AI Logic

Comprehensive documentation of the AI/ML logic powering Hawkeye's incident prediction system.

Overview

Hawkeye's AI system uses an advanced XGBoost machine learning model to predict incident severity and classification. The AI logic encompasses the entire pipeline from feature extraction to final prediction.

Core AI Components

1. Feature Extraction Engine

The AI system extracts and processes features from raw incident data:

def extract_features(incident_data):
    """
    Extract and engineer features from incident data
    """
    features = {}
    
    # Temporal features
    timestamp = parse_timestamp(incident_data.get('timestamp'))
    features['hour'] = timestamp.hour
    features['day_of_week'] = timestamp.weekday()
    features['is_weekend'] = timestamp.weekday() >= 5
    features['is_business_hours'] = 9 <= timestamp.hour <= 17
    
    # Categorical features
    features['incident_type'] = incident_data.get('incident_type')
    features['severity'] = incident_data.get('severity')
    features['source'] = incident_data.get('source', 'unknown')
    
    # Numerical features
    features['affected_users'] = incident_data.get('affected_users', 0)
    features['system_impact_score'] = calculate_impact_score(incident_data)
    
    # Derived features
    features['severity_numeric'] = encode_severity(features['severity'])
    features['time_since_last_incident'] = get_time_since_last_similar(
        features['incident_type']
    )
    
    return features

2. Preprocessing Pipeline

The AI preprocessing logic handles feature normalization and encoding:

Feature Scaling

from sklearn.preprocessing import StandardScaler
from joblib import load

scaler = load('xgb_advanced/scaler.joblib')

def scale_features(numerical_features):
    """
    Scale numerical features to standard distribution
    """
    return scaler.transform([numerical_features])[0]

Logic:

• Normalizes features to mean=0, std=1
• Ensures all numerical features are on the same scale
• Improves model convergence and accuracy

Target Encoding

from joblib import load

encoder = load('xgb_advanced/target_encoder.joblib')

def encode_categorical(categorical_features):
    """
    Encode categorical features using target encoding
    """
    return encoder.transform([categorical_features])[0]

Logic:

• Converts categorical variables to numerical representations
• Uses target encoding to preserve relationships with output
• Reduces dimensionality while maintaining information

3. XGBoost Prediction Logic

The core AI prediction logic using XGBoost:

import xgboost as xgb
from joblib import load
import numpy as np

model = load('xgb_advanced/xgboost_advanced_model.joblib')

def predict_incident(features):
    """
    Main AI prediction logic
    """
    # 1. Extract features
    numerical = extract_numerical(features)
    categorical = extract_categorical(features)
    
    # 2. Preprocess
    scaled = scale_features(numerical)
    encoded = encode_categorical(categorical)
    
    # 3. Combine features
    processed = np.hstack([scaled, encoded])
    
    # 4. Predict
    prediction = model.predict([processed])[0]
    probabilities = model.predict_proba([processed])[0]
    confidence = probabilities.max()
    
    # 5. Post-process
    result = {
        'prediction': prediction,
        'confidence': float(confidence),
        'probabilities': {
            'low': float(probabilities[0]),
            'medium': float(probabilities[1]),
            'high': float(probabilities[2]),
            'critical': float(probabilities[3])
        },
        'feature_contributions': get_feature_importance(features, model)
    }
    
    return result

4. Decision Logic

The AI decision-making process:

def make_decision(prediction_result):
    """
    AI decision logic based on prediction
    """
    prediction = prediction_result['prediction']
    confidence = prediction_result['confidence']
    
    # High confidence decisions
    if confidence >= 0.9:
        return {
            'action': 'immediate_response',
            'priority': 'high',
            'auto_escalate': True
        }
    
    # Medium confidence
    elif confidence >= 0.7:
        return {
            'action': 'review_required',
            'priority': 'medium',
            'auto_escalate': False
        }
    
    # Low confidence - human review
    else:
        return {
            'action': 'manual_review',
            'priority': 'low',
            'auto_escalate': False,
            'reason': 'Low confidence prediction'
        }

Model Architecture Logic

XGBoost Configuration

The AI model uses optimized hyperparameters:

model_params = {
    'objective': 'multi:softprob',
    'num_class': 4,
    'max_depth': 6,  # Optimized via Optuna
    'learning_rate': 0.1,  # Optimized via Optuna
    'min_child_weight': 3,
    'subsample': 0.8,
    'colsample_bytree': 0.8,
    'n_estimators': 500,
    'random_state': 42
}

Feature Importance Logic

The AI system tracks feature importance:

def get_feature_importance(features, model):
    """
    Calculate feature contributions to prediction
    """
    importance = model.feature_importances_
    feature_names = model.feature_names_in_
    
    contributions = {}
    for name, score in zip(feature_names, importance):
        contributions[name] = float(score)
    
    return dict(sorted(contributions.items(), 
                      key=lambda x: x[1], 
                      reverse=True))

Confidence Scoring Logic

def calculate_confidence(probabilities):
    """
    Calculate prediction confidence
    """
    # Maximum probability
    max_prob = max(probabilities)
    
    # Entropy-based confidence
    entropy = -sum(p * np.log(p + 1e-10) for p in probabilities)
    max_entropy = np.log(len(probabilities))
    normalized_entropy = 1 - (entropy / max_entropy)
    
    # Combined confidence score
    confidence = (max_prob * 0.7) + (normalized_entropy * 0.3)
    
    return confidence

Error Handling Logic

def safe_ai_predict(incident_data):
    """
    AI prediction with error handling
    """
    try:
        # Validate input
        if not validate_input(incident_data):
            raise ValueError("Invalid input data")
        
        # Extract features
        features = extract_features(incident_data)
        
        # Validate features
        if not validate_features(features):
            raise ValueError("Invalid feature extraction")
        
        # Make prediction
        result = predict_incident(features)
        
        # Validate output
        if result['confidence'] < 0.3:
            result['warning'] = 'Very low confidence - manual review recommended'
        
        return result
        
    except Exception as e:
        # Fallback logic
        return {
            'prediction': 'unknown',
            'confidence': 0.0,
            'error': str(e),
            'fallback': True
        }

Model Update Logic

def should_retrain_model():
    """
    Logic to determine if model should be retrained
    """
    # Check prediction accuracy over time
    recent_accuracy = get_recent_accuracy(days=30)
    
    # Check data drift
    data_drift = detect_data_drift()
    
    # Check time since last training
    days_since_training = get_days_since_training()
    
    # Decision logic
    if recent_accuracy < 0.85:
        return True, "Low accuracy detected"
    
    if data_drift > 0.1:
        return True, "Significant data drift detected"
    
    if days_since_training > 90:
        return True, "Model age threshold reached"
    
    return False, None

Performance Optimization Logic

# Model caching logic
model_cache = {}

def get_cached_model():
    """
    Lazy loading and caching of ML model
    """
    if 'model' not in model_cache:
        model_cache['model'] = load('xgb_advanced/xgboost_advanced_model.joblib')
        model_cache['scaler'] = load('xgb_advanced/scaler.joblib')
        model_cache['encoder'] = load('xgb_advanced/target_encoder.joblib')
    
    return model_cache

Model Files

The AI system uses the following model files from xgb_advanced/:

• xgboost_advanced_model.joblib - Main XGBoost model (~169 MB)
• scaler.joblib - Feature scaler for normalization (~1.7 KB)
• target_encoder.joblib - Target encoder for categorical features (~186 KB)
• feature_info.joblib - Feature metadata and schema (~609 B)
• optuna_study_advanced.pkl - Hyperparameter optimization study (~108 KB)
• feature_importance_advanced.png - Feature importance visualization (~100 KB)

BentoML Cloud Deployment

The Hawkeye ML model is deployed on BentoML Cloud for production use:

Production Endpoints

• API Endpoint: https://failure-prediction-prod-0d460137.mt-guc1.bentoml.ai
• Interactive Playground: https://service12.cloud.bentoml.com/deployments/failure-prediction-prod/playground

Using the Deployed Model

Python Example

import requests

# BentoML Cloud endpoint
api_url = "https://failure-prediction-prod-0d460137.mt-guc1.bentoml.ai/predict"

# Prepare incident data
incident_data = {
    "incident_type": "security",
    "severity": "high",
    "description": "Unauthorized access attempt detected",
    "affected_users": 150,
    "system_impact_score": 75.5
}

# Make prediction request
response = requests.post(api_url, json=incident_data)
prediction = response.json()

print(f"Prediction: {prediction}")

cURL Example

curl -X POST https://failure-prediction-prod-0d460137.mt-guc1.bentoml.ai/predict \
  -H "Content-Type: application/json" \
  -d '{
    "incident_type": "security",
    "severity": "high",
    "description": "Security breach detected",
    "affected_users": 150,
    "system_impact_score": 75.5
  }'

JavaScript/TypeScript Example

const apiUrl = "https://failure-prediction-prod-0d460137.mt-guc1.bentoml.ai/predict";

const incidentData = {
  incident_type: "security",
  severity: "high",
  description: "Unauthorized access attempt detected",
  affected_users: 150,
  system_impact_score: 75.5
};

const response = await fetch(apiUrl, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(incidentData),
});

const prediction = await response.json();
console.log('Prediction:', prediction);

BentoML Service Features

• Scalable Infrastructure: Auto-scaling based on demand
• High Availability: Redundant deployments for reliability
• API Gateway: Built-in load balancing and routing
• Monitoring: Real-time metrics and logging
• Interactive Playground: Test predictions directly in the browser

Model Version

The deployed model uses:

• Model Type: XGBoost Advanced
• Deployment Name: failure-prediction-prod
• Status: Production
• Model Files: All files from xgb_advanced/ directory are packaged in the BentoML service