Modeling the operating system incident forecasting subsystem allows obtaining accurate and reliable forecasts. For this purpose, elements of the theory of heuristic self-organization and concrete realization of this theory-GMDH are applied. The data of the system log of OS hardware errors incidents were used as input data of the model. As a result of testing the proposed model based on test samples at different settings of the machine learning system and parameters (the degree of reference polynomial, the number of variables in the model of the characteristic polynomial, the number of selection series) obtained a much more accurate forecast. Thus, in comparison with classical regression methods or the method of exponential smoothing, GMDH gives not more than 4% of erroneous calculations using GMDH.
One of the most problematic areas when planning measures to prevent the consequences of
hardware failures of the operating system is to obtain an effective model for predicting incidents of
the operating system. Most authors do not raise the issue of classifying methods and models for
predicting the operation of operating systems (OS). As a review of the literature shows, currently the
most popular are classical incidents forecasting models (trending, regression), forecasting using
neural networks, and Markov models [
Among examples of the actions of the hardware, errors are logs registered by the operating system
[
To prove the correctness of this trend, it is possible to go in two ways: empirical and experimental.
It is possible to use the predictive trend model using regression analysis [
But, to obtain accurate and reliable forecasts in the study of complex objects, such as an incident
registration system, the theory of heuristic self-organization, and the concrete implementation of the
theory—GMDH [
The algorithm for finding the optimal structure model for the incident forecasting subsystem can
be represented in the form of the following steps [
partitioning sets 1. There is a sample in the form of the time series (TS) system: log = {( , )} =1, where ∈ ℜ
. Since for the GMDH operation, it is necessary to conduct learning and testing, the samples are divided into learning and test ones. In the practical GMDH implementation, the percentage of these samples is manually selected.
be set from the range {1, . . , } = . These sets satisfy the conditions for ∪ = 1 ∩ = 0. elements for which the index ∈ . The partition of the sample is written as follows: The matrix consists of row vectors for which the index ∈ . Vector 1 consists of those ∈ ℜ 1 = (
, ) , ∈ ℜ 3. Let’s define the base model. This model describes the relationship between a dependent variable
and free variables . For the forecasting algorithm being created, let’s use the Voltaire functional series (the so-called Kolmogorov-Gabor polynomial): =1
=1 =1
=1 =1 =1 = 0 + ∑ + ∑ ∑ + ∑ ∑ ∑ + ⋯. 4. In the model (1), = { | = 1, . . , } – set of free variables and -set of weights: = ⟨ , ,
| , , , … = 1, . . , ⟩. 5. Based on the set objectives, the objective function is selected – an external criterion that describes the quality of the model. A few commonly used external criteria are described below. 6. Inductively generated candidate models. In this case, restrictions are introduced on the length of the polynomial of the base model. For example, the degree of a polynomial of the base model should not exceed a specific natural value. Then the basic model is written as a linear combination of a given number 0 of products of free variables as follows:
= ( 1, 2, . . , 12, 1 2, 22, . . , ), where f is the linear combination function. Arguments (2) are redefined as follows: (1) (2) 1 2 → , 22 → , . . , 1 → 1, 2 → 2, . . , 21 → , → 0, order: form:
= ( 1, 2, . . , 0).
For coefficients linearly included in the model, one-index numbering is specified in the following = 1, . . , 0. In this case, the model can be represented as a linear combination of the Each model of the generated form (3) is defined by a linear combination of elements {( , . . , )} in which the set of indices { } = is subset {1, . . , 0}.
7. To configure these parameters, internal criteria are used; it is calculated using the training sample. To each element of a vector
− selection element , a vector is mapped . Next, a view matrix is constructed , which represents a set of column vectors .The matrix is divided into sub-matrixes and . The smallest remainder of the form | − |, where = ^ ^
^
[
returns the value of the parameter vector , which is calculated by the least-squares method where ∈ { , , }. The internal criterion for the model applies the standard error of the form: = 0 + ∑ .
(3) 2 = | − | .
^ 2 In accordance with the criterion 2 → , parameters are selected and errors are calculated on the test sample , where
= . When the model is complicated, the internal criterion does not give the minimum models of optimal complexity; therefore, it is not suitable for choosing a model. 8. To select the best models, let’s calculate their quality. For this, a control sample and an external criterion are used. The error in the sample is indicated as follows: 2 ( ) = 2 ( | ) = | − 0 | , ^ 2 where ∈ { , }, ∩ = 0. This means that the error is calculated on the sample with the model parameters obtained on the sample .
A model that provides a minimum of external criteria is considered optimal. With an increase in the number of variables in the model and the degree of the reference polynomial, obtaining the best forecasting model can increase significantly.
An application of a developed forecasting model in the C# language based on GHMD has been implemented. As a result of the program
module realization, the mathematical model of training selects the best models, and as a result of the selection of the best models get the best model, which will be used to predict security incidents of the investigated OS (Fig. 1). All data taken for forecasting in the developed model are average statistics from the Windows incident log. In principle, you can take such a time series based on the probability of meeting or on the basis of average data (averaging is performed for a fixed period).
On the graph of the input and processed data of the forecasting model based on GMDH, it is possible to estimate the discrepancy between the data of the real sample and the data (shown in black) obtained on the basis of the best forecasting GMDH model (shown in red) (Fig. 2). Prediction results are obtained with various system settings and various parameters (degree of the reference polynomial, number of variables of the characteristic polynomial model, number of selection series).
In order to predict the time series obtained from the incident log of the Windows family’s OS
based on GMDH, it is necessary to select the best models at each iteration of the method. This
approach reduces the total number of calculations (processor time) and also reduces the amount of
memory needed for the work of the method itself. Comparing the forecasting results, generated by the
GMDH model and by the autoregression, it is possible to use the created software product in practice.
Among examples of hardware actions, errors are ones registered by operating system logs. This
information in the logs of system events of the Windows OS, for example, there are following:
Problems in the file system structure; device controller error.
Error on the device.
Damage to the disk resource cluster and numbers of other similar errors [
As was shown in [
By changing the input parameters of the model (shown in Fig. 1) for the same input data of the TS, the parameters of the time series data sampling test part, and the ones of the real TS, it is possible to reject the results of the selection of changes in the model except for the best ones. Real data of TS are taken from the logs without preserving the pre-juvenile OS.
On the graph of the input and refined data of the forecast model based on the GMDH, it is possible to estimate the distribution of the real sample data and data (shown by the new color), which were taken on the basis of the short model to the forecast of the GMDH (shown by the black color) (Fig. 2).
When calculating the parameters of the GMDH model, we obtain the corresponding intermediate
data of the stages of calculation of the GMDH-based models:
Regularity criteria for the obtained models on optimization steps: S[
The module of a deviation estimation of the received forecasting models on all samples.
Some prediction results are obtained with various system settings and various parameters (degree of the reference polynomial, number of variables of the characteristic polynomial model, number of selection series) are shown in Fig. 3.
After testing the obtained forecasting subsystem and the generated test samples, it is found that the results of the model incidents forecasting model to predict OS incidents are taken with various system settings and parameters may differ slightly (not more than 4%).
The accuracy of predicting incidents of the same type over a given time series (computer system hardware incidents) can be assessed positively. Of course, if there is a lot of such data and they cover large numbers of sources with as many behaviors as possible, then the forecast will be more accurate.
The peculiarity of this model is the fairly accurate past results (if such points were not filmed in the time series before). The value of such a model may be manifested when the intervals for taking data to the incident log were high, but there is a need to determine the significance of this type of event in the past (incident investigation).
The use of a large number of polynomial models, such as those used in GMDH, allows one to obtain a much more accurate forecast for the task of forecasting OS incidents than classical regression methods, as well as the method of exponential smoothing.
An important aspect of the resulting model is that it can be used to obtain a retrospective forecast. This is especially useful when, as a result of the investigation, it is necessary to know the exact value of the TS. But, at the same time, there is no real value due to the large interval of bound values.