Big data and machine learning core technologies
Domain 2 - Big data and machine learning core technologies
This domain tests the technical stack beneath AIOps: what data operations produce, how it is stored and processed, which ML techniques are applied to which problems, and how models are evaluated.
The data layer
AIOps ingests metrics (time-stamped numbers), logs (unstructured or semi-structured text), traces (request paths across services), and events (deployments, config changes, tickets). Volume and cardinality are high; labels are scarce. Pipelines typically stream data through a broker, land it in a lake or time-series store, and enrich it with topology and change data. Data quality - completeness, timestamp accuracy, consistent service naming - determines model quality more than algorithm choice.
The ML layer
- Unsupervised learning dominates because labeled incidents are rare: clustering groups similar alerts; isolation forests and autoencoders flag outliers; change-point detection finds baseline shifts.
- Supervised learning is used where historical labels exist: classifying tickets, predicting disk failure, scoring incident severity.
- Time-series forecasting predicts capacity and detects deviations from seasonal baselines.
- NLP parses logs and ticket text, extracts entities, and now supports retrieval-augmented assistants.
- Causal and topology analysis separates correlated symptoms from root causes.
Evaluation must match operations: precision and recall at the alert level, false-positive rate per service, mean time to detect, and alert-to-incident ratio. A model with 99% accuracy can still be useless if the 1% is every real outage.
Worked example
A team receives 5,000 alerts daily, 40 of which become incidents. They cluster alerts by topology and text similarity, then apply anomaly detection to each cluster's metric baseline. Clustering cuts volume to 300; anomaly scoring ranks 25 as likely incidents. Precision is 60%, recall 95%. The team tunes the threshold to raise precision, accepting slower detection for some low-severity services. Reasoning: the bottleneck was triage capacity, so precision mattered more than raw accuracy; recall protected critical services.
Traps that cost marks
- Assuming supervised learning is always superior; incident labels are usually missing.
- Confusing correlation with causation.
- Thinking more data automatically improves results; noisy or unlabeled data hurts.
- Treating an LLM as the core detection engine rather than one component.
- Quoting accuracy alone; use precision, recall, and operational metrics.