Una característica nueva en Elastic 8.6 ofrece una vista más detallada del modelo de puntuación de detección de anomalías. Explica los factores que influencian las puntuaciones de anomalías específicas de tus datos.

Explaining anomalies detected by Elastic machine learning

Explicar anomalías detectadas por el machine learning de Elastic

Feature importance is a new capability in Elasticsearch machine learning that allows us to interpret and validate regression and classification models, which may be otherwise too complex to comprehend.

With Elasticsearch machine learning one can build regression and classification models for data analysis and inference. Accurate prediction models are often too complex to understand simply by looking at their definition. Using <a href="https://www.elastic.co/guide/en/machine-learning/7.6/dfa-regression.html#dfa-regression-feature-importance">feature importance</a>, introduced in Elastic Stack 7.6, we can now interpret and validate such models.
 <h2>Motivation</h2>Using data frame analytics (introduced in Elastic Stack 7.4), we can analyze multivariate data using <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/release-notes-7.4.0.html#enhancement-7.4.0">regression</a> and <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/release-notes-7.5.0.html#feature-7.5.0">classification</a>. These supervised learning methods train an ensemble of decision trees to predict target fields for new data based on historical observations.&nbsp;
While ensemble models provide good predictive accuracy, this comes at the cost of high complexity. Feature importance gives us a locally-accurate linear model representation of an ensemble model. Thus, it helps us to understand and to interpret the model predictions. There are two questions that feature importance can help us to answer.
First, we can ask whether what the model has learned about the data makes sense? Here, feature importance gives us tools to interpret and to verify the model predictions using domain knowledge. Sometimes, we may see that a feature has little impact on the prediction, and domain knowledge supports this observation. Then we can decide to remove the feature altogether to improve the model.
Second, we can ask ourselves what we can deduce from the learned dependencies between quantities in a data set? In this blog post, we show how one can use feature importance for exploratory data analysis. We’ll use the Elastic machine learning feature importance capability to analyze the World Happiness Report dataset and to discover the reasons for people’s happiness.&nbsp;
If you are interested in more technical details — and not afraid of a little Python — you can follow along using the accompanying <a href="https://github.com/elastic/examples/blob/master/Machine%20Learning/Feature%20Importance/feature_importance_in_elasticsearch.ipynb">Jupyter notebook</a>.
 <h2>(Data) Framing happiness</h2>Our ML capabilities are most often used in our <a href="https://www.elastic.co/security">Security</a> and <a href="https://www.elastic.co/observability">Observability</a> solutions, but sometimes we just like to have some fun, so we will try to investigate whether "money can buy happiness" using machine learning and feature importance. What are some of the factors that can determine happiness, and which is most important? Will buying a Rolls Royce make you happier? If not, then what will?
Making things more complicated, we know that different nationalities have different mentalities and value different things in life. You may have noticed this if you have lived in different countries or if you were traveling around the world. Yes, everyone has anecdotes, but can this observation be measured empirically? In fact, it can! And <a href="https://worldhappiness.report/">the World Happiness Report</a> is a survey that does just that — it ranks 156 countries by how happy their citizens perceive themselves to be.
As a data scientist, I knew I could get to the bottom of my Rolls Royce question.&nbsp;
The World Happiness Report asks citizens of the surveyed countries to say how happy they are on a scale from 0 to 10. Additionally, the survey captures the following information:&nbsp;
<ul>
	<li>GDP per capita&nbsp;</li>
	<li>Social support&nbsp;</li>
	<li>Healthy life expectancies at birth&nbsp;</li>
	<li>Freedom to make life choices&nbsp;</li>
	<li>Generosity&nbsp;</li>
	<li>Perceptions of corruption&nbsp;</li>
	<li>Positive affection of the respondents&nbsp;</li>
	<li>Negative affection of the respondents</li>
</ul>The World Happiness Report for 2019 contains the historical survey data from 2008 through 2018.
 <h2>Feature importance: Digging a little deeper</h2>Feature importance is similar in concept to <a href="https://www.elastic.co/blog/interpretability-in-ml-identifying-anomalies-influencers-root-causes">influencers</a> in our unsupervised anomaly detection. They both help users to interpret and to more deeply understand (and trust) the results of the analytics. Yet, despite the similarity of these concepts, the implementation details are significantly different.
Within the context of data frame analytics, feature importance can be defined in many different ways. There are general model-independent definitions as well as those specific to decision trees. We use the SHAP (SHapley Additive exPlanations) Algorithm by <a href="https://papers.nips.cc/paper/7062-a-unified-approach-to-interpreting-model-predictions">Lundberg and Lee</a>. This algorithm assigns a SHAP value for every feature in every data point. The sum of these values for a data point gives us the deviation of model prediction from the baseline. The baseline value is the average of predictions for all data points in the training data set.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt1fb4efb98c89f350/5e7dfcfdcd562e2d656ce573/ml-feature-importance-decision-path-blog.png" data-sys-asset-uid="blt1fb4efb98c89f350" alt="Decision path" style="display: block; margin: auto;">
The figure above shows the decision path our model takes when predicting the happiness score of Argentina. The path starts at the baseline of 5.41 and then incrementally adds the feature importance values until it finally results in the predicted happiness score of 5.83. If the decision path goes left, the feature has a negative effect on the model prediction (e.g., generosity). If the decision path goes right, the feature has a positive effect (e.g., healthy_life_expectancy_at_birth).
Every feature importance value affects the decision of the model, increasing or decreasing the prediction. Hence, the features with the largest positive or negative feature importance values — with the largest absolute values — are the most significant for a particular data point.
For classification models, the sum of feature importance values approximates the predicted <a href="https://en.wikipedia.org/wiki/Logit">log-odds</a>. No worries if you don't know what a log-odd is. The takeaway message is that the effects of feature importance for classification can be interpreted in very much the same way as its effects for regression.
 <h2>Getting started with feature importance</h2>To activate feature importance computation in a data frame analytics job, we need to pass the configuration parameter "num_top_feature_importance_values" in the "analysis" section. The parameter defines the maximum number of feature importance values reported for every data point (see <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.6/put-dfanalytics.html#ml-put-dfanalytics-request-body">API Reference</a> for details).
Unless you have too many features and may run into the danger of exploding indices, you can set this parameter equal to the number of features in the data set. In our example, we set "num_top_feature_importance_values" to 8.
<pre class="prettyprint">PUT /_ml/data_frame/analytics/world-happiness-report
{
 "id": "world-happiness-report",
 "description": "",
 "source": {
 "index": [
 "world-happiness-report"
 ],
 "query": {
 "match_all": {}
 }
 },
 "dest": {
 "index": "whr-regression-results",
 "results_field": "ml"
 },
 "analysis": {
 "regression": {
 "dependent_variable": "life_ladder",
 "training_percent": 80,
 "num_top_feature_importance_values": 8 
 }
 },
 "analyzed_fields": {
 "includes": [],
 "excludes": [
 "year",
 "country_name"
 ]
 }
}
</pre>Then we trigger the analytics job:
<pre class="prettyprint">POST /_ml/data_frame/analytics/world-happiness-report/_start
</pre>Upon job completion, the feature importance values are stored in the destination index in the fields prefixed by “ml.feature_importance.” So, in our example, the feature importance of the field “generosity” is stored in the field “ml.feature_importance.generosity”.
It is likely that, for individual documents, the number of reported feature importance values will be smaller than the number specified in "num_top_feature_importance_values". This happens if a model does not require some features for a prediction: If a feature importance value is zero, it is not reported.
 <h2>Analyzing the data</h2>Since feature importance is computed for individual data points, we, of course, can aggregate those to average magnitudes over the complete data set and get a quick summary of which features are, in general, more important than others.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt4ca413cb7116c882/5e7e2b0d5b63ed09d2258fd2/ml-feature-importance-total-feature-importance-blog.png" data-sys-asset-uid="blt4ca413cb7116c882" alt="Total feature importance" style="display: block; margin: auto;">
We can immediately see that “healthy_life_expectancy_at_birth” is the most important feature. Also “log_gdp_per_capita” has generally a similar importance to “social_support”.
To dive a little deeper into the details, we can compare the distribution of feature importance values for different features, as shown below. Here, we see a combination of a scatter plot and a violin plot showing the importance values for individual features. Features with higher overall feature importance tend to have a more extensive spread from minimum to maximum.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt6f405dc9f6f93ccb/5e7e2b5f04b0f6372237c116/ml-feature-importance-distribution-blog.png" data-sys-asset-uid="blt6f405dc9f6f93ccb" alt="Feature importance distribution" style="display: block; margin: auto;">
Moreover, the diagram helps us to identify clusters of feature importance values. Indeed, it shows that “healthy_life_expectancy_at_birth” has several groups: On the left side, we have a large concentration of countries where life expectancy has negative feature importance. Those are the countries where low life expectancy reduces the happiness score. On the right side, we have a large concentration of countries where life expectancy has positive feature importance. High life expectancy in those countries increases the happiness score.
For the features “generosity”, “freedom_to_make_life_choices”, “perceptions_of_corruption”, and “negative_affect”, we see a large concentration of countries around 0 mark. For those countries, the features don’t have a significant effect on happiness.
Let’s now “zoom in” on the most distinctive feature “healthy_life_expectancy_at_birth” and look at the dependence plot. This plot shows the distribution of feature importance values as a function of feature values.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltcb5bd4ed81281369/5e7e2c6071abc60ae32d3fc3/ml-feature-importance-dependence-life-expectancy-blog.png" data-sys-asset-uid="bltcb5bd4ed81281369" alt="Dependence plot healthy life expectancy at birth" style="display: block; margin: auto;">
The dependence plot shows a linear relationship: the higher the feature value, the higher its effect on the prediction. We can also see a positive correlation between life expectancy and happiness. In the top right corner we see countries with a higher happiness score (red). Similarly, in the bottom left corner we see countries with a lower happiness score (blue).
However, interestingly and somewhat unexpected is the following observation: the linear dependency does not hold for life expectancy under 57 and over 72. On the right side of the plot, countries like Japan, South Korea, Spain, and France show that although they have a very long life expectancy, this has a comparably low effect on their happiness. Similarly, on the left side of the plot, we see African countries like Chad, Ivory Coast, Sierra Leone, Nigeria, and Mali with the shortest life expectancy but not the strongest negative effect of this feature on their happiness.
Come to think of it, people rarely worry about their life expectancy on a daily basis. This feature serves rather as a proxy for multiple factors such as quality of health care, air pollution, and sanitation. Once these factors are taken care of, life expectancy is affected by factors like genetics and diet, which are less correlated with happiness.
Looking at the same kind of plot for "log_gdp_per_capita", we see again the general correlation between the feature value and the feature importance as well as between the feature value and the happiness score.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltd9bafaee9f2e0ff2/5e7e2cbadf057a3646f915d0/ml-feature-importance-dependence-gdp-blog.png" data-sys-asset-uid="bltd9bafaee9f2e0ff2" alt="Dependence plot log GDP per capita" style="display: block; margin: auto;">
For log GDP over about 10.5 the importance of this feature stagnates and other features become more relevant. For example, although Luxembourg has almost an order of magnitude higher GDP per capita than the United Kingdom, for both these countries, this feature contributes equally to the overall prediction of the happiness score.
 <h2>Conclusions</h2>Is money important for happiness? <a href="https://www.elastic.co/blog/it-depends">It depends</a>. Every country has its unique empirically measurable profile of what makes its citizens happy on a macroscopic level.
Looking at the World Happiness Report, we can conclude that, overall, countries' wealth (as determined by GDP per capita), is only the second most significant factor. It is superseded by the ability to live a long and healthy life. Having a good social network of family and friends and enjoying happy moments in life are the other two important factors (way more important than a Rolls Royce).
We have seen that countries exhibit their individual "happiness profiles." For both most important features — GDP and healthy life expectancy — the importance stagnates at the extreme sides of the spectrum. This means that, for very rich and very poor countries, factors other than wealth become more important.&nbsp;
 <h2>Try it yourself</h2>Feature importance, released with Elasticsearch 7.6, makes it easier to understand and interpret regression and classification models. Moreover, it helps to gain insights into data and find relationships unknown before. You can try it yourself, using a <a href="https://www.elastic.co/elasticsearch/service">free trial of the Elasticsearch Service</a> and the <a href="https://github.com/elastic/examples/blob/master/Machine%20Learning/Feature%20Importance/feature_importance_in_elasticsearch.ipynb">accompanying Jupyter notebook</a>.

blog-banner-processing-dots-squares.jpg

blog-thumb-processing-dots-squares.jpg

Feature importance for data frame analytics with Elastic machine learning

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Valeriy Khakhutskyy

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

El contenido de esta página no está disponible en el idioma seleccionado. Elastic está trabajando para garantizar que el contenido esté disponible en varios idiomas. Gracias por tu paciencia mientras trabajamos.

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

Al enviar, confirma que ha leído y acepta nuestras <a href="/es/legal/elastic-cloud-account-terms" target="_self">Condiciones de servicio</a>, y que acepta recibir las <a href="/es/legal/privacy-statement#how-we-use-the-information" target="_self">comunicaciones seleccionadas</a> en los detalles de contacto que proporcionó anteriormente. Consulte la <a href="/es/legal/privacy-statement/" target="_self">Declaración de privacidad de Elastic</a> para obtener más información o para cancelar su suscripción en cualquier momento.

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

Al enviar, confirma que ha leído y acepta nuestras <a href="/es/legal/serverless-preview-terms" target="_self">Condiciones de servicio</a>, y que Elastic puede <a href="/es/legal/privacy-statement#how-we-use-the-information" target="_self">ponerse en contacto con usted</a> acerca de nuestros productos y servicios relacionados. Consulte la <a href="/es/legal/privacy-statement/" target="_self">Declaración de privacidad de Elastic</a> para obtener más información o para cancelar su suscripción en cualquier momento.

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

Al enviar esta información, aceptas los <a href="/es/agreements/global/cloud-services-monthly" rel="nofollow">Términos de servicio de Elastic</a>. Los datos personales se procesarán de conformidad con la <a href="/es/legal/privacy-statement">declaración de privacidad de Elastic</a>.

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

Al enviar, confirma que ha leído y acepta nuestras <a href="/es/legal/terms-of-use" target="_self">Condiciones de servicio</a>, y que Elastic puede <a href="/es/legal/privacy-statement#how-we-use-the-information" target="_self">ponerse en contacto con usted</a> acerca de nuestros productos y servicios relacionados. Consulte la <a href="/es/legal/privacy-statement/" target="_self">Declaración de privacidad de Elastic</a> para obtener más información o para cancelar su suscripción en cualquier momento.

Hosted by

All Solutions

Follow us on Youtube

Watch now (no PT)

Articles by

Share by Email

Filters

All (no PT translation)

Contact information

See when this webinar starts in my time zone

Ver cuándo comienza este webinar en mi zona horaria

Thank you for your interest!

Register to Attend

Small image for

Register to Watch

Continue reading

Featured webinar

What to explore next...

Reset all

Load more press releases

Sign In to Attend

Share

Upcoming webinar

Learn more

Search Integrations

Share on Reddit

Share on Twitter

Share on Facebook

Load more news

View more posts

On-demand webinar

Follow us on Facebook

Author

Press Release

You'll also receive an email with related content.

You'll also receive an email with related content

Además, te enviaremos contenidos relevantes

Print

Contact Info

Overview

Video for

Read less

Register now

Share this story

See All Posts

See all top stories

View next

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

¿No puedes asistir? Regístrate y te enviaremos la grabación. También recibirás un correo electrónico con contenido relacionado.

Follow us on LinkedIn

Highlights

Explore similar demos

Follow us on Twitter

Share on LinkedIn

Load More

See more insights

Speakers

Close

Thank you for registering. We will send you a confirmation email soon.

Gracias por registrarte. Te enviaremos un correo electrónico de confirmación pronto.

Author

Articles by Valeriy Khakhutskyy

Explicar anomalías detectadas por el machine learning de Elastic

Feature importance for data frame analytics with Elastic machine learning

Sign up for Elastic Cloud free trial