EP4309099A1 - Systeme und verfahren zur identifizierung und auflösung von ereignissen in einem system unter verwendung eines modells der künstlichen intelligenz - Google Patents

Systeme und verfahren zur identifizierung und auflösung von ereignissen in einem system unter verwendung eines modells der künstlichen intelligenz

Info

Publication number
EP4309099A1
EP4309099A1 EP23724961.0A EP23724961A EP4309099A1 EP 4309099 A1 EP4309099 A1 EP 4309099A1 EP 23724961 A EP23724961 A EP 23724961A EP 4309099 A1 EP4309099 A1 EP 4309099A1
Authority
EP
European Patent Office
Prior art keywords
clustered
records
incident records
incident
problem record
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
EP23724961.0A
Other languages
English (en)
French (fr)
Inventor
Gary Duma
Geoffrey Allan SPARKE
Andrew WYNKOOP
Sudhanshu Shukla
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fidelity Information Services LLC
Original Assignee
Fidelity Information Services LLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US17/816,745 external-priority patent/US20230325748A1/en
Application filed by Fidelity Information Services LLC filed Critical Fidelity Information Services LLC
Publication of EP4309099A1 publication Critical patent/EP4309099A1/de
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06NCOMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00Machine learning
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90Details of database functions independent of the retrieved data types
    • G06F16/906Clustering; Classification
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00Pattern recognition
    • G06F18/20Analysing
    • G06F18/23Clustering techniques
    • G06F18/231Hierarchical techniques, i.e. dividing or merging pattern sets so as to obtain a dendrogram

Definitions

  • Various embodiments of the present disclosure relate generally to identifying and resolving incidents in a system using an artificial intelligence model and, more particularly, to identifying and resolving clusters of similar recurring incidents in a system using an artificial intelligence model.
  • IT operations change requests for changes across the IT landscape can have varying levels of risk and impact.
  • change-caused incidents may make up 70-80% of critical incidents, and hence cause a significant burden on IT teams.
  • Modem IT architectures have become increasingly complex. Resolving recurring incidents in a large system across the IT landscape frequently involves decentralized personnel and systems, and individual ticket and time-separated resolutions, resulting in significant inefficiencies in large IT organizations.
  • the present disclosure is directed to overcoming one or more of these abovereferenced challenges.
  • the techniques described herein relate to a method for identifying and handling incidents using a machine-learning based model, the method including, performing by one or more processors, operations including: clustering a subgroup of incident records from among a plurality of incident records using the machinelearning based model based on a rolling time window and a number of records in the subgroup of incident records; creating a problem record based on the clustered incident records; populating the problem record with information related to the clustered incident records; linking the clustered incident records to the problem record; providing a notification that the problem record has been created; receiving a resolution for the problem record; and updating, based on the resolution, the machine-learning based model to leam an association between extracted features of the resolution and extracted features of the clustered incident records.
  • the techniques described herein relate to a method, wherein the rolling time window is three months and the number of records is one thousand records, so that incident records are clustered when at least one thousand records are identified in the sub-group of incident records by the machine-learning based model in the rolling time window of three months.
  • the techniques described herein relate to a method, wherein the incident records are clustered based on one or more of a description of the incident, a location where the incident occurred, or a priority level of the incident record.
  • the techniques described herein relate to a method, wherein the clustering is performed using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).
  • HDBSCAN Hierarchical Density-Based Spatial Clustering of Applications with Noise
  • the techniques described herein relate to a method, wherein the information related to the clustered incident records includes one or more of an assigned problem management group, an assigned problem manager, a description of a most frequent value in the clustered incident records, a problem short description, or a problem long description.
  • the techniques described herein relate to a method, wherein the linking the clustered incident records to the problem record includes updating a field in each of the clustered incident records with an identification of the problem record.
  • the techniques described herein relate to a method, wherein the linking the clustered incident records to the problem record includes creating a parent/child relationship between the problem record and the clustered incident records. [015] In some aspects, the techniques described herein relate to a method, wherein the updating the machine-learning based model includes training the machine-learning based model to leam an association between clustered new incident records and the problem record.
  • the techniques described herein relate to a method, wherein the operations further include: when the machine-learning based model indicates the clustered new incident records are related to the problem record and the clustered new incident records are based on unacceptable incidents, creating a persisting problem record based on the clustered new incident records, linking the clustered new incident records to the persisting problem record, and linking the persisting problem record to the problem record to indicate an issue related to the problem record persists.
  • the techniques described herein relate to a method, wherein the operations further include: when the machine-learning based model indicates the clustered new incident records are related to the problem record and the clustered new incident records are based on acceptable incidents, omitting creating a new problem record based on the clustered new' incident records.
  • the techniques described herein relate to a computer- implemented system for identifying and handling related incidents using a machine-learning based model
  • the computer-implemented system including: a memory to store instructions; and one or more processors to execute the stored instructions to perform operations including: clustering a sub-group of incident records from among a plurality of incident records using the machine-learning based model based on a rolling time window and a number of records in the sub-group of incident records; creating a problem record based on the clustered incident records; populating the problem record with information related to the clustered incident records; linking the clustered incident records to the problem record; providing a notification that the problem record has been created; receiving a resolution for the problem record; and updating, based on the resolution, the machine-learning based model to learn an association between extracted features of the resolution and extracted features of the clustered incident records.
  • the techniques described herein relate to a computer- implemented system, wherein the rolling time window is three months and the number of records is one thousand records, so that incident records are clustered when at least one thousand records are identified in the sub-group of incident records by the machine-learning based model in the rolling time window of three months.
  • the techniques described herein relate to a computer- implemented system, wherein the incident records are clustered based on one or more of a description of the incident, a location where the incident occurred, or a priority level of the incident record.
  • the techniques described herein relate to a computer- implemented system, wherein the clustering is performed using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).
  • HDBSCAN Hierarchical Density-Based Spatial Clustering of Applications with Noise
  • the techniques described herein relate to a computer- implemented system, wherein the information related to the clustered incident records includes one or more of an assigned problem management group, an assigned problem manager, a description of a most frequent value in the clustered incident records, a problem short description, or a problem long description.
  • the techniques descnbed herein relate to a computer- implemented system, wherein the linking the clustered incident records to the problem record includes updating a field in each of the clustered incident records with an identification of the problem record.
  • the techniques described herein relate to a computer- implemented system, wherein the linking the clustered incident records to the problem record includes creating a parent/ child relationship between the problem record and the clustered incident records.
  • the techniques described herein relate to a computer- implemented system, wherein the updating the machine-learning based model includes training the machine-learning based model to leam an association between clustered new incident records and the problem record.
  • the techniques described herein relate to a computer- implemented system, wherein the operations further include: when the machine-learning based model indicates the clustered new incident records are related to the problem record and the clustered new incident records are based on unacceptable incidents, creating a persisting problem record based on the clustered new incident records, linking the clustered new incident records to the persisting problem record, and linking the persisting problem record to the problem record to indicate an issue related to the problem record persists, and when the machine-learning based model indicates the clustered new incident records are related to the problem record and the clustered new incident records are based on acceptable incidents, omitting creating a new problem record based on the clustered new incident records.
  • the techniques described herein relate to a non-transitory computer readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations including: clustering a sub-group of incident records from among a plurality of incident records using a machinelearning based model based on a rolling time window and a number of the sub-group of incident records; creating a problem record based on the clustered incident records; populating the problem record with information related to the clustered incident records; linking the clustered incident records to the problem record; providing a notification that the problem record has been created; receiving a resolution for the problem record; and updating, based on the resolution, the machine-learning based model to leam an association between extracted features of the resolution and extracted features of the clustered incident records.
  • an advantage to the disclosed systems and methods is that the disclosed systems and methods provide an end-to- end approach to incidents, as compared to current isolated improvements per department, which will lead to increased communication and focus on common problems.
  • the disclosed systems and methods provides a solution for all departments in a company to supply data to be commonly available for insights to all departments. As a result, a team may take common actions to address related incidents in all departments, for example.
  • the disclosed systems and methods may enhance the data quality and/or best practices standardizing the resolution of recurring incidents and/or solving the underlying, systemic issues causing these recurring incidents.
  • the disclosed systems and methods may aggregate and cluster huge volumes of incidents that a human being (or team of humans) cannot practically parse in reasonable timeframes.
  • the disclosed systems and methods may automate the creation of a cluster ticket via API calls from a cloud environment.
  • FIG. 1 depicts an exemplary system overview for using artificial intelligence to predict and troubleshoot incidents in a system, according to one or more embodiments.
  • FIG. 2 depicts a flowchart of a method 200 for using artificial intelligence to cluster incidents and create a problem record in a system, according to one or more embodiments.
  • FIG. 3 depicts a flowchart of a method 300 for using artificial intelligence to resolve and track a problem record for incidents in a system, according to one or more embodiments.
  • FIG. 4 depicts a flowchart of a method 400 for identifying and handling incidents using a machine-learning based model, according to one or more embodiments.
  • FIG. 5 depicts a flowchart of a method 500 for identifying and handling incidents using a machine-learning based model, according to one or more embodiments.
  • FIG. 6 illustrates an implementation of a general computer system that may execute techniques presented herein.
  • Various embodiments of the present disclosure relate generally to identifying and resolving incidents in a system using an artificial intelligence model and, more particularly , to identifying and resolving clusters of similar recurring incidents in a system using an artificial intelligence model.
  • subject matter may be embodied as methods, devices, components, or systems. Accordingly, embodiments may, for example, take the form of hardware, software, firmware or any combination thereof (other than software per se).
  • the following detailed description is, therefore, not intended to be taken in a limiting sense.
  • One or more embodiments may be able to reduce a burden on a company to identify and resolve incidents.
  • an incident may be any change in a system, such as an outage or a performance change, for example. Incidents may be manually reported by customers or personnel, may be automatically logged by internal systems, or may be captured in other ways.
  • One or more embodiments may provide IT management, governance, and operations with a solution to identify and resolve incidents and have an impact in an ongoing, dynamic way.
  • One or more embodiments may be extended to clients and users of services and software with applications that are connected to systems.
  • One or more embodiments may reach many different areas of the IT operations lifecycle, such as the identification of high-risk groups or infrastructure components, and may transform the way that decisions and reviews on incidents are made. Feedback from incident resolution teams may be integrated back into the Al models and improve the incident resolution over time.
  • FIG. 1 depicts an exemplary system overview for using artificial intelligence to predict and troubleshoot incidents in a system, according to one or more embodiments.
  • a Problem Assessment System 100 may include relational database 105 including problem table 110 and incident table 115.
  • Problem table 110 and incident table 115 may be provided as one or more tables, and may include, for example, one or more problems, tasks, risk conditions, incidents, or changes.
  • Problem table 110 may be managed by a problem management team 120.
  • Relational database 105 may be connected through encryption to gateway 125 in cloud 121, and may send and receive periodic updates to and from cloud 121.
  • Cloud 121 may be a remote cloud service, a local service, or any combination thereof.
  • Cloud 121 may include gateway 125 connected to processing API 130 which may be used with event trigger 135 to update an artificial intelligence model 140.
  • Artificial intelligence model 140 may send and receive data, using Container Management Platform 145 and event trigger 150, to and from Relational Database Service 155.
  • Relational Database Service 155 may be connected to relational database 105 through gateway 160, and may send and receive periodic updates to and from relational database 105 through gateway 160.
  • Artificial intelligence model 140 may include a machine learning component.
  • One of the machine learning techniques that may be useful and effective for the analysis is a neural network, which is a type of supervised machine learning. Nonetheless, it should be noted that other machine learning techniques and frameworks may be used to perform the methods contemplated by the present disclosure.
  • the systems and methods may be realized using other types of supervised machine learning such as regression problems, random forest, etc., using unsupervised machine learning such as cluster algorithms, principal component analysis (PCA), etc., and/or using reinforcement learning.
  • PCA principal component analysis
  • Problem Assessment System 1 OO may provide an incident identification model that may predict an incident for every change. This may be accomplished by using an incident journey, so that the system may reverse engineer and identify the patterns in incoming incidents, by training an incident classification model that will tag changes to an incident, and by using a threshold analysis for clustering the incidents.
  • the thresholds may be dynamic and specific for a particular Assignment Group.
  • the model may cluster incidents proactively in real-time as incident, issue ticket, and script data are collected.
  • Problem Assessment System 100 may provide a model that can proactively suggest code changes/resolutions for incoming incidents, by building a classification / probability prediction (for example, Multi-Layer Perceptron, Logistic Regression, or Artificial Neural Network) model to identify whether a new incident is code change related or not. If a new incident is code change related, the incident journey may be used to identify which part of the code that needs to be changed to fix the issue. In the code, the incident journey may identify which branch, file, or class or module should be changed.
  • a classification / probability prediction for example, Multi-Layer Perceptron, Logistic Regression, or Artificial Neural Network
  • topic modeling such as Latent Dirichlet Allocation or Neural Topic Modeling
  • clustering such as Bidirectional Encoder Representations from Transformers or Hierarchical Density-Based Spatial Clustering of Applications with Noise
  • Unsupervised learning may be done for incident descriptions, resolution notes, issue tracking tickets, and code repository commit messages, for example.
  • Auto-labeling of the created clusters may be performed using topic modeling.
  • the finalized clusters may be used as classes to train a supervised classifier model. Because the amount of data may be massive, various Deep Learning models such as Artificial Neural Network, Recurrent Neural Networks, and Long- Short Term Memory may be used. Using the final classification tags from the supervised model, an incident journey may be mapped.
  • Metadata may be provided from relational database 105 including incident reports with information for each incident provided with an incident number, closed date/time, category, close code, close note, long description, short description, root cause, and assignment group.
  • the metadata may be provided from relational database 105 including incident reports with information for each incident provided with an issue key, description, summary, label, issue type, fix version, environment, author, and comments.
  • metadata may be provided from relational database 105 including incident reports with information for each incident provided with a file name, script name, script type, script description, display identifier, message, committer type, commiter link, properties, file changes, and branch information.
  • FIG. 2 depicts a flowchart of a method 200 for using artificial intelligence to cluster incidents and create a problem record in a system, according to one or more embodiments.
  • operation 205 may include a cluster of related incidents being identified by a machine learning model with a record count threshold of, for example, at least 1000 incidents in a rolling window of, for example, three months. More or fewer numbers of records may be used for the threshold, and the rolling window may be shortened or lengthened as needed.
  • Problem Assessment System 100 may create a new problem record in a digital workflow management system for the identified cluster of related incidents.
  • the Problem Assessment System 100 may populate the new problem record.
  • the new problem record may include a problem management group field, a problem manager, an assignment group or category, a problem short description, and a problem long description.
  • the Problem Assessment System 100 may update a problem record identification field, for example, in all related incidents identified in the cluster with an identification of the new problem record, so that the new problem record includes a link to all related incidents identified in the cluster, and vice versa.
  • the Problem Assessment System 100 may create a linked relationship between the new problem record and all related incidents identified in the cluster, so that the new problem record includes a link to all related incidents identified in the cluster, and vice versa.
  • the linked relationship may be created in a table with a parent/child relationship between the new problem record and all related incidents identified in the cluster.
  • the disclosure is not limited thereto, and other linking methods may be used.
  • FIG. 3 depicts a flowchart of a method 300 for using artificial intelligence to resolve and track a problem record for incidents in a system, according to one or more embodiments.
  • the Problem Assessment System 100 may provide a notification that a new problem record was created in method 200. As shown in FIG. 3, in operation 305, the problem manager may make an initial determination of whether the new problem record is a true incident cluster or a false positive, for example.
  • the new problem record is a true incident cluster, in operation 310, the incident team may work to resolve the issue identified in the new problem record, and provide a resolution to the Problem Assessment System 100. If the new problem record is not a true incident cluster, in operation 350, the problem manager may provide instructions to the Problem Assessment System 100 to cancel the new problem record. If the new problem record is not a true incident cluster, in operation 355, the Problem Assessment System 100 may expect no new incidents for the cluster of related incidents, and will not create new additional problem records related to the incident.
  • the problem manager may provide instructions to the Problem Assessment System 100 to close the new problem record, and may choose a closure process. If the closure process is “permanently resolved”, for example, in operation 320, the Problem Assessment System 100 may expect no new incidents for the cluster of related incidents. However, if new incidents are identified, based on the threshold, then Problem Assessment System 100 may create another problem record with a link to the previously created problem record, indicating the issue identified in the previously created problem record persists, and was not permanently resolved. In operation 325. if the closure process is a known error, the Problem Assessment System 100 may expect new incidents for the cluster of related incidents, but will not create new additional problem records related to the incident.
  • FIG. 4 depicts a flowchart of a method 400 for identifying and handling incidents using a machine-learning based model, according to one or more embodiments.
  • the method 400 for identifying and handling related incidents using a machine-learning based model may include, performing by one or more processors 602, various operations.
  • Operation 405 may include clustering a sub-group of incident records from among a plurality of incident records using the machine-learning based model based on a rolling time window and a number of records in the sub-group of incident records.
  • Operation 410 may include creating a problem record based on the clustered incident records.
  • Operation 415 may include populating the problem record with information related to the clustered incident records.
  • Operation 420 may include linking the clustered incident records to the problem record.
  • Operation 425 may include providing a notification that the problem record has been created.
  • Operation 430 may include receiving a resolution for the problem record.
  • Operation 435 may include updating, based on the resolution, the machinelearning based model to learn an association between extracted features of the resolution and extracted features of the clustered incident records.
  • FIG. 5 depicts a flowchart of a method 500 for identifying and handling incidents using a machine-learning based model, according to one or more embodiments.
  • Operation 505 may include wherein the rolling time window is three months and the number of records is one thousand records, so that incident records are clustered when at least one thousand records are identified in the sub-group of incident records by the machine-learning based model in the rolling time window of three months.
  • Operation 510 may include wherein the incident records are clustered based on one or more of a description of the incident, a location where the incident occurred, or a priority level of the incident record.
  • Operation 515 may include wherein the clustering is performed using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).
  • HDBSCAN Hierarchical Density-Based Spatial Clustering of Applications with Noise
  • Operation 520 may include wherein the information related to the clustered incident records includes one or more of an assigned problem management group, an assigned problem manager, a description of a most frequent value in the clustered incident records, a problem short description, or a problem long description.
  • Operation 525 may include wherein the linking the clustered incident records to the problem record includes updating a field in each of the clustered incident records with an identification of the problem record.
  • Operation 530 may include wherein the linking the clustered incident records to the problem record includes creating a parent/child relationship between the problem record and the clustered incident records.
  • Operation 535 may include wherein the updating the machine-learning based model includes training the machine-learning based model to learn an association between clustered new incident records and the problem record.
  • Operation 540 may include when the machine-learning based model indicates the clustered new incident records are related to the problem record and the clustered new incident records are based on unacceptable incidents, creating a persisting problem record based on the clustered new incident records, linking the clustered new incident records to the persisting problem record, and linking the persisting problem record to the problem record to indicate an issue related to the problem record persists.
  • Operation 545 may include when the machine-learning based model indicates the clustered new incident records are related to the problem record and the clustered new incident records are based on acceptable incidents, omitting creating a new problem record based on the clustered new incident records.
  • FIG. 6 illustrates an implementation of a general computer system that may execute techniques presented herein.
  • discussions utilizing terms such as “processing,” “computing,” “calculating,” “determining”, analyzing” or the like refer to the action and/or processes of a computer or computing system, or similar electronic computing device, that manipulate and/or transform data represented as physical, such as electronic, quantities into other data similarly represented as physical quantities.
  • processor may refer to any device or portion of a device that processes electronic data, e.g., from registers and/or memory to transform that electronic data into other electronic data that, e.g., may be stored in registers and/or memory.
  • a “computer,” a “computing machine,” a “computing platform,” a “computing device,” or a “server” may include one or more processors.
  • FIG. 6 illustrates an implementation of a computer system 600.
  • the computer system 600 can include a set of instructions that can be executed to cause the computer system 600 to perform any one or more of the methods or computer based functions disclosed herein.
  • the computer system 600 may operate as a standalone device or may be connected, e.g., using a network, to other computer systems or peripheral devices.
  • the computer system 600 may operate in the capacity of a server or as a client user computer in a server-client user netw ork environment, or as a peer computer system in a peer-to-peer (or distributed) network environment.
  • the computer system 600 can also be implemented as or incorporated into various devices, such as a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile device, a palmtop computer, a laptop computer, a desktop computer, a communications device, a wireless telephone, a land-line telephone, a control system, a camera, a scanner, a facsimile machine, a printer, a pager, a personal trusted device, a web appliance, a network router, switch or bridge, or any other machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine.
  • PC personal computer
  • PDA personal digital assistant
  • the computer system 600 can be implemented using electronic devices that provide voice, video, or data communication. Further, while a computer system 600 is illustrated as a single system, the term “system” shall also be taken to include any collection of systems or sub-systems that individually or jointly execute a set, or multiple sets, of instructions to perform one or more computer functions.
  • the computer system 600 may include a processor 602, e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both.
  • the processor 602 may be a component in a variety of systems.
  • the processor 602 may be part of a standard personal computer or a workstation.
  • the processor 602 may be one or more general processors, digital signal processors, application specific integrated circuits, field programmable gate arrays, servers, networks, digital circuits, analog circuits, combinations thereof, or other now known or later developed devices for analyzing and processing data.
  • the processor 602 may implement a software program, such as code generated manually (i.e., programmed).
  • the computer system 600 may include a memory 604 that can communicate via a bus 608.
  • the memory 604 may be a main memory, a static memory, or a dynamic memory.
  • the memory 604 may include, but is not limited to computer readable storage media such as various types of volatile and non-volatile storage media, including but not limited to random access memory, read-only memory, programmable read-only memory, electrically programmable read-only memory, electrically erasable read-only memory, flash memory, magnetic tape or disk, optical media and the like.
  • the memory 604 includes a cache or random-access memory for the processor 602.
  • the memory 604 is separate from the processor 602, such as a cache memory of a processor, the system memory, or other memory.
  • the memory 604 may be an external storage device or database for storing data. Examples include a hard drive, compact disc (“CD”), digital video disc (“DVD”), memory card, memory stick, floppy disc, universal serial bus (“USB”) memory device, or any other device operative to store data.
  • the memory 604 is operable to store instructions executable by the processor 602.
  • the functions, acts or tasks illustrated in the figures or described herein may be performed by the processor 602 executing the instructions stored in the memory 604.
  • the functions, acts or tasks are independent of the particular type of instructions set, storage media, processor or processing strategy and may be performed by software, hardware, integrated circuits, firm-ware, microcode and the like, operating alone or in combination.
  • processing strategies may include multiprocessing, multitasking, parallel processing and the like.
  • the computer system 600 may further include a display 610, such as a liquid crystal display (LCD), an organic light emitting diode (OLED), a flat panel display, a solid-state display, a cathode ray tube (CRT), a projector, a printer or other now known or later developed display device for outputting determined information.
  • a display 610 such as a liquid crystal display (LCD), an organic light emitting diode (OLED), a flat panel display, a solid-state display, a cathode ray tube (CRT), a projector, a printer or other now known or later developed display device for outputting determined information.
  • the display 610 may act as an interface for the user to see the functioning of the processor 602, or specifically as an interface with the software stored in the memory 604 or in the drive unit 606.
  • the computer system 600 may include an input device 612 configured to allow a user to interact with any of the components of computer system 600.
  • the input device 612 may be a number pad, a keyboard, or a cursor control device, such as a mouse, or a joystick, touch screen display, remote control, or any other device operative to interact with the computer system 600.
  • the computer system 600 may also or alternatively include drive unit 606 implemented as a disk or optical drive.
  • the drive unit 606 may include a computer-readable medium 622 in which one or more sets of instructions 624, e.g. software, can be embedded. Further, the instructions 624 may embody one or more of the methods or logic as described herein. The instructions 624 may reside completely or partially within the memory 604 and/or within the processor 602 during execution by the computer system 600.
  • the memory 604 and the processor 602 also may include computer-readable media as discussed above.
  • a computer-readable medium 622 includes instructions 624 or receives and executes instructions 624 responsive to a propagated signal so that a device connected to a network 670 can communicate voice, video, audio, images, or any other data over the network 670. Further, the instructions 624 may be transmitted or received over the network 670 via a communication port or interface 620, and/or using a bus 608.
  • the communication port or interface 620 may be a part of the processor 602 or may be a separate component.
  • the communication port or interface 620 may be created in software or may be a physical connection in hardware.
  • the communication port or interface 620 may be configured to connect with a network 670, external media, the display 610, or any other components in computer system 600, or combinations thereof.
  • connection with the network 670 may be a physical connection, such as a wired Ethernet connection or may be established wirelessly as discussed below.
  • additional connections with other components of the computer system 600 may be physical connections or may be established wirelessly.
  • the network 670 may alternatively be directly connected to a bus 608.
  • While the computer-readable medium 622 is shown to be a single medium, the term “computer-readable medium” may include a single medium or multiple media, such as a centralized or distributed database, and/or associated caches and servers that store one or more sets of instructions.
  • the term “computer-readable medium” may also include any medium that is capable of storing, encoding, or carrying a set of instructions for execution by a processor or that cause a computer system to perform any one or more of the methods or operations disclosed herein.
  • the computer-readable medium 622 may be non-transitory, and may be tangible.
  • the computer-readable medium 622 can include a solid-state memory such as a memory card or other package that houses one or more non-volatile read-only memories.
  • the computer-readable medium 622 can be a random-access memory or other volatile rewritable memory. Additionally or alternatively, the computer-readable medium 622 can include a magneto-optical or optical medium, such as a disk or tapes or other storage device to capture carrier wave signals such as a signal communicated over a transmission medium.
  • a digital file attachment to an e-mail or other self-contained information archive or set of archives may be considered a distribution medium that is a tangible storage medium. Accordingly, the disclosure is considered to include any one or more of a computer-readable medium or a distribution medium and other equivalents and successor media, in which data or instructions may be stored.
  • dedicated hardware implementations such as application specific integrated circuits, programmable logic arrays and other hardware devices, can be constructed to implement one or more of the methods described herein
  • Applications that may include the apparatus and systems of vanous implementations can broadly include a variety of electronic and computer systems.
  • One or more implementations described herein may implement functions using two or more specific interconnected hardware modules or devices with related control and data signals that can be communicated between and through the modules, or as portions of an application-specific integrated circuit. Accordingly, the present system encompasses software, firmware, and hardware implementations.
  • the computer system 600 may be connected to a network 670.
  • the network 670 may define one or more networks including wired or wireless networks.
  • the wireless network may be a cellular telephone network, an 802.11, 802. 16, 802.20, or WiMAX network.
  • such networks may include a public network, such as the Internet, a private network, such as an intranet, or combinations thereof, and may utilize a variety of networking protocols now available or later developed including, but not limited to TCP/IP based networking protocols.
  • the network 670 may include wide area networks (WAN), such as the Internet, local area networks (LAN), campus area networks, metropolitan area networks, a direct connection such as through a Universal Serial Bus (USB) port, or any other networks that may allow for data communication.
  • WAN wide area networks
  • LAN local area networks
  • USB Universal Serial Bus
  • the network 670 may be configured to couple one computing device to another computing device to enable communication of data between the devices.
  • the network 670 may generally be enabled to employ any form of machine-readable media for communicating information from one device to another.
  • the network 670 may include communication methods by which information may travel between computing devices.
  • the network 670 may be divided into sub-networks. The sub-networks may allow access to all of the other components connected thereto or the sub-networks may restrict access between the components.
  • the network 670 may be regarded as a public or private network connection and may include, for example, a virtual private network or an encryption or other security mechanism employed over the public Internet, or the like.
  • the methods described herein may be implemented by software programs executable by a computer system.
  • implementations can include distributed processing, component/object distnaded processing, and parallel processing.
  • virtual computer system processing can be constructed to implement one or more of the methods or functionality as described herein.
  • Coupled when used in the claims, should not be interpreted as being limited to direct connections only.
  • the terms “coupled” and “connected,” along with their derivatives, may be used. It should be understood that these terms are not intended as synonyms for each other.
  • the scope of the expression a device A coupled to a device B should not be limited to devices or systems wherein an output of device A is directly connected to an input of device B. It means that there exists a path between an output of A and an input of B which may be a path including other devices or means.
  • Coupled may mean that two or more elements are either in direct physical or electrical contact, or that two or more elements are not in direct contact with each other but yet still co-operate or interact with each other.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Computation (AREA)
  • Software Systems (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Artificial Intelligence (AREA)
  • Databases & Information Systems (AREA)
  • Computing Systems (AREA)
  • Medical Informatics (AREA)
  • Mathematical Physics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
EP23724961.0A 2022-04-07 2023-04-06 Systeme und verfahren zur identifizierung und auflösung von ereignissen in einem system unter verwendung eines modells der künstlichen intelligenz Pending EP4309099A1 (de)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
IN202211020902 2022-04-07
US17/816,745 US20230325748A1 (en) 2022-04-07 2022-08-02 Systems and methods for identifying and resolving incidents in a system using an artificial intelligence model
PCT/US2023/017693 WO2023196471A1 (en) 2022-04-07 2023-04-06 Systems and methods for identifying and resolving incidents in a system using an artificial intelligence model

Publications (1)

Publication Number Publication Date
EP4309099A1 true EP4309099A1 (de) 2024-01-24

Family

ID=86424847

Family Applications (1)

Application Number Title Priority Date Filing Date
EP23724961.0A Pending EP4309099A1 (de) 2022-04-07 2023-04-06 Systeme und verfahren zur identifizierung und auflösung von ereignissen in einem system unter verwendung eines modells der künstlichen intelligenz

Country Status (2)

Country Link
EP (1) EP4309099A1 (de)
WO (1) WO2023196471A1 (de)

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3800856B1 (de) * 2018-02-20 2023-07-05 Darktrace Holdings Limited Cybersicherheitsanwendung für eine cloud-infrastruktur
US11651032B2 (en) * 2019-05-03 2023-05-16 Servicenow, Inc. Determining semantic content of textual clusters

Also Published As

Publication number Publication date
WO2023196471A1 (en) 2023-10-12

Similar Documents

Publication Publication Date Title
US10977293B2 (en) Technology incident management platform
US11126493B2 (en) Methods and systems for autonomous cloud application operations
US20190156257A1 (en) Pervasive, domain and situational-aware, adaptive, automated, and coordinated big data analysis, contextual learning and predictive control of business and operational risks and security
Herzig et al. Predicting defects using change genealogies
WO2020003325A1 (en) Integrated skill management and training platform
US11625602B2 (en) Detection of machine learning model degradation
Sidhu et al. A machine learning approach to software model refactoring
US20230077527A1 (en) Local agent system for obtaining hardware monitoring and risk information utilizing machine learning models
US20230140918A1 (en) Intelligent automated computing system incident management
US20220067579A1 (en) Dynamic ontology classification system
WO2023049706A1 (en) Systems and methods for determining cause of performance change using machine learning techniques
US20220207443A1 (en) Local agent system for obtaining hardware monitoring and risk information
Pease et al. An interoperable semantic service toolset with domain ontology for automated decision support in the end-of-life domain
US20230325748A1 (en) Systems and methods for identifying and resolving incidents in a system using an artificial intelligence model
EP4309099A1 (de) Systeme und verfahren zur identifizierung und auflösung von ereignissen in einem system unter verwendung eines modells der künstlichen intelligenz
Sima et al. A hybrid approach for alarm verification using stream processing, machine learning and text analytics
US20230196248A1 (en) Systems and methods for improving quality of artificial intelligence model
US11816476B2 (en) Systems and methods for risk awareness using machine learning techniques
Yahav et al. Risk based testing of open source software (OSS)
CA3028142C (en) Data translation
König et al. A measure for resilience of critical infrastructures
Guittoum et al. Inferring threatening IoT dependencies using semantic digital twins toward collaborative IoT device management
Zhang et al. [Retracted] Exploring Artificial Intelligence Architecture in Data Cleaning Based on Bayesian Networks
Buzdugan et al. Architecture Considerations for a Decision Support System in Cyber Risk Management
US20220207433A1 (en) Method and System For Classification Prediction and Model Deployment

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20231017

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC ME MK MT NL NO PL PT RO RS SE SI SK SM TR