Elastic 8.6의 새로운 기능을 통해 이상 징후 탐지 점수 평가 모델을 보다 자세히 볼 수 있습니다. 이것은 데이터의 특정 이상 징후 점수에 영향을 미치는 요인을 설명합니다.

blog-elastic-single-bucket-impact.png

blog-elastic-multi-bucket-impact.png

blog-elastic-short-anomalies.png

blog-elastic-single-metric-viewer.png

blog-elastic-single-time-series-analysis.png

blog-thumb-blind-spots.png

Explaining anomalies detected by Elastic machine learning

Elastic 머신 러닝이 탐지하는 이상 징후 설명

Feature importance is a new capability in Elasticsearch machine learning that allows us to interpret and validate regression and classification models, which may be otherwise too complex to comprehend.

With Elasticsearch machine learning one can build regression and classification models for data analysis and inference. Accurate prediction models are often too complex to understand simply by looking at their definition. Using <a href="https://www.elastic.co/guide/en/machine-learning/7.6/dfa-regression.html#dfa-regression-feature-importance">feature importance</a>, introduced in Elastic Stack 7.6, we can now interpret and validate such models.
 <h2>Motivation</h2>Using data frame analytics (introduced in Elastic Stack 7.4), we can analyze multivariate data using <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/release-notes-7.4.0.html#enhancement-7.4.0">regression</a> and <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/release-notes-7.5.0.html#feature-7.5.0">classification</a>. These supervised learning methods train an ensemble of decision trees to predict target fields for new data based on historical observations.&nbsp;
While ensemble models provide good predictive accuracy, this comes at the cost of high complexity. Feature importance gives us a locally-accurate linear model representation of an ensemble model. Thus, it helps us to understand and to interpret the model predictions. There are two questions that feature importance can help us to answer.
First, we can ask whether what the model has learned about the data makes sense? Here, feature importance gives us tools to interpret and to verify the model predictions using domain knowledge. Sometimes, we may see that a feature has little impact on the prediction, and domain knowledge supports this observation. Then we can decide to remove the feature altogether to improve the model.
Second, we can ask ourselves what we can deduce from the learned dependencies between quantities in a data set? In this blog post, we show how one can use feature importance for exploratory data analysis. We’ll use the Elastic machine learning feature importance capability to analyze the World Happiness Report dataset and to discover the reasons for people’s happiness.&nbsp;
If you are interested in more technical details — and not afraid of a little Python — you can follow along using the accompanying <a href="https://github.com/elastic/examples/blob/master/Machine%20Learning/Feature%20Importance/feature_importance_in_elasticsearch.ipynb">Jupyter notebook</a>.
 <h2>(Data) Framing happiness</h2>Our ML capabilities are most often used in our <a href="https://www.elastic.co/security">Security</a> and <a href="https://www.elastic.co/observability">Observability</a> solutions, but sometimes we just like to have some fun, so we will try to investigate whether "money can buy happiness" using machine learning and feature importance. What are some of the factors that can determine happiness, and which is most important? Will buying a Rolls Royce make you happier? If not, then what will?
Making things more complicated, we know that different nationalities have different mentalities and value different things in life. You may have noticed this if you have lived in different countries or if you were traveling around the world. Yes, everyone has anecdotes, but can this observation be measured empirically? In fact, it can! And <a href="https://worldhappiness.report/">the World Happiness Report</a> is a survey that does just that — it ranks 156 countries by how happy their citizens perceive themselves to be.
As a data scientist, I knew I could get to the bottom of my Rolls Royce question.&nbsp;
The World Happiness Report asks citizens of the surveyed countries to say how happy they are on a scale from 0 to 10. Additionally, the survey captures the following information:&nbsp;
<ul>
	<li>GDP per capita&nbsp;</li>
	<li>Social support&nbsp;</li>
	<li>Healthy life expectancies at birth&nbsp;</li>
	<li>Freedom to make life choices&nbsp;</li>
	<li>Generosity&nbsp;</li>
	<li>Perceptions of corruption&nbsp;</li>
	<li>Positive affection of the respondents&nbsp;</li>
	<li>Negative affection of the respondents</li>
</ul>The World Happiness Report for 2019 contains the historical survey data from 2008 through 2018.
 <h2>Feature importance: Digging a little deeper</h2>Feature importance is similar in concept to <a href="https://www.elastic.co/blog/interpretability-in-ml-identifying-anomalies-influencers-root-causes">influencers</a> in our unsupervised anomaly detection. They both help users to interpret and to more deeply understand (and trust) the results of the analytics. Yet, despite the similarity of these concepts, the implementation details are significantly different.
Within the context of data frame analytics, feature importance can be defined in many different ways. There are general model-independent definitions as well as those specific to decision trees. We use the SHAP (SHapley Additive exPlanations) Algorithm by <a href="https://papers.nips.cc/paper/7062-a-unified-approach-to-interpreting-model-predictions">Lundberg and Lee</a>. This algorithm assigns a SHAP value for every feature in every data point. The sum of these values for a data point gives us the deviation of model prediction from the baseline. The baseline value is the average of predictions for all data points in the training data set.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt1fb4efb98c89f350/5e7dfcfdcd562e2d656ce573/ml-feature-importance-decision-path-blog.png" data-sys-asset-uid="blt1fb4efb98c89f350" alt="Decision path" style="display: block; margin: auto;">
The figure above shows the decision path our model takes when predicting the happiness score of Argentina. The path starts at the baseline of 5.41 and then incrementally adds the feature importance values until it finally results in the predicted happiness score of 5.83. If the decision path goes left, the feature has a negative effect on the model prediction (e.g., generosity). If the decision path goes right, the feature has a positive effect (e.g., healthy_life_expectancy_at_birth).
Every feature importance value affects the decision of the model, increasing or decreasing the prediction. Hence, the features with the largest positive or negative feature importance values — with the largest absolute values — are the most significant for a particular data point.
For classification models, the sum of feature importance values approximates the predicted <a href="https://en.wikipedia.org/wiki/Logit">log-odds</a>. No worries if you don't know what a log-odd is. The takeaway message is that the effects of feature importance for classification can be interpreted in very much the same way as its effects for regression.
 <h2>Getting started with feature importance</h2>To activate feature importance computation in a data frame analytics job, we need to pass the configuration parameter "num_top_feature_importance_values" in the "analysis" section. The parameter defines the maximum number of feature importance values reported for every data point (see <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.6/put-dfanalytics.html#ml-put-dfanalytics-request-body">API Reference</a> for details).
Unless you have too many features and may run into the danger of exploding indices, you can set this parameter equal to the number of features in the data set. In our example, we set "num_top_feature_importance_values" to 8.
<pre class="prettyprint">PUT /_ml/data_frame/analytics/world-happiness-report
{
 "id": "world-happiness-report",
 "description": "",
 "source": {
 "index": [
 "world-happiness-report"
 ],
 "query": {
 "match_all": {}
 }
 },
 "dest": {
 "index": "whr-regression-results",
 "results_field": "ml"
 },
 "analysis": {
 "regression": {
 "dependent_variable": "life_ladder",
 "training_percent": 80,
 "num_top_feature_importance_values": 8 
 }
 },
 "analyzed_fields": {
 "includes": [],
 "excludes": [
 "year",
 "country_name"
 ]
 }
}
</pre>Then we trigger the analytics job:
<pre class="prettyprint">POST /_ml/data_frame/analytics/world-happiness-report/_start
</pre>Upon job completion, the feature importance values are stored in the destination index in the fields prefixed by “ml.feature_importance.” So, in our example, the feature importance of the field “generosity” is stored in the field “ml.feature_importance.generosity”.
It is likely that, for individual documents, the number of reported feature importance values will be smaller than the number specified in "num_top_feature_importance_values". This happens if a model does not require some features for a prediction: If a feature importance value is zero, it is not reported.
 <h2>Analyzing the data</h2>Since feature importance is computed for individual data points, we, of course, can aggregate those to average magnitudes over the complete data set and get a quick summary of which features are, in general, more important than others.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt4ca413cb7116c882/5e7e2b0d5b63ed09d2258fd2/ml-feature-importance-total-feature-importance-blog.png" data-sys-asset-uid="blt4ca413cb7116c882" alt="Total feature importance" style="display: block; margin: auto;">
We can immediately see that “healthy_life_expectancy_at_birth” is the most important feature. Also “log_gdp_per_capita” has generally a similar importance to “social_support”.
To dive a little deeper into the details, we can compare the distribution of feature importance values for different features, as shown below. Here, we see a combination of a scatter plot and a violin plot showing the importance values for individual features. Features with higher overall feature importance tend to have a more extensive spread from minimum to maximum.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt6f405dc9f6f93ccb/5e7e2b5f04b0f6372237c116/ml-feature-importance-distribution-blog.png" data-sys-asset-uid="blt6f405dc9f6f93ccb" alt="Feature importance distribution" style="display: block; margin: auto;">
Moreover, the diagram helps us to identify clusters of feature importance values. Indeed, it shows that “healthy_life_expectancy_at_birth” has several groups: On the left side, we have a large concentration of countries where life expectancy has negative feature importance. Those are the countries where low life expectancy reduces the happiness score. On the right side, we have a large concentration of countries where life expectancy has positive feature importance. High life expectancy in those countries increases the happiness score.
For the features “generosity”, “freedom_to_make_life_choices”, “perceptions_of_corruption”, and “negative_affect”, we see a large concentration of countries around 0 mark. For those countries, the features don’t have a significant effect on happiness.
Let’s now “zoom in” on the most distinctive feature “healthy_life_expectancy_at_birth” and look at the dependence plot. This plot shows the distribution of feature importance values as a function of feature values.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltcb5bd4ed81281369/5e7e2c6071abc60ae32d3fc3/ml-feature-importance-dependence-life-expectancy-blog.png" data-sys-asset-uid="bltcb5bd4ed81281369" alt="Dependence plot healthy life expectancy at birth" style="display: block; margin: auto;">
The dependence plot shows a linear relationship: the higher the feature value, the higher its effect on the prediction. We can also see a positive correlation between life expectancy and happiness. In the top right corner we see countries with a higher happiness score (red). Similarly, in the bottom left corner we see countries with a lower happiness score (blue).
However, interestingly and somewhat unexpected is the following observation: the linear dependency does not hold for life expectancy under 57 and over 72. On the right side of the plot, countries like Japan, South Korea, Spain, and France show that although they have a very long life expectancy, this has a comparably low effect on their happiness. Similarly, on the left side of the plot, we see African countries like Chad, Ivory Coast, Sierra Leone, Nigeria, and Mali with the shortest life expectancy but not the strongest negative effect of this feature on their happiness.
Come to think of it, people rarely worry about their life expectancy on a daily basis. This feature serves rather as a proxy for multiple factors such as quality of health care, air pollution, and sanitation. Once these factors are taken care of, life expectancy is affected by factors like genetics and diet, which are less correlated with happiness.
Looking at the same kind of plot for "log_gdp_per_capita", we see again the general correlation between the feature value and the feature importance as well as between the feature value and the happiness score.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltd9bafaee9f2e0ff2/5e7e2cbadf057a3646f915d0/ml-feature-importance-dependence-gdp-blog.png" data-sys-asset-uid="bltd9bafaee9f2e0ff2" alt="Dependence plot log GDP per capita" style="display: block; margin: auto;">
For log GDP over about 10.5 the importance of this feature stagnates and other features become more relevant. For example, although Luxembourg has almost an order of magnitude higher GDP per capita than the United Kingdom, for both these countries, this feature contributes equally to the overall prediction of the happiness score.
 <h2>Conclusions</h2>Is money important for happiness? <a href="https://www.elastic.co/blog/it-depends">It depends</a>. Every country has its unique empirically measurable profile of what makes its citizens happy on a macroscopic level.
Looking at the World Happiness Report, we can conclude that, overall, countries' wealth (as determined by GDP per capita), is only the second most significant factor. It is superseded by the ability to live a long and healthy life. Having a good social network of family and friends and enjoying happy moments in life are the other two important factors (way more important than a Rolls Royce).
We have seen that countries exhibit their individual "happiness profiles." For both most important features — GDP and healthy life expectancy — the importance stagnates at the extreme sides of the spectrum. This means that, for very rich and very poor countries, factors other than wealth become more important.&nbsp;
 <h2>Try it yourself</h2>Feature importance, released with Elasticsearch 7.6, makes it easier to understand and interpret regression and classification models. Moreover, it helps to gain insights into data and find relationships unknown before. You can try it yourself, using a <a href="https://www.elastic.co/elasticsearch/service">free trial of the Elasticsearch Service</a> and the <a href="https://github.com/elastic/examples/blob/master/Machine%20Learning/Feature%20Importance/feature_importance_in_elasticsearch.ipynb">accompanying Jupyter notebook</a>.

blog-banner-processing-dots-squares.jpg

blog-thumb-processing-dots-squares.jpg

Feature importance for data frame analytics with Elastic machine learning

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Valeriy Khakhutskyy

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

제출하면 귀하가 <a href="/kr/legal/elastic-cloud-account-terms" target="_self">Elastic 서비스 약관</a>을 읽고 이에 동의하며, 위에 제공된 연락처로 <a href="/kr/legal/privacy-statement#how-we-use-the-information" target="_self">선택한 커뮤니케이션</a>을 수신하는 데 동의한 것으로 간주됩니다. 언제든지 수신을 거부할 수 있으며 자세한 내용은 <a href="/kr/legal/privacy-statement/" target="_self">Elastic 개인정보 취급방침</a>을 참조하시기 바랍니다.

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

제출하면 귀하가 Elastic <a href="/kr/legal/serverless-preview-terms" target="_self">서비스 약관</a>을 읽고 이에 동의하며, 위에 제공된 세부 정보를 사용하여 Elastic이 관련 제품 및 서비스에 대해 귀하에게 <a href="/kr/legal/privacy-statement#how-we-use-the-information" target="_self">연락할 수 있음</a>을 이해한 것으로 간주됩니다. 언제든지 수신을 거부할 수 있으며 자세한 내용은 <a href="/kr/legal/privacy-statement/" target="_self">Elastic 개인정보 취급방침</a>을 참조하시기 바랍니다.

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

제출하면 <a href="/kr/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud 서비스 약관</a>에 동의하시게 됩니다. 개인 데이터는 <a href="/kr/legal/privacy-statement">Elastic의 개인정보 취급방침</a>에 따라 처리됩니다.

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

제출하면 귀하가 Elastic <a href="/kr/legal/terms-of-use" target="_self">서비스 약관</a>을 읽고 이에 동의하며, 위에 제공된 세부 정보를 사용하여 Elastic이 관련 제품 및 서비스에 대해 귀하에게 <a href="/kr/legal/privacy-statement#how-we-use-the-information" target="_self">연락할 수 있음</a>을 이해한 것으로 간주됩니다. 언제든지 수신을 거부할 수 있으며 자세한 내용은 <a href="/kr/legal/privacy-statement/" target="_self">Elastic 개인정보 취급방침</a>을 참조하시기 바랍니다.

Explore similar demos

Overview

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

이 페이지의 콘텐츠는 선택하신 언어로 제공되지 않습니다. Elastic은 다양한 언어로 콘텐츠를 제공하기 위해 최선을 다하고 있습니다.조금만 더 기다려주세요!

Author

Articles by

Learn more

Watch now (no PT)

Watch now

See all top stories

All (no PT translation)

Contact information

Press Release

Share on Reddit

Share this story

Share by Email

Thank you for your interest!

Contact Info

Follow us on Youtube

Load More

Share on LinkedIn

Follow us on LinkedIn

Search Integrations

All Solutions

Video for

Follow us on Twitter

See when this webinar starts in my time zone

내 표준 시간대로 웨비나 시작 시간 확인하기

Register to Watch

Register now

See All Posts

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

참여가 어려우신가요? 등록하시면 녹화 자료를 보내드리겠습니다. 이메일로 관련 콘텐츠도 받아보실 수 있습니다.

Small image for

On-demand webinar

Featured webinar

Register to Attend

Share on Facebook

Reset all

Upcoming webinar

View more posts

Print

Hosted by

Sign In to Attend

View next

Follow us on Facebook

Share

Highlights

Read less

You'll also receive an email with related content

이메일을 통해 관련 내용을 보내드리겠습니다.

Thank you for registering. We will send you a confirmation email soon.

등록해 주셔서 감사합니다. 곧 확인 이메일을 보내드리겠습니다.

Author

Articles by Valeriy Khakhutskyy

Elastic 머신 러닝이 탐지하는 이상 징후 설명

Feature importance for data frame analytics with Elastic machine learning

Sign up for Elastic Cloud free trial