{
  "video": {
    "id": "u1yaOeEX4e8",
    "title": "Learned Execution Graphs for Anomaly Detection & Drift in APIs — Ritvik Pandya, JP Morgan Chase",
    "duration": 1178,
    "upload_date": null,
    "channel": "AI Engineer",
    "source": "AI Engineer",
    "event_format": "In person"
  },
  "analysis": {
    "video_id": "u1yaOeEX4e8",
    "title": "Learned Execution Graphs for Anomaly Detection & Drift in APIs — Ritvik Pandya, JP Morgan Chase",
    "one_liner": "A JP Morgan payments lead's recipe for API anomaly detection: model each request's end-to-end path as a short-lived execution DAG, baseline it per client and per endpoint, then classify what changed — structural, scale, or co-variate drift — so an alert names the exact node instead of just \"it's slow\".",
    "summary": "Ritvik Pandya, who leads a payments team at JP Morgan, distinguishes execution graphs — short-lived DAGs of how one request was actually processed — from the persistent property graphs people usually mean (Neo4j and friends). Representing the whole path (edge layer → gateway/ingress → authn/authz → orchestration → parallel services → client notification) as a DAG gives you the execution order, the context passed node to node, and a per-node baseline, so a deviation localises to the service that caused it — his example is the foreign-transaction FX rate service running slow inside an otherwise-healthy 700ms request. He splits deviation into anomalies (one bad commute) versus drift (the commute has taken 20 minutes longer for a year), then sub-classifies drift as structural, scale/volume, or co-variate, because the category determines the fix. The pipeline is OpenTelemetry fed asynchronously so detection never slows real-time payments, Kafka plus stream assessment, a fast hot path and a slower more accurate recon path, and automated remediation rolled out to 5–10% of machines before 100%.",
    "key_points": [
      "Execution graphs are short-lived per-request DAGs, explicitly not persistence/property graphs like Neo4j; the DAG encodes service execution order and what context each node passes to the next, and every retry loop is modelled as a separate entity so it can be tracked.",
      "Checks are tiered like airport security: the tier-one check is the end-to-end baseline — \"someone is looking at the boarding pass and let you go\" — and you only spend resources on deeper tiers (scale deviations, divergence, exponential moving average) when the top-level timing is off.",
      "Baselines must be per client, not global: a local client and an overseas client legitimately differ, so a single threshold generates noise.",
      "Anomaly vs drift, via a commute analogy: one slow day is an incident; a year-on-year shift from 60 minutes to 80 means the pattern changed and you need a new baseline.",
      "Drift is categorised so the remedy follows: structural (a node added or removed — the coffee shop starts asking about membership), scale/volume (scale the service up or make the call asynchronous), co-variate (traffic mix shifts from 60% local / 40% foreign toward foreign — \"nothing changed, your system is working fine\" but you either split into two graphs or raise the baseline), and same-request-different-behaviour, which may warrant a rollback.",
      "Benchmarking used OpenTelemetry and a \"star bench\" suite: millions of traces over 7 days, with anomalies deliberately injected to train the system before it went live.",
      "Runtime architecture: telemetry fed asynchronously (because real-time payment processing must not be delayed), Kafka plus stream assessment, and two paths — a hot path for fast decisions and a slower recon path that is more accurate.",
      "Automation is risk-gated: after root-cause analysis and drift classification, assess the risk, roll the remediation to 5% or 10% of machines, verify, then go to 100%.",
      "Reported result: mean time to discovery dropped substantially, moving from waiting on multiple time windows to a single window."
    ],
    "takeaways": [
      "Instrument for tail-based sampling, since what you are measuring is when each node's span started and ended — head-based sampling won't reliably give you the whole graph.",
      "Tune how long you wait before declaring a structural change: if 6 of 7 nodes have reported and the 7th event is merely delayed, treating that as \"a node was removed\" is a false alarm.",
      "Scope baselines to the operation, not the HTTP verb — not one number for all POSTs, but separate numbers for POST real-time payments versus POST wire payments — and give a brand-new endpoint its own cold-start baseline rather than a generic one.",
      "For the detection step, use MMD or KL divergence, confirm with an admin, then classify the drift type before choosing an action.",
      "Make the output explainable: \"your health score is 22\" is as useless from a monitoring system as from a doctor — ship the supporting data so someone can make an informed decision.",
      "Feed deployment events into the system so it knows a change just shipped and can decide whether to roll back."
    ],
    "topics": [
      "observability",
      "anomaly-detection",
      "drift",
      "distributed-tracing",
      "payments",
      "dags",
      "sre",
      "alerting"
    ],
    "tools": [
      "OpenTelemetry",
      "Neo4j",
      "Kafka",
      "JP Morgan Chase",
      "\"star bench\" benchmark suite (as transcribed; likely DeathStarBench)",
      "Kubernetes ingress (as transcribed: \"if k is there you have ingress layer\")"
    ],
    "quotes": [
      {
        "text": "What I'm talking about today is execution graph. It's short-lived graph.",
        "at": "01:21",
        "url": "https://www.youtube.com/watch?v=u1yaOeEX4e8&t=81s"
      },
      {
        "text": "So nothing changed. Your system is working fine, right? But now you need to come up with the criteria and reassess your baselines again.",
        "at": "11:07",
        "url": "https://www.youtube.com/watch?v=u1yaOeEX4e8&t=667s"
      },
      {
        "text": "if there is a new endpoint consider the new baseline don't make it very generic.",
        "at": "16:30",
        "url": "https://www.youtube.com/watch?v=u1yaOeEX4e8&t=990s"
      },
      {
        "text": "If you go to the doctor and doctor says your health score is 22, it doesn't make much sense to you.",
        "at": "18:43",
        "url": "https://www.youtube.com/watch?v=u1yaOeEX4e8&t=1123s"
      }
    ],
    "words": 3105
  },
  "summary_url": "/#u1yaOeEX4e8",
  "transcript": {
    "html": "/transcripts/u1yaOeEX4e8.html",
    "txt": "/transcripts/u1yaOeEX4e8.txt",
    "vtt": "/transcripts/u1yaOeEX4e8.vtt"
  }
}