity and quality of discussion postings, and the quality of conversation with the agent were significantly associated with the learner achievement. This study also identified two factors that comprise online learning participation and interaction: interaction quality and LMS-oriented interaction.

Participation in Online Courses and Interaction With a Virtual Agent

Online learning environments could be well understood as a multifaceted phenomenon affected by different aspects of learner participation including synchronous/asynchronous interactions. The aim of this study was to investigate learners’ participation in online courses, synchronous interaction with a conversational virtual agent, their relationships with learner performance, and the participation/interaction factor identification. To examine learner participation, we collected learning management system (LMS) log data that included the frequency and length of course access, discussion board postings, and final grades. To examine synchronous learner interaction, we collected learners’ conversation logs from the conversational agent. We calculated the quantity and quality of discussion postings and conversations with the agent. The results showed that the frequency and length of course access, the quantity and quality of discussion postings, and the quality of conversation with the agent were significantly associated with the learner achievement. This study also identified two factors that comprise online learning participation and interaction: interaction quality and LMS-oriented interaction.

Relations among participation, fairness and performance in collaborative learning with Wiki‐based analytics

ABSTRACTUtilizing data analytics for supporting collaborative learning is under‐studied in secondary education. This study aims to evaluate the effectiveness of Wiki and Wiki‐based learning analytics in facilitating collaborative learning in a junior secondary school, in terms of students' participation, contribution, performance, and perception. A Wiki‐based learning analytic tool, Wikiglass, was employed for visualizing statistics of students' contributions and participation (e.g., revision counts) in Wiki, on both the group and individual levels. System log, student survey and performance data were collected from students involved in a Wiki‐supported inquiry project assignment. An Unfairness Index is proposed to measure students' group work distribution. Results of statistical analyses show that fairness of group work distribution was positively related to active participation in revisions on Wiki on the group level, and the number of sentences with higher‐order thinking was related to group performance scores. On the level of individual students, Wiki‐based analytics increased the visibility of work distribution and peers' work progress and contributions which might have changed students' collaborative behaviors.

Integration of an in-home monitoring system into home care nurses’ workflow: A case study

BackgroundThe healthcare system faces a major challenge in caring for an increasingly ageing population as this task requires more resources than are currently available. Adopting monitoring technologies could enable more efficient care practices and support ageing in place. ObjectivesTo investigate how the use of an in-home motion monitoring system can be integrated into home care nurses’ workflows and to uncover the factors behind system adoption. DesignA single case study adopting a qualitative approach. SettingA home care unit serving older adults living in independent living residences within an apartment complex. MethodMultiple data collection methods were used including individual and group interviews, a questionnaire with open-ended questions, evaluation probes, and system log data. The qualitative material was analysed using a stepwise-deductive inductive approach. ResultsA central factor behind system adoption was the perceived usefulness of gaining information about older adults’ night-time activities. In particular, monitoring older adults suffering from memory disorders was considered advantageous. The information that the system provided supported nurses in health assessments and assisted in adjusting care decisions. Previous negative experiences with similar technologies initially influenced the time for adoption. Further, although nurses were closely involved in the system design process, they took some time to get acquainted with the system and to integrate its use into daily practice. System reliability and accuracy issues influenced nurses’ trust in the sensory data. ConclusionThe findings suggests that in a home care setting, focusing on motion pattern monitoring for older adults with memory disorders can provide significant benefits and therefore also facilitate system adoption among nurses. Involving nurses in the design of the technology and providing opportunities to trial the system in real practice also appear to be important in achieving system adoption.

Cyber anomaly detection: Using tabulated vectors and embedded analytics for efficient data mining

Firewalls, especially at large organizations, process high velocity internet traffic and flag suspicious events and activities. Flagged events can be benign, such as misconfigured routers, or malignant, such as a hacker trying to gain access to a specific computer. Confounding this is that flagged events are not always obvious in their danger and the high velocity nature of the problem. Current work in firewall log analysis is manual intensive and involves manpower hours to find events to investigate. This is predominantly achieved by manually sorting firewall and intrusion detection/prevention system log data. This work aims to improve the ability of analysts to find events for cyber forensics analysis. A tabulated vector approach is proposed to create meaningful state vectors from time-oriented blocks. Multivariate and graphical analysis is then used to analyze state vectors in human–machine collaborative interface. Statistical tools, such as the Mahalanobis distance, factor analysis, and histogram matrices, are employed for outlier detection. This research also introduces the breakdown distance heuristic as a decomposition of the Mahalanobis distance, by indicating which variables contributed most to its value. This work further explores the application of the tabulated vector approach methodology on collected firewall logs. Lastly, the analytic methodologies employed are integrated into embedded analytic tools so that cyber analysts on the front-line can efficiently deploy the anomaly detection capabilities.