US20180032330A9 - System and method for classifying and resolving software production incident - Google Patents
System and method for classifying and resolving software production incident Download PDFInfo
- Publication number
- US20180032330A9 US20180032330A9 US15/069,633 US201615069633A US2018032330A9 US 20180032330 A9 US20180032330 A9 US 20180032330A9 US 201615069633 A US201615069633 A US 201615069633A US 2018032330 A9 US2018032330 A9 US 2018032330A9
- Authority
- US
- United States
- Prior art keywords
- incident
- keywords
- vectors
- mechanization
- ticket
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/70—Software maintenance or management
- G06F8/77—Software metrics
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/35—Clustering; Classification
- G06F16/355—Class or cluster creation or modification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/33—Querying
- G06F16/3331—Query processing
- G06F16/334—Query execution
- G06F16/3347—Query execution using vector based model
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/35—Clustering; Classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/35—Clustering; Classification
- G06F16/353—Clustering; Classification into predefined classes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/35—Clustering; Classification
- G06F16/358—Browsing; Visualisation therefor
-
- G06F17/3069—
-
- G06F17/30713—
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/20—Software design
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/01—Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0631—Resource planning, allocation, distributing or scheduling for enterprises or organisations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0633—Workflow analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/10—Office automation; Time management
- G06Q10/101—Collaborative creation, e.g. joint development of products or services
Definitions
- This disclosure relates generally to information technology infrastructure management, and more particularly to system and method for classifying and resolving software production incident tickets.
- a method for classifying software production incident tickets comprises receiving an incident ticket.
- the method further comprises extracting a plurality of keywords from the incident ticket.
- the method further comprises deriving a query vector corresponding to the incident ticket based on the plurality of keywords.
- the method further comprises classifying the incident ticket into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and a plurality of vectors derived from a plurality of past incident tickets.
- the plurality of vectors are derived based on a plurality of keywords and their corresponding occurrences in the plurality of past incident tickets.
- a system for classifying software production incident tickets comprises at least one processor and a memory communicatively coupled to the at least one processor.
- the memory stores processor-executable instructions, which, on execution, cause the processor to receive an incident ticket.
- the processor-executable instructions, on execution, further cause the processor to extract a plurality of keywords from the incident ticket.
- the processor-executable instructions, on execution, further cause the processor to derive a query vector corresponding to the incident ticket based on the plurality of keywords.
- the processor-executable instructions on execution, further cause the processor to classify the incident ticket into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and a plurality of vectors derived from a plurality of past incident tickets.
- the plurality of vectors are derived based on a plurality of keywords and their corresponding occurrences in the plurality of past incident tickets.
- a non-transitory computer-readable medium storing computer-executable instructions for classifying software production incident tickets.
- the stored instructions when executed by a processor, cause the processor to receive an incident ticket.
- the stored instructions when executed by the processor, further cause the processor to extract a plurality of keywords from the incident ticket.
- the stored instructions when executed by the processor, further cause the processor to derive a query vector corresponding to the incident ticket based on the plurality of keywords.
- the stored instructions, when executed by the processor, further cause the processor to classify the incident ticket into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and a plurality of vectors derived from a plurality of past incident tickets.
- the plurality of vectors are derived based on a plurality of keywords and their corresponding occurrences in the plurality of past incident tickets.
- FIG. 1 is a block diagram of an exemplary system for classifying and resolving software production incident tickets in accordance with some embodiments of the present disclosure.
- FIG. 2 is a functional block diagram of a classification and resolution engine in accordance with some embodiments of the present disclosure.
- FIG. 3 illustrates an exemplary knowledge representation as stored in solution knowledge base.
- FIG. 4 illustrates an exemplary two-dimensional KD-tree for indexing the knowledge representation of FIG. 3 .
- FIG. 5 is a flow diagram of an exemplary process for classifying and resolving software production incident tickets in accordance with some embodiments of the present disclosure.
- FIG. 6 is a flow diagram of a detailed exemplary process for classifying and resolving software production incident tickets in accordance with some embodiments of the present disclosure.
- FIG. 7 is a block diagram of an exemplary computer system for implementing embodiments consistent with the present disclosure.
- an exemplary system 100 for classifying and resolving software production incident tickets is illustrated in accordance with some embodiments of the present disclosure.
- the incident tickets correspond to anomalies, defects, or any other obstructions in an information technology (IT) infrastructure.
- the system 100 implements a technique for providing classification of incident tickets based on their mechanization or automation possibility, and for providing automatic resolution for the incident tickets for which mechanization or automation is possible.
- the system 100 comprises an IT infrastructure 101 supporting an organization or an enterprise.
- the IT infrastructure 101 may include IT systems and devices interconnected by communication networks and running a host of software applications for managing the organization or the enterprise, enabling information processing like archival and retrieval, and enabling work processes, and so forth.
- the IT infrastructure 101 is a collection of hardware, software, and network resources.
- the hardware resources may be servers, computers, switches, routers, adopters, hubs, and so forth.
- the software resources may be operating systems, enterprise resource planning (ERP) solutions, customer relationship management (CRM) solutions, productivity applications, and so forth.
- the network resources may be Ethernet, Internet, firewall, communications protocols, and so forth.
- a number of users 102 such as network administrators, developers, end users, and so forth may operate or use the IT infrastructure 101 while performing day to day work in the organization or the enterprise.
- the system 100 further comprises an IT service management (ITSM) tool 103 .
- the ITSM tool 103 is a service level incident management tool where all incidents are logged as tickets in an incident repository.
- the ITSM tool 103 is responsible for receiving and processing the incident tickets so as to provide fast and accurate resolution.
- the ITSM tool 103 may be build based on the IT infrastructure Library (ITIL) guidelines. Examples of ITSM tool 103 may include, but are not limited to, Wipro® eHelpline, BMCTM Remedy 9 , ServiceNOWTM, and so forth.
- the incident tickets are logged into ITSM tool 103 either automatically after monitoring and processing or manually. Thus, qualified events which are generated by any monitoring solution will be converted as an incident ticket.
- a human user such as the user 102 may also log an incident ticket in the ITSM tool 103 .
- System generated events or incident tickets are typically related to availability, capacity, performance of one or more components of the IT infrastructure 101 (e.g., memory utilization, CPU utilization, and so forth). Additionally, the events or incident tickets may be related to software or applications infrastructures (e.g., auto system scheduler issue, database refresh failure, long running query issue, and so forth), or may be related to hardware faults (e.g., network port Issue, LAN issue, and so forth).
- the system 100 further comprises monitoring tools 104 for monitoring the IT infrastructure 101 .
- the monitoring tool 104 monitors the behavior of a particular infrastructure component (server, application, etc.) with respect to a pre-defined threshold and/or after a pre-defined interval. It should be noted that, in many cases, one can easily identify the problem in the IT infrastructure 101 based on certain change in regular pattern or behavior. For example, the monitoring tool 104 may generate alerts for events whenever a threshold is reached. Thus, the monitoring tool 104 picks up problems or events corresponding to potential problems in the IT infrastructure 101 . Examples of monitoring tool 104 may include, but are not limited to, Wipro® Viking, HP® OpenView, IBM® Tivoli, and so forth.
- the system 100 further comprises an event correlation engine 105 for correlating multiple events detected by the monitoring tool 104 and to identify few events that are relevant and of importance based on a set of rules. For example, if a router is down, the underlying devices or application (e.g., computer, ERP) will be down as well. The monitoring tool 104 may generate alerts for the router as well as for the other underlying devices. However, the event correlation will indicate that router is the issue.
- the event correlation engine 105 processes the multiple events and analyzes relationships between events. The set of rules is then generated based on the analysis to suppress the unwanted events before logging the events as incident tickets. For example, the rules may include, but are not limited to, alert already exist, many to one alert, suppress by outage, and so forth.
- the system further comprises an incident classification and resolution engine 106 for classifying and resolving software production incident tickets.
- the incident classification and resolution engine 106 classifies incident tickets based on their mechanization possibility, and subsequently provides automatic resolution for those incident tickets for which mechanization is possible.
- the incident classification and resolution engine 106 comprises a preparatory analyzer 107 , a run-time analyzer 108 , and a solution knowledge base (SK-Base) and configuration management database (CMDB) 109 .
- SK-Base solution knowledge base
- CMDB configuration management database
- the preparatory analyzer 107 analyzes all the previously logged incident tickets in the ITSM 103 based on their mechanization status and derives vectors or feature matrices using natural language processing that are subsequently employed for identification or determination of possible mechanization candidates. The preparatory analyzer 107 then updates the SK-Base 109 with these vectors and feature matrices. Additionally, the preparatory analyzer 107 represents the mechanization solutions as knowledge in SK-Base, searches the availability of different mechanization solutions in the SK-Base, and accordingly updates the SK-Base.
- the run-time analyzer 108 analyzes the alerts from the event correlation or ITSM and classifies the alerts into possibly mechanization candidates or not using natural language processing and based on the vectors or feature matrices built by the preparatory analyzer 107 . Additionally, the run-time analyzer 108 acquires the knowledge about available mechanization solution from SK-Base 109 for the positive mechanization candidates and then maps the mechanization candidates towards the available mechanization solutions. Further, the run-time analyzer 108 updates the resolved information in ITSM tool 103 which then implements or applies the resolution in the IT infrastructure 101 . Further, as will be appreciated by those skilled in the art, the run-time analyzer 108 updates the ITSM tool 103 with negative mechanization candidates. Such tickets are then picked up from ITSM tool 103 for manual resolution by a user 110 and the resolution is then updated in the ITSM tool 103 for subsequent implementation or application in the IT infrastructure 101 .
- the SK-Base 109 is a knowledge repository of vectors and/or feature matrices, and automation solutions (e.g., scripts). The solutions are indexed against the alert/ticket.
- the CMDB 109 is a configuration repository comprising information about configuration item (CI) of a particular location (e.g., IP address, etc.), capacity (e.g., server capacity, memory capacity, etc.), and other such information about the IT infrastructure. This information is employed by the ITSM tool 103 to implement the solution in the IT infrastructure 101 .
- the incident classification and resolution engine 200 comprises a preparatory analyzer 201 (analogous to the preparatory analyzer 107 ), a run-time analyzer 202 (analogous to the run-time analyzer 108 ), and a SK-Base and CMDB 203 (analogous to the SK-Base and CMDB 109 ).
- the preparatory analyzer 201 derives vectors and/or feature matrices based on past incident tickets while the run-time analyzer 202 determines if a current incident ticket is a mechanization candidate or not based on the vectors and/or the feature matrices. Further, SK-Base and CMDB 203 stores vectors, feature matrices, existing solutions or resolutions, mapping between positive mechanization incident tickets and the existing solutions, information about CI, and other such information.
- the preparatory analyzer 201 acquires all the past (i.e., previously logged) incident tickets from the ITSM tool as training data at step 204 .
- the training data may be selected manually based on an empirical knowledge of the data. The manual selection may be performed in consultation with domain experts such as automation domain expert, operational engineers, and so forth.
- the past incident tickets 205 are then categorized based on their known mechanization status at step 206 . Thus, all the past incident tickets are categorized in at least two categories or classes—category 1 being incident tickets for which mechanization is possible (i.e., positive samples having automated solutions) and category 2 being incident tickets for which mechanization is not possible (i.e., negative samples for which there is no automated solutions).
- an incident ticket stating that ‘a device has been stolen’ is not a mechanization candidate as the device needs to be physically replaced.
- an incident ticket stating that ‘memory utilization has exceeded a threshold value’ may be a mechanization candidate as the resolution may be to run a script so as to clean up the memory.
- the past incident tickets may be categorized into more than 2 categories based on their mechanization level—full mechanization possible, mechanization not possible, partial mechanization is possible (e.g., 40% mechanization, 60% mechanization, and so forth).
- a description of each incident ticket is initially pre-processed at step 207 so as to determine a concise or a representative description while preserving the content, context, and meaning of that ticket.
- the pre-processing may involve removing stop words (e.g., punctuations, numbers, and so forth) as they have little or no contribution to content, context, and meaning of the ticket, thereby leading to lower accuracy in subsequent classification. For example, from the incident ticket having description ‘a device has been stolen’, stop words such as ‘has’, ‘been’, as well as any punctuation mark may be removed.
- the pre-processing may involve stemming where different forms of same words in the description (e.g., device/devices, utilization/utilizes/utilizing, etc.) may be represented by one word (e.g., device, utilization, etc.). It should be noted that pre-processing may also involve other text processing techniques. Thus, for the incident ticket having description ‘memory utilization has exceeded the threshold value on windows server’, pre-processing may provide a concise or representative description as ‘memory utilization exceed threshold window server’ or as ‘memory utilization’. Thus, for each category, we have multiple concise or representative descriptions corresponding to multiple incident tickets belonging to the given category.
- a number of keywords are extracted from the multiple concise descriptions belonging to the give category at step 208 .
- the keywords ‘device’ and ‘stolen’ may be extracted from the concise description ‘device stolen’ and the keywords ‘memory’, ‘utilization’, ‘exceed’, ‘threshold’, ‘window’, and ‘server’ may be extracted from ‘memory utilization exceed threshold window server’.
- at least three different training corpuses may be built using these keywords—training corpus comprising of all keywords (e.g., ‘device’, ‘stolen’, ‘memory’, ‘utilization’ etc.), training corpus comprising all noun keywords (e.g.
- each of the keywords may be represented by a unique number representation for ease of subsequent processing.
- each of the alphabets is assigned a unique number, and then an exponentiation and a subtraction operation may be employed on each of the alphabet based on the position of the alphabet in the keyword so as to determine the unique number representation.
- the choice of the exponentiation and the subtraction operation is because of their non-associative property.
- the unique number representation for the keyword ‘device’ may be determined as follows:
- unique number representations for the keyword ‘CPU’ is 3 1 ⁇ 16 2 ⁇ 21 3 i.e. ‘ ⁇ 9514’
- for the keyword ‘memory’ is 13 1 ⁇ 5 2 ⁇ 13 3 ⁇ 15 4 ⁇ 18 5 ⁇ 25 6 i.e. ⁇ 246083027
- for the keyword ‘utilization’ is 21 1 ⁇ 20 2 ⁇ 9 3 ⁇ 12 4 ⁇ 9 5 ⁇ 26 6 ⁇ 1 7 ⁇ 20 8 ⁇ 9 9 ⁇ 15 10 ⁇ 14 11 i.e., ⁇ 4652511977448.
- a plurality of vectors is derived based on the plurality of keywords and their corresponding occurrences in plurality of past incident tickets at step 209 .
- the vectors may be derived for at least one of a mode, a median, and a range for the plurality of keywords.
- the vectors may be derived by iteratively extracting most commonly occurring keyword (i.e., mode), by iteratively extracting middle occurring keyword from keywords arranged in ascending or descending order of occurrence frequency (i.e., median), by iteratively extracting most and least commonly occurring keyword from keywords arranged in ascending or descending order of occurrence frequency (range).
- each of the vectors may be determined based on a pre-defined number (e.g., 50 keywords) or based on fulfillment of some pre-defined conditions (e.g., keywords that occur at least 50 times). It should be noted that various other vectors depending on occurrences of the keywords in past incident tickets may be derived in various other embodiments.
- the plurality of vectors may be derived for each of the training corpuses i.e., all keywords, noun keywords, verb keywords. Thus, in some embodiments, there are 18 vectors in total—9 vectors for each category as follows:
- one or more feature matrices may be derived based on the plurality of vectors.
- Each feature matrix is a set of vectors from the plurality of vectors.
- the derived vectors and/or feature matrices are stored in SK Base and CMDB 203 for subsequent use by the run-time analyzer 202 for classification of the current incident ticket into mechanization candidate or not. Further, as will be described in greater detail in conjunction with FIGS. 3 and 4 , the preparatory analyzer 201 may index, store, and update existing mechanization solutions in the SK-Based 203 (i.e., knowledge repository) for subsequent resolution of the incident ticket for which mechanization is possible.
- SK-Based 203 i.e., knowledge repository
- the run-time analyzer 202 receives the incident ticket from the ITSM tool or the event correlation engine as test data or run-time data at step 210 .
- the event correlation engine provides automatically captured incident tickets while the ITSM tool provides manually logged incident tickets to the run-time analyzer 202 .
- the incident ticket 211 is then pre-processed at step 212 so as to extract a concise or a representative description of the ticket from the initially provided description.
- the pre-processing step 212 is similar to the pre-processing step 207 described above and may involve removing stop words (e.g., punctuations, numbers, etc.), stemming, and other such text processing techniques. Further, a number of keywords are extracted from the concise or the representative description at step 213 .
- each of the keywords may be represented by a unique number representation for ease of subsequent processing.
- the step 213 is similar to the step 208 described above for extraction of keywords and for determining unique number representation for the extracted keywords.
- a query vector is derived based on the plurality of keywords at step 214 .
- the incident ticket is then classified at step 215 into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and the plurality of vectors or feature matrices.
- the classification may be into more than 2 categories—full mechanization possible, mechanization not possible, partial mechanization is possible (e.g., 40% mechanization, 60% mechanization, and so forth).
- the plurality of derived vectors and/or feature matrices is accessed from the SK Base and CMDB 203 .
- each of the derived vectors and/or the feature matrices may be normalized using the following equation:
- i and j represents position of individual word representation within the vectors and/or feature matrices while n and m represents size of the vectors and/or feature matrices.
- the value of i and therefore n is equal to 1 for the vectors while the value of n is equal to 3 for the feature matrices comprising of 3 vectors.
- the size of the query vector i.e., number of keywords in the query vector
- the placements of original keywords within the adjusted query vector are further adjusted such that they correspond to the placements of those keywords within the vector or the feature matrix it is being compared with (i.e., the keywords are in same positions as that in the vector it is being compared with). For example, if the query vector comprises of keywords ‘device’ and ‘stolen’, and it is to be compared with the vector having 100 keywords where ‘device’ appears at 4th position and ‘stolen’ appears at 99th position, then the adjusted query vector will also comprises of 100 keywords comprising of ‘device’ at 4th position, ‘stolen’ at 99th position, and dummy keywords at rest of the positions.
- the classification comprises performing a nearest neighbor classification based on at least one of a similarity and a dissimilarity between the query vector and each of the plurality of vectors.
- determining the similarity comprises determining a cosine similarity as follows:
- Cosine ⁇ ⁇ similarity Vector ⁇ ⁇ 1 ⁇ Vector ⁇ ⁇ 2 ⁇ Vector ⁇ ⁇ 1 ⁇ ⁇ ⁇ Vector ⁇ ⁇ 2 ⁇
- determining the dissimilarity comprises determining a Euclidean distance as follows:
- vector 1 is the query vector and vector 2 is the vector it is being compared with.
- the nearest neighbor classification is then performed by determining a decision parameter based on the cosine similarity and the Euclidean distance as follows:
- a plurality of decision parameters is calculated based on the query vector and each of 18 vectors (9 vectors with respect to category 1 and 9 vectors with respect to category 2) or 6 feature matrices (3 feature matrices with respect to category 1 and 3 feature matrices with respect to category 2) described above. An average value of the decision parameter is then calculated for 9 vectors with respect to category 1 or 3 feature matrices with respect to category 1. Similarly, an average value of the decision parameter is then calculated for 9 vectors with respect to category 2 or 3 feature matrices with respect to category 2. The incident ticket belongs to the category having higher value of average decision factor.
- the incident ticket belongs to category 2 representing tickets for which mechanization is not possible then it is a negative mechanization incident ticket 216 and the ITSM or the incident repository within ITSM is updated with the incident ticket at step 217 . Such tickets may then be taken up for manual resolution. However, if the incident ticket belongs to category 1 representing tickets for which mechanization is possible then it is a positive mechanization incident ticket 218 . In some embodiments, the run-time analyzer 202 resolves such incident ticket using an existing solution at step 219 . As will be described in greater detail in conjunction with FIGS.
- this is achieved by first identifying the existing solution from a plurality of existing solutions indexed in the SK-Base 203 (i.e., the knowledge repository) based on the incident ticket and then invoking one or more scripts associated with the existing solution to resolve the ticket. Subsequent to resolution, the ITSM or the incident repository within ITSM is updated with the incident ticket and the existing solution identified and implemented at step 220 .
- the incident classification and resolution engine 200 stores the knowledge representation 300 of the all available mechanization solutions in the SK-Base 203 indexed against various positive mechanization tickets.
- each use case 301 representing positive mechanization tickets may be associated with different descriptions 302 .
- each use case 301 may have one or more associated scripts 303 as solution.
- the use case 301 is represented using similar representation (e.g., vector) as that of the incident ticket.
- the use case 301 may be CPU utilization, memory utilization, database backup, and so forth.
- the use case 301 may be unique number representations of CPU utilization, memory utilization, database backup, and so forth.
- the use case 301 is a class representation of different tickets having different descriptions but belonging to one major class. All the descriptions 302 related to one use case 301 are combined into a corpus.
- CPU utilization use case or class representation may correspond to descriptions such as ‘CPU UTILIZATION has exceeded the threshold value on Windows Server’, ‘CPU UTILIZATION has exceeded the threshold value on VMware VM Windows 2008 Server Device’, ‘The threshold for the CPU has exceeded’, and so forth.
- memory utilization use case or class representation may correspond to descriptions such as ‘MEMORY UTILIZATION has exceeded the threshold value on Windows Server’, ‘MEMORY UTILIZATION has exceeded the threshold value on Windows 2008 Server Device’, ‘CPU UTILIZATION, MEMORY UTILIZATION, WinWPX has exceeded the threshold value on VMware VM Windows 2003 Server Device’, and so forth.
- database backup use case or class representation may correspond to descriptions such as ‘OVO PS Description: BACKUP failed to complete the command BACKUP DATABASE’, ‘MS SQL SERVER Description: BACKUP failed to complete the command BACKUP DATABASE’, and so forth.
- the incident classification and resolution engine 200 employs a K dimensional tree or a KD-tree 400 for indexing the knowledge representation 300 of FIG. 3 .
- the KD-tree 400 is a multilevel and multidimensional indexing structure and therefore able to support k-dimensional data points.
- the preparatory analyzer 201 may employ mode values of all keywords (e.g., two or three most commonly occurring keywords) in the incident tickets belonging to each of the major classes as keys for indexing the use case.
- mode values for all keywords e.g., two or three most commonly occurring keywords
- any other choice of values for keywords e.g., median values or range values
- the unique number representations may be employed to represent the keys.
- the key for use case ‘CPU utilization’ is ( ⁇ 9514, ⁇ 4652511977448) and that for memory utilization is ( ⁇ 246083027, ⁇ 4652511977448) as the unique number representations of CPU is ⁇ 9514, memory is ⁇ 246083027, and utilization is ⁇ 4652511977448.
- the KD-tree 400 may then be created through insertion.
- balancing of the KD-tree 400 may be performed for fast retrieval of use cases and therefore associated solutions.
- the dimensions of the KD-tree 400 as well as choice of keys are user-defined and dependent on the number of words needed to represent the use cases.
- all the use cases are represented by two words.
- the use cases may be represented by three words or n number of words resulting in three-dimensional or n-dimensional KD-tree.
- all the use cases should be represented by same number of keywords.
- the use cases may be represented by different number of words and default words (e.g., ‘00000’) may be employed to equalize the number of words so as to index the use cases via a KD-tree 400 .
- control logic 500 for classifying and resolving software production incident tickets by a system, such as system 100 , is depicted by a flowchart in accordance with some embodiments of the present disclosure.
- the control logic 500 includes the steps of receiving an incident ticket at step 501 , extracting a plurality of keywords from the incident ticket at step 502 , and deriving a query vector corresponding to the incident ticket based on the plurality of keywords at step 503 .
- the control logic 500 further includes the steps of classifying the incident ticket into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and a plurality of vectors derived from a plurality of past incident tickets at step 504 .
- the plurality of vectors are derived based on a plurality of keywords and their corresponding occurrences in the plurality of past incident tickets.
- deriving the plurality of vectors comprises deriving the plurality of vectors for at least one of a mode, a median, and a range for the plurality of keywords. Further, in some embodiments, deriving the plurality of vectors comprises normalizing each of the plurality of vectors.
- control logic 600 for classifying and resolving software production incident tickets is depicted in greater detail by a flowchart in accordance with some embodiments of the present disclosure.
- the control logic 600 includes the steps of acquiring past incident tickets from the ITSM at step 601 , and categorizing the past incident tickets into at least 2 categories based on their corresponding mechanization status at step 602 .
- the control logic 600 further includes the steps of pre-processing the incident tickets for each category at step 603 , extracting keywords from pre-processed incident tickets for each category at step 604 , and determining unique number representations for each of the plurality of keywords for each category at step 605 .
- the control logic 600 further includes the step of deriving a plurality of vectors based on the plurality of keywords and their corresponding occurrences in plurality of past incident tickets for each category at step 606 .
- the vectors may be derived for different training corpuses of keywords (e.g., all keywords, noun keywords, verb keywords, etc.) and for different types of frequency of occurrences (e.g., mode, median, range, etc.).
- feature matrices may be derived based on the plurality of vectors for each category.
- the control logic 600 further includes the step of normalizing each of the plurality of vectors and/or feature matrices at step 607 .
- the control logic 600 further includes the step of determining if the incident ticket is a positive mechanization incident ticket or not at step 614 . If the incident ticket is positive mechanization incident ticket, then the control logic 600 includes the step of resolving the incident ticket using an existing solution at step 615 . In some embodiments, resolving at step 615 may further comprise identifying the existing solution from a plurality of existing solutions indexed in a knowledge repository (i.e., SK-Base) at step 616 , and invoking one or more scripts associated with the existing solution at step 617 . The control logic 600 further includes the step of updating the incident repository within ITSM with the incident ticket and the associated resolution (i.e., existing solution) at step 618 .
- a knowledge repository i.e., SK-Base
- the ITSM may subsequently implement the provided resolution.
- the control logic 600 directly flows to step 618 and updates the incident repository within ITSM with the incident ticket. In such cases, the incident ticket is taken for manual resolution.
- the above described techniques may take the form of computer or controller implemented processes and apparatuses for practicing those processes.
- the disclosure can also be embodied in the form of computer program code containing instructions embodied in tangible media, such as floppy diskettes, CD-ROMs, hard drives, or any other computer-readable storage medium, wherein, when the computer program code is loaded into and executed by a computer or controller, the computer becomes an apparatus for practicing the invention.
- the disclosure may also be embodied in the form of computer program code or signal, for example, whether stored in a storage medium, loaded into and/or executed by a computer or controller, or transmitted over some transmission medium, such as over electrical wiring or cabling, through fiber optics, or via electromagnetic radiation, wherein, when the computer program code is loaded into and executed by a computer, the computer becomes an apparatus for practicing the invention.
- the computer program code segments configure the microprocessor to create specific logic circuits.
- Computer system 701 may be used for implementing system 100 and incident classification and resolution engine 200 for classifying and resolving software production incident tickets.
- Computer system 701 may comprise a central processing unit (“CPU” or “processor”) 702 .
- Processor 702 may comprise at least one data processor for executing program components for executing user- or system-generated requests.
- a user may include a person, a person using a device such as such as those included in this disclosure, or such a device itself.
- the processor may include specialized processing units such as integrated system (bus) controllers, memory management control units, floating point units, graphics processing units, digital signal processing units, etc.
- the processor may include a microprocessor, such as AMD Athlon, Duron or Opteron, ARM's application, embedded or secure processors, IBM PowerPC, Intel's Core, Itanium, Xeon, Celeron or other line of processors, etc.
- the processor 702 may be implemented using mainframe, distributed processor, multi-core, parallel, grid, or other architectures. Some embodiments may utilize embedded technologies like application-specific integrated circuits (ASICs), digital signal processors (DSPs), Field Programmable Gate Arrays (FPGAs), etc.
- ASICs application-specific integrated circuits
- DSPs digital signal processors
- FPGAs Field Programmable Gate Arrays
- I/O Processor 702 may be disposed in communication with one or more input/output (I/O) devices via I/O interface 703 .
- the I/O interface 703 may employ communication protocols/methods such as, without limitation, audio, analog, digital, monaural, RCA, stereo, IEEE-1394, serial bus, universal serial bus (USB), infrared, PS/2, BNC, coaxial, component, composite, digital visual interface (DVI), high-definition multimedia interface (HDMI), RF antennas, S-Video, VGA, IEEE 802.n/b/g/n/x, Bluetooth, cellular (e.g., code-division multiple access (CDMA), high-speed packet access (HSPA+), global system for mobile communications (GSM), long-term evolution (LTE), WiMax, or the like), etc.
- CDMA code-division multiple access
- HSPA+ high-speed packet access
- GSM global system for mobile communications
- LTE long-term evolution
- WiMax wireless wide area network
- the computer system 701 may communicate with one or more I/O devices.
- the input device 704 may be an antenna, keyboard, mouse, joystick, (infrared) remote control, camera, card reader, fax machine, dongle, biometric reader, microphone, touch screen, touchpad, trackball, sensor (e.g., accelerometer, light sensor, GPS, gyroscope, proximity sensor, or the like), stylus, scanner, storage device, transceiver, video device/source, visors, etc.
- Output device 705 may be a printer, fax machine, video display (e.g., cathode ray tube (CRT), liquid crystal display (LCD), light-emitting diode (LED), plasma, or the like), audio speaker, etc.
- a transceiver 706 may be disposed in connection with the processor 702 . The transceiver may facilitate various types of wireless transmission or reception.
- the transceiver may include an antenna operatively connected to a transceiver chip (e.g., Texas Instruments WiLink WL1283, Broadcom BCM4750IUB8, Infineon Technologies X-Gold 618-PMB9800, or the like), providing IEEE 802.11a/b/g/n, Bluetooth, FM, global positioning system (GPS), 2G/3G HSDPA/HSUPA communications, etc.
- a transceiver chip e.g., Texas Instruments WiLink WL1283, Broadcom BCM4750IUB8, Infineon Technologies X-Gold 618-PMB9800, or the like
- IEEE 802.11a/b/g/n e.g., Texas Instruments WiLink WL1283, Broadcom BCM4750IUB8, Infineon Technologies X-Gold 618-PMB9800, or the like
- IEEE 802.11a/b/g/n e.g., Bluetooth, FM, global positioning system (GPS), 2G/3G HSDPA/HS
- the processor 702 may be disposed in communication with a communication network 708 via a network interface 707 .
- the network interface 707 may communicate with the communication network 708 .
- the network interface may employ connection protocols including, without limitation, direct connect, Ethernet (e.g., twisted pair 10/100/1000 Base T), transmission control protocol/internet protocol (TCP/IP), token ring, IEEE 802.11a/b/g/n/x, etc.
- the communication network 708 may include, without limitation, a direct interconnection, local area network (LAN), wide area network (WAN), wireless network (e.g., using Wireless Application Protocol), the Internet, etc.
- the computer system 701 may communicate with devices 709 , 710 , and 711 .
- These devices may include, without limitation, personal computer(s), server(s), fax machines, printers, scanners, various mobile devices such as cellular telephones, smartphones (e.g., Apple iPhone, Blackberry, Android-based phones, etc.), tablet computers, eBook readers (Amazon Kindle, Nook, etc.), laptop computers, notebooks, gaming consoles (Microsoft Xbox, Nintendo DS, Sony PlayStation, etc.), or the like.
- the computer system 701 may itself embody one or more of these devices.
- the processor 702 may be disposed in communication with one or more memory devices (e.g., RAM 713 , ROM 714 , etc.) via a storage interface 712 .
- the storage interface may connect to memory devices including, without limitation, memory drives, removable disc drives, etc., employing connection protocols such as serial advanced technology attachment (SATA), integrated drive electronics (IDE), IEEE-1394, universal serial bus (USB), fiber channel, small computer systems interface (SCSI), etc.
- the memory drives may further include a drum, magnetic disc drive, magneto-optical drive, optical drive, redundant array of independent discs (RAID), solid-state memory devices, solid-state drives, etc.
- the memory devices may store a collection of program or database components, including, without limitation, an operating system 716 , user interface application 717 , web browser 718 , mail server 719 , mail client 720 , user/application data 721 (e.g., any data variables or data records discussed in this disclosure), etc.
- the operating system 716 may facilitate resource management and operation of the computer system 701 .
- Operating systems include, without limitation, Apple Macintosh OS X, Unix, Unix-like system distributions (e.g., Berkeley Software Distribution (BSD), FreeBSD, NetBSD, OpenBSD, etc.), Linux distributions (e.g., Red Hat, Ubuntu, Kubuntu, etc.), IBM OS/2, Microsoft Windows (XP, Vista/7/8, etc.), Apple iOS, Google Android, Blackberry OS, or the like.
- User interface 717 may facilitate display, execution, interaction, manipulation, or operation of program components through textual or graphical facilities.
- user interfaces may provide computer interaction interface elements on a display system operatively connected to the computer system 701 , such as cursors, icons, check boxes, menus, scrollers, windows, widgets, etc.
- GUIs Graphical user interfaces
- GUIs may be employed, including, without limitation, Apple Macintosh operating systems' Aqua, IBM OS/2, Microsoft Windows (e.g., Aero, Metro, etc.), Unix X-Windows, web interface libraries (e.g., ActiveX, Java, Javascript, AJAX, HTML, Adobe Flash, etc.), or the like.
- the computer system 701 may implement a web browser 718 stored program component.
- the web browser may be a hypertext viewing application, such as Microsoft Internet Explorer, Google Chrome, Mozilla Firefox, Apple Safari, etc. Secure web browsing may be provided using HTTPS (secure hypertext transport protocol), secure sockets layer (SSL), Transport Layer Security (TLS), etc. Web browsers may utilize facilities such as AJAX, DHTML, Adobe Flash, JavaScript, Java, application programming interfaces (APIs), etc.
- the computer system 701 may implement a mail server 719 stored program component.
- the mail server may be an Internet mail server such as Microsoft Exchange, or the like.
- the mail server may utilize facilities such as ASP, ActiveX, ANSI C++/C#, Microsoft .NET, CGI scripts, Java, JavaScript, PERL, PHP, Python, WebObjects, etc.
- the mail server may utilize communication protocols such as internet message access protocol (IMAP), messaging application programming interface (MAPI), Microsoft Exchange, post office protocol (POP), simple mail transfer protocol (SMTP), or the like.
- IMAP internet message access protocol
- MAPI messaging application programming interface
- POP post office protocol
- SMTP simple mail transfer protocol
- the computer system 701 may implement a mail client 720 stored program component.
- the mail client may be a mail viewing application, such as Apple Mail, Microsoft Entourage, Microsoft Outlook, Mozilla Thunderbird, etc.
- computer system 701 may store user/application data 721 , such as the data, variables, records, etc. (e.g., incident tickets, keywords, unique number representations of keywords, vectors, feature matrices, mechanization statuses, use cases, descriptions, scripts, configuration item, KD-tree, and so forth) as described in this disclosure.
- databases may be implemented as fault-tolerant, relational, scalable, secure databases such as Oracle or Sybase.
- databases may be implemented using standardized data structures, such as an array, hash, linked list, struct, structured text file (e.g., XML), table, or as object-oriented databases (e.g., using ObjectStore, Poet, Zope, etc.).
- object-oriented databases e.g., using ObjectStore, Poet, Zope, etc.
- the techniques described in the various embodiments discussed above result in automated, efficient, and speedy resolution of tickets based on intelligent classification.
- the identification of automation candidates through the classification reduces the human error and the time delay of providing accurate resolution.
- the techniques described in the various embodiments discussed above increase the productivity of the automation solutions while at the same time reduce the manual effort.
- a computer-readable storage medium refers to any type of physical memory on which information or data readable by a processor may be stored.
- a computer-readable storage medium may store instructions for execution by one or more processors, including instructions for causing the processor(s) to perform steps or stages consistent with the embodiments described herein.
- the term “computer-readable medium” should be understood to include tangible items and exclude carrier waves and transient signals, i.e., be non-transitory. Examples include random access memory (RAM), read-only memory (ROM), volatile memory, nonvolatile memory, hard drives, CD ROMs, DVDs, flash drives, disks, and any other known physical storage media.
Abstract
Description
- This application claims the benefit of Indian Patent Application Serial No. 201641002564 filed Jan. 22, 2016, which is hereby incorporated by reference in its entirety.
- This disclosure relates generally to information technology infrastructure management, and more particularly to system and method for classifying and resolving software production incident tickets.
- In the current business environment, industries and enterprises are continuously looking for means and models to operate efficiently and to meet ever evolving customer demands. Digitization of various processes and activities in an industry or an enterprise is one such means that is being enabled by the advancements in the field of Information Technology (IT). This digitization is deployed using IT infrastructures that involve a complex combination of devices and software solutions. However, to derive the benefits of digitization, the IT infrastructures need to run smoothly.
- Various tools have been designed and developed to monitor and/or predict any anomaly or malfunctioning in these IT infrastructures so that the anomaly can be resolved quickly and proactively. However, despite much advancement the resolutions provided by the support team are at times delayed and/or not accurate. Such delays accrue due to many reasons, among which few being the sheer load of unwanted and/or redundant alerts or tickets corresponding to various anomalies or defects in IT infrastructures that get logged requiring attention of the support team to resolve them quickly. Various existing optimization tools and techniques to address this concern still don't address the problem effectively. Hence, the technical support teams face the barrage of unwanted alerts or tickets to resolve and thereby limiting the time that is required to address the genuine and the critical alerts or tickets. These limitations, in turn, affect the overall functioning of the organization or the enterprise. Automation is one of way to resolve the alerts or tickets without human intervention so as to increase resolution efficiency and to reduce cost. However, identification of automation candidate among tickets and invoking corresponding resolution script still requires some manual efforts.
- In one embodiment, a method for classifying software production incident tickets is disclosed. In one example, the method comprises receiving an incident ticket. The method further comprises extracting a plurality of keywords from the incident ticket. The method further comprises deriving a query vector corresponding to the incident ticket based on the plurality of keywords. The method further comprises classifying the incident ticket into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and a plurality of vectors derived from a plurality of past incident tickets. The plurality of vectors are derived based on a plurality of keywords and their corresponding occurrences in the plurality of past incident tickets.
- In one embodiment, a system for classifying software production incident tickets is disclosed. In one example, the system comprises at least one processor and a memory communicatively coupled to the at least one processor. The memory stores processor-executable instructions, which, on execution, cause the processor to receive an incident ticket. The processor-executable instructions, on execution, further cause the processor to extract a plurality of keywords from the incident ticket. The processor-executable instructions, on execution, further cause the processor to derive a query vector corresponding to the incident ticket based on the plurality of keywords. The processor-executable instructions, on execution, further cause the processor to classify the incident ticket into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and a plurality of vectors derived from a plurality of past incident tickets. The plurality of vectors are derived based on a plurality of keywords and their corresponding occurrences in the plurality of past incident tickets.
- In one embodiment, a non-transitory computer-readable medium storing computer-executable instructions for classifying software production incident tickets is disclosed. In one example, the stored instructions, when executed by a processor, cause the processor to receive an incident ticket. The stored instructions, when executed by the processor, further cause the processor to extract a plurality of keywords from the incident ticket. The stored instructions, when executed by the processor, further cause the processor to derive a query vector corresponding to the incident ticket based on the plurality of keywords. The stored instructions, when executed by the processor, further cause the processor to classify the incident ticket into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and a plurality of vectors derived from a plurality of past incident tickets. The plurality of vectors are derived based on a plurality of keywords and their corresponding occurrences in the plurality of past incident tickets.
- It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.
- The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate exemplary embodiments and, together with the description, serve to explain the disclosed principles.
-
FIG. 1 is a block diagram of an exemplary system for classifying and resolving software production incident tickets in accordance with some embodiments of the present disclosure. -
FIG. 2 is a functional block diagram of a classification and resolution engine in accordance with some embodiments of the present disclosure. -
FIG. 3 illustrates an exemplary knowledge representation as stored in solution knowledge base. -
FIG. 4 illustrates an exemplary two-dimensional KD-tree for indexing the knowledge representation ofFIG. 3 . -
FIG. 5 is a flow diagram of an exemplary process for classifying and resolving software production incident tickets in accordance with some embodiments of the present disclosure. -
FIG. 6 is a flow diagram of a detailed exemplary process for classifying and resolving software production incident tickets in accordance with some embodiments of the present disclosure. -
FIG. 7 is a block diagram of an exemplary computer system for implementing embodiments consistent with the present disclosure. - Exemplary embodiments are described with reference to the accompanying drawings. Wherever convenient, the same reference numbers are used throughout the drawings to refer to the same or like parts. While examples and features of disclosed principles are described herein, modifications, adaptations, and other implementations are possible without departing from the spirit and scope of the disclosed embodiments. It is intended that the following detailed description be considered as exemplary only, with the true scope and spirit being indicated by the following claims.
- Referring now to
FIG. 1 , anexemplary system 100 for classifying and resolving software production incident tickets is illustrated in accordance with some embodiments of the present disclosure. The incident tickets correspond to anomalies, defects, or any other obstructions in an information technology (IT) infrastructure. In particular, thesystem 100 implements a technique for providing classification of incident tickets based on their mechanization or automation possibility, and for providing automatic resolution for the incident tickets for which mechanization or automation is possible. - The
system 100 comprises anIT infrastructure 101 supporting an organization or an enterprise. TheIT infrastructure 101 may include IT systems and devices interconnected by communication networks and running a host of software applications for managing the organization or the enterprise, enabling information processing like archival and retrieval, and enabling work processes, and so forth. Thus, theIT infrastructure 101 is a collection of hardware, software, and network resources. The hardware resources may be servers, computers, switches, routers, adopters, hubs, and so forth. The software resources may be operating systems, enterprise resource planning (ERP) solutions, customer relationship management (CRM) solutions, productivity applications, and so forth. The network resources may be Ethernet, Internet, firewall, communications protocols, and so forth. A number ofusers 102 such as network administrators, developers, end users, and so forth may operate or use theIT infrastructure 101 while performing day to day work in the organization or the enterprise. - The
system 100 further comprises an IT service management (ITSM)tool 103. The ITSMtool 103 is a service level incident management tool where all incidents are logged as tickets in an incident repository. The ITSMtool 103 is responsible for receiving and processing the incident tickets so as to provide fast and accurate resolution. In some embodiments, the ITSMtool 103 may be build based on the IT infrastructure Library (ITIL) guidelines. Examples ofITSM tool 103 may include, but are not limited to, Wipro® eHelpline, BMC™ Remedy 9, ServiceNOW™, and so forth. The incident tickets are logged intoITSM tool 103 either automatically after monitoring and processing or manually. Thus, qualified events which are generated by any monitoring solution will be converted as an incident ticket. Similarly, a human user such as theuser 102 may also log an incident ticket in theITSM tool 103. System generated events or incident tickets are typically related to availability, capacity, performance of one or more components of the IT infrastructure 101 (e.g., memory utilization, CPU utilization, and so forth). Additionally, the events or incident tickets may be related to software or applications infrastructures (e.g., auto system scheduler issue, database refresh failure, long running query issue, and so forth), or may be related to hardware faults (e.g., network port Issue, LAN issue, and so forth). - The
system 100 further comprisesmonitoring tools 104 for monitoring theIT infrastructure 101. Themonitoring tool 104 monitors the behavior of a particular infrastructure component (server, application, etc.) with respect to a pre-defined threshold and/or after a pre-defined interval. It should be noted that, in many cases, one can easily identify the problem in theIT infrastructure 101 based on certain change in regular pattern or behavior. For example, themonitoring tool 104 may generate alerts for events whenever a threshold is reached. Thus, themonitoring tool 104 picks up problems or events corresponding to potential problems in theIT infrastructure 101. Examples ofmonitoring tool 104 may include, but are not limited to, Wipro® Viking, HP® OpenView, IBM® Tivoli, and so forth. - The
system 100 further comprises anevent correlation engine 105 for correlating multiple events detected by themonitoring tool 104 and to identify few events that are relevant and of importance based on a set of rules. For example, if a router is down, the underlying devices or application (e.g., computer, ERP) will be down as well. Themonitoring tool 104 may generate alerts for the router as well as for the other underlying devices. However, the event correlation will indicate that router is the issue. Theevent correlation engine 105 processes the multiple events and analyzes relationships between events. The set of rules is then generated based on the analysis to suppress the unwanted events before logging the events as incident tickets. For example, the rules may include, but are not limited to, alert already exist, many to one alert, suppress by outage, and so forth. - The system further comprises an incident classification and
resolution engine 106 for classifying and resolving software production incident tickets. As will be described in greater detail in conjunction withFIG. 2 , the incident classification andresolution engine 106 classifies incident tickets based on their mechanization possibility, and subsequently provides automatic resolution for those incident tickets for which mechanization is possible. The incident classification andresolution engine 106 comprises apreparatory analyzer 107, a run-time analyzer 108, and a solution knowledge base (SK-Base) and configuration management database (CMDB) 109. - The
preparatory analyzer 107 analyzes all the previously logged incident tickets in theITSM 103 based on their mechanization status and derives vectors or feature matrices using natural language processing that are subsequently employed for identification or determination of possible mechanization candidates. Thepreparatory analyzer 107 then updates the SK-Base 109 with these vectors and feature matrices. Additionally, thepreparatory analyzer 107 represents the mechanization solutions as knowledge in SK-Base, searches the availability of different mechanization solutions in the SK-Base, and accordingly updates the SK-Base. - The run-
time analyzer 108 analyzes the alerts from the event correlation or ITSM and classifies the alerts into possibly mechanization candidates or not using natural language processing and based on the vectors or feature matrices built by thepreparatory analyzer 107. Additionally, the run-time analyzer 108 acquires the knowledge about available mechanization solution from SK-Base 109 for the positive mechanization candidates and then maps the mechanization candidates towards the available mechanization solutions. Further, the run-time analyzer 108 updates the resolved information inITSM tool 103 which then implements or applies the resolution in theIT infrastructure 101. Further, as will be appreciated by those skilled in the art, the run-time analyzer 108 updates theITSM tool 103 with negative mechanization candidates. Such tickets are then picked up fromITSM tool 103 for manual resolution by auser 110 and the resolution is then updated in theITSM tool 103 for subsequent implementation or application in theIT infrastructure 101. - The SK-
Base 109 is a knowledge repository of vectors and/or feature matrices, and automation solutions (e.g., scripts). The solutions are indexed against the alert/ticket. TheCMDB 109 is a configuration repository comprising information about configuration item (CI) of a particular location (e.g., IP address, etc.), capacity (e.g., server capacity, memory capacity, etc.), and other such information about the IT infrastructure. This information is employed by theITSM tool 103 to implement the solution in theIT infrastructure 101. - Referring now to
FIG. 2 , a functional block diagram of an incident classification and resolution engine 200 (analogous to the incident classification and resolution engine 106) implemented by thesystem 100 ofFIG. 1 is illustrated in accordance with some embodiments of the present disclosure. As discussed above, the incident classification andresolution engine 200 comprises a preparatory analyzer 201 (analogous to the preparatory analyzer 107), a run-time analyzer 202 (analogous to the run-time analyzer 108), and a SK-Base and CMDB 203 (analogous to the SK-Base and CMDB 109). Thepreparatory analyzer 201 derives vectors and/or feature matrices based on past incident tickets while the run-time analyzer 202 determines if a current incident ticket is a mechanization candidate or not based on the vectors and/or the feature matrices. Further, SK-Base andCMDB 203 stores vectors, feature matrices, existing solutions or resolutions, mapping between positive mechanization incident tickets and the existing solutions, information about CI, and other such information. - The
preparatory analyzer 201 acquires all the past (i.e., previously logged) incident tickets from the ITSM tool as training data atstep 204. In some embodiments, the training data may be selected manually based on an empirical knowledge of the data. The manual selection may be performed in consultation with domain experts such as automation domain expert, operational engineers, and so forth. Thepast incident tickets 205 are then categorized based on their known mechanization status atstep 206. Thus, all the past incident tickets are categorized in at least two categories or classes—category 1 being incident tickets for which mechanization is possible (i.e., positive samples having automated solutions) and category 2 being incident tickets for which mechanization is not possible (i.e., negative samples for which there is no automated solutions). For example, an incident ticket stating that ‘a device has been stolen’ is not a mechanization candidate as the device needs to be physically replaced. However, an incident ticket stating that ‘memory utilization has exceeded a threshold value’ may be a mechanization candidate as the resolution may be to run a script so as to clean up the memory. In some embodiments, the past incident tickets may be categorized into more than 2 categories based on their mechanization level—full mechanization possible, mechanization not possible, partial mechanization is possible (e.g., 40% mechanization, 60% mechanization, and so forth). - For each category, a description of each incident ticket is initially pre-processed at
step 207 so as to determine a concise or a representative description while preserving the content, context, and meaning of that ticket. In some embodiments, the pre-processing may involve removing stop words (e.g., punctuations, numbers, and so forth) as they have little or no contribution to content, context, and meaning of the ticket, thereby leading to lower accuracy in subsequent classification. For example, from the incident ticket having description ‘a device has been stolen’, stop words such as ‘has’, ‘been’, as well as any punctuation mark may be removed. Further, in some embodiments, the pre-processing may involve stemming where different forms of same words in the description (e.g., device/devices, utilization/utilizes/utilizing, etc.) may be represented by one word (e.g., device, utilization, etc.). It should be noted that pre-processing may also involve other text processing techniques. Thus, for the incident ticket having description ‘memory utilization has exceeded the threshold value on windows server’, pre-processing may provide a concise or representative description as ‘memory utilization exceed threshold window server’ or as ‘memory utilization’. Thus, for each category, we have multiple concise or representative descriptions corresponding to multiple incident tickets belonging to the given category. - Further, for each category, a number of keywords are extracted from the multiple concise descriptions belonging to the give category at
step 208. For example, the keywords ‘device’ and ‘stolen’ may be extracted from the concise description ‘device stolen’ and the keywords ‘memory’, ‘utilization’, ‘exceed’, ‘threshold’, ‘window’, and ‘server’ may be extracted from ‘memory utilization exceed threshold window server’. In some embodiments, at least three different training corpuses may be built using these keywords—training corpus comprising of all keywords (e.g., ‘device’, ‘stolen’, ‘memory’, ‘utilization’ etc.), training corpus comprising all noun keywords (e.g. ‘device’, ‘CPU’ memory′ etc.), and training corpus comprising all verb keywords (stolen′, ‘utilization’ etc.). It should be noted that various other training corpuses depending on various other categorizations of keywords may also be employed in various other embodiments. Further, in some embodiments, each of the keywords may be represented by a unique number representation for ease of subsequent processing. For example, in some embodiments, each of the alphabets is assigned a unique number, and then an exponentiation and a subtraction operation may be employed on each of the alphabet based on the position of the alphabet in the keyword so as to determine the unique number representation. It should be noted that the choice of the exponentiation and the subtraction operation is because of their non-associative property. Thus, the unique number representation for the keyword ‘device’ may be determined as follows: -
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
Now, D→4 (p→1), e→5 (p→2), v→22 (p→3), i→9 (p→4), c→3 (p→5), and e→5 (p→6), where p is the position of alphabet within the keyword. The unique number representation for the keyword ‘device’ is therefore 41−52−223−94−35−56 i.e. ‘−33098’. Similarly, unique number representations for the keyword ‘CPU’ is 31−162−213 i.e. ‘−9514’, for the keyword ‘memory’ is 131−52−133−154−185−256 i.e. −246083027, and for the keyword ‘utilization’ is 211−202−93−124−95−266−17−208−99−1510−1411 i.e., −4652511977448. - Further, for each category, a plurality of vectors is derived based on the plurality of keywords and their corresponding occurrences in plurality of past incident tickets at
step 209. In some embodiments, the vectors may be derived for at least one of a mode, a median, and a range for the plurality of keywords. Thus, the vectors may be derived by iteratively extracting most commonly occurring keyword (i.e., mode), by iteratively extracting middle occurring keyword from keywords arranged in ascending or descending order of occurrence frequency (i.e., median), by iteratively extracting most and least commonly occurring keyword from keywords arranged in ascending or descending order of occurrence frequency (range). The size of each of the vectors (i.e., number of keywords in the vector) may be determined based on a pre-defined number (e.g., 50 keywords) or based on fulfillment of some pre-defined conditions (e.g., keywords that occur at least 50 times). It should be noted that various other vectors depending on occurrences of the keywords in past incident tickets may be derived in various other embodiments. In some embodiments, the plurality of vectors may be derived for each of the training corpuses i.e., all keywords, noun keywords, verb keywords. Thus, in some embodiments, there are 18 vectors in total—9 vectors for each category as follows: -
- Vector 1={mode of all keywords} of size m1 for category 1 (mechanization possible);
- Vector 2={mode of all noun keywords} of size m2 for category 1;
- Vector 3={mode of all verb keywords} of size m3 for category 1;
- Vector 4={median of all keywords} of size m4 for category 1;
- Vector 5={median of all noun keywords} of size m5 for category 1;
- Vector 6={median of all verb keywords} of size m6 for category 1
- Vector 7={range of all keywords} of size m7 for category 1;
- Vector 8={range of all noun keywords} of size m8 for category 1;
- Vector 9={range of all verb keywords} of size m9 for category 1;
- Vector 10={mode of all keywords} of size m10 for category 2 (mechanization not possible);
-
Vector 11={mode of all noun keywords} of size m11 for category 2; - Vector 12={mode of all verb keywords} of size m12 for category 2;
-
Vector 13={median of all keywords} of size m13 for category 2; - Vector 14={median of all noun keywords} of size m14 for category 2;
- Vector 15={median of all verb keywords} of size m15 for category 2;
- Vector 16={range of all keywords} of size m16 for category 2;
- Vector 17={range of all noun keywords} of size m17 for category 2;
- Vector 18={range of all verb keywords} of size m18 for category 2.
- Further, in some embodiments, for each category, one or more feature matrices may be derived based on the plurality of vectors. Each feature matrix is a set of vectors from the plurality of vectors. For example, in some embodiments, there are 6 matrices in total (3 matrices for each category) where matrix 1 may be collection of vector 1, vector 2, and vector 3 representing mode for all keywords, noun keywords, verb keywords for category 1, matrix 2 may be collection of vector 4, vector 5, and vector 6 representing median for all keywords, noun keywords, verb keywords for category 1, matrix 3 may be collection of vector 7, vector 8, and vector 9 representing range for all keywords, noun keywords, verb keywords for category 1, matrix 4 may be collection of vector 10,
vector 11, and vector 12 representing mode for all keywords, noun keywords, verb keywords for category 2, matrix 5 may be collection ofvector 13, vector 14, and vector 15 representing median for all keywords, noun keywords, verb keywords for category 2, and matrix 6 may be collection of vector 16, vector 17, and vector 18 representing range for all keywords, noun keywords, verb keywords for category 2. The derived vectors and/or feature matrices are stored in SK Base andCMDB 203 for subsequent use by the run-time analyzer 202 for classification of the current incident ticket into mechanization candidate or not. Further, as will be described in greater detail in conjunction withFIGS. 3 and 4 , thepreparatory analyzer 201 may index, store, and update existing mechanization solutions in the SK-Based 203 (i.e., knowledge repository) for subsequent resolution of the incident ticket for which mechanization is possible. - The run-
time analyzer 202 receives the incident ticket from the ITSM tool or the event correlation engine as test data or run-time data atstep 210. As stated above, the event correlation engine provides automatically captured incident tickets while the ITSM tool provides manually logged incident tickets to the run-time analyzer 202. Theincident ticket 211 is then pre-processed atstep 212 so as to extract a concise or a representative description of the ticket from the initially provided description. Thepre-processing step 212 is similar to thepre-processing step 207 described above and may involve removing stop words (e.g., punctuations, numbers, etc.), stemming, and other such text processing techniques. Further, a number of keywords are extracted from the concise or the representative description atstep 213. Further, in some embodiments, each of the keywords may be represented by a unique number representation for ease of subsequent processing. Thestep 213 is similar to thestep 208 described above for extraction of keywords and for determining unique number representation for the extracted keywords. Further, a query vector is derived based on the plurality of keywords atstep 214. - The incident ticket is then classified at
step 215 into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and the plurality of vectors or feature matrices. In some embodiments, the classification may be into more than 2 categories—full mechanization possible, mechanization not possible, partial mechanization is possible (e.g., 40% mechanization, 60% mechanization, and so forth). For classification, first the plurality of derived vectors and/or feature matrices is accessed from the SK Base andCMDB 203. In some embodiments, each of the derived vectors and/or the feature matrices may be normalized using the following equation: -
- where i and j represents position of individual word representation within the vectors and/or feature matrices while n and m represents size of the vectors and/or feature matrices. It should be noted that the value of i and therefore n is equal to 1 for the vectors while the value of n is equal to 3 for the feature matrices comprising of 3 vectors. Further, the size of the query vector (i.e., number of keywords in the query vector) is adjusted so as to be of same size as the vector or the feature matrix it is being compared with. This is achieved by populating the query vector with dummy keywords (e.g., ‘00000’) till the size of adjusted query vector and the vector or the feature matrix it is being compared with is same. Additionally, the placements of original keywords within the adjusted query vector are further adjusted such that they correspond to the placements of those keywords within the vector or the feature matrix it is being compared with (i.e., the keywords are in same positions as that in the vector it is being compared with). For example, if the query vector comprises of keywords ‘device’ and ‘stolen’, and it is to be compared with the vector having 100 keywords where ‘device’ appears at 4th position and ‘stolen’ appears at 99th position, then the adjusted query vector will also comprises of 100 keywords comprising of ‘device’ at 4th position, ‘stolen’ at 99th position, and dummy keywords at rest of the positions.
- In some embodiments, the classification comprises performing a nearest neighbor classification based on at least one of a similarity and a dissimilarity between the query vector and each of the plurality of vectors. In some embodiments, determining the similarity comprises determining a cosine similarity as follows:
-
- Further, in some embodiments, determining the dissimilarity comprises determining a Euclidean distance as follows:
-
Euclidean distance=√{square root over ((Vector1−Vector2)2)} - where vector 1 is the query vector and vector 2 is the vector it is being compared with. The nearest neighbor classification is then performed by determining a decision parameter based on the cosine similarity and the Euclidean distance as follows:
-
- Thus, for example if two vectors are as follows:
-
Vector 1 7 2 5 0 9 Vector 2 0 2 3 2 4 -
- In some embodiments, a plurality of decision parameters is calculated based on the query vector and each of 18 vectors (9 vectors with respect to category 1 and 9 vectors with respect to category 2) or 6 feature matrices (3 feature matrices with respect to category 1 and 3 feature matrices with respect to category 2) described above. An average value of the decision parameter is then calculated for 9 vectors with respect to category 1 or 3 feature matrices with respect to category 1. Similarly, an average value of the decision parameter is then calculated for 9 vectors with respect to category 2 or 3 feature matrices with respect to category 2. The incident ticket belongs to the category having higher value of average decision factor.
-
Category 1 Category 2 Decision parameter 1 Decision parameter 10 Decision parameter 2 Decision parameter 11Decision parameter 3 Decision parameter 12 Decision parameter 4 Decision parameter 13Decision parameter 5 Decision parameter 14 Decision parameter 6 Decision parameter 15 Decision parameter 7 Decision parameter 16 Decision parameter 8 Decision parameter 17 Decision parameter 9 Decision parameter 18 Average decision parameter Average decision parameter of category 1 of category 2 - If the incident ticket belongs to category 2 representing tickets for which mechanization is not possible then it is a negative
mechanization incident ticket 216 and the ITSM or the incident repository within ITSM is updated with the incident ticket atstep 217. Such tickets may then be taken up for manual resolution. However, if the incident ticket belongs to category 1 representing tickets for which mechanization is possible then it is a positivemechanization incident ticket 218. In some embodiments, the run-time analyzer 202 resolves such incident ticket using an existing solution atstep 219. As will be described in greater detail in conjunction withFIGS. 3 and 4 , this is achieved by first identifying the existing solution from a plurality of existing solutions indexed in the SK-Base 203 (i.e., the knowledge repository) based on the incident ticket and then invoking one or more scripts associated with the existing solution to resolve the ticket. Subsequent to resolution, the ITSM or the incident repository within ITSM is updated with the incident ticket and the existing solution identified and implemented atstep 220. - Referring now to
FIG. 3 , the incident classification andresolution engine 200 stores theknowledge representation 300 of the all available mechanization solutions in the SK-Base 203 indexed against various positive mechanization tickets. As illustrated, eachuse case 301 representing positive mechanization tickets may be associated withdifferent descriptions 302. Further, eachuse case 301 may have one or more associatedscripts 303 as solution. Theuse case 301 is represented using similar representation (e.g., vector) as that of the incident ticket. For example, theuse case 301 may be CPU utilization, memory utilization, database backup, and so forth. Alternatively, theuse case 301 may be unique number representations of CPU utilization, memory utilization, database backup, and so forth. Thus, theuse case 301 is a class representation of different tickets having different descriptions but belonging to one major class. All thedescriptions 302 related to oneuse case 301 are combined into a corpus. For example, CPU utilization use case or class representation may correspond to descriptions such as ‘CPU UTILIZATION has exceeded the threshold value on Windows Server’, ‘CPU UTILIZATION has exceeded the threshold value on VMware VM Windows 2008 Server Device’, ‘The threshold for the CPU has exceeded’, and so forth. Similarly, memory utilization use case or class representation may correspond to descriptions such as ‘MEMORY UTILIZATION has exceeded the threshold value on Windows Server’, ‘MEMORY UTILIZATION has exceeded the threshold value on Windows 2008 Server Device’, ‘CPU UTILIZATION, MEMORY UTILIZATION, WinWPX has exceeded the threshold value on VMware VM Windows 2003 Server Device’, and so forth. Similarly, database backup use case or class representation may correspond to descriptions such as ‘OVO PS Description: BACKUP failed to complete the command BACKUP DATABASE’, ‘MS SQL SERVER Description: BACKUP failed to complete the command BACKUP DATABASE’, and so forth. Thus, it is theuse case 301 that is matched against the query vector for identifying the existing solution. Once the use case is identified, the scripts associated with that use case is then invoked to resolve the incident ticket. - Referring now to
FIG. 4 , the incident classification andresolution engine 200 employs a K dimensional tree or a KD-tree 400 for indexing theknowledge representation 300 ofFIG. 3 . The KD-tree 400 is a multilevel and multidimensional indexing structure and therefore able to support k-dimensional data points. In some embodiments, thepreparatory analyzer 201 may employ mode values of all keywords (e.g., two or three most commonly occurring keywords) in the incident tickets belonging to each of the major classes as keys for indexing the use case. However, it should be noted that any other choice of values for keywords (e.g., median values or range values) may be equally employed as keys to represent the use cases. In the illustrated figure, KD-tree 400 is a two-dimensional tree (i.e., k=2) with two mode values being employed as the keys for indexing the use cases (e.g., CPU utilization, memory utilization, database backup, and so forth). Further, the unique number representations may be employed to represent the keys. Thus, for example, the key for use case ‘CPU utilization’ is (−9514, −4652511977448) and that for memory utilization is (−246083027, −4652511977448) as the unique number representations of CPU is −9514, memory is −246083027, and utilization is −4652511977448. The KD-tree 400 may then be created through insertion. Subsequently, balancing of the KD-tree 400 may be performed for fast retrieval of use cases and therefore associated solutions. It should be noted that the dimensions of the KD-tree 400 as well as choice of keys are user-defined and dependent on the number of words needed to represent the use cases. For example, in the illustrated two-dimensional KD-tree 400, all the use cases are represented by two words. However, in some embodiments, the use cases may be represented by three words or n number of words resulting in three-dimensional or n-dimensional KD-tree. It should be noted that, in some embodiments, all the use cases should be represented by same number of keywords. Alternatively, in some embodiments, the use cases may be represented by different number of words and default words (e.g., ‘00000’) may be employed to equalize the number of words so as to index the use cases via a KD-tree 400. - As will be appreciated by one skilled in the art, a variety of processes may be employed for classifying and resolving software production incident tickets. For example, the
exemplary system 100 and the associated incident classification andresolution engine 200 may classify and resolve software production incident tickets by the processes discussed herein. In particular, as will be appreciated by those of ordinary skill in the art, control logic and/or automated routines for performing the techniques and steps described herein may be implemented by thesystem 100 and the associated incident classification andresolution engine 200, either by hardware, software, or combinations of hardware and software. For example, suitable code may be accessed and executed by the one or more processors on thesystem 100 to perform some or all of the techniques described herein. Similarly application specific integrated circuits (ASICs) configured to perform some or all of the processes described herein may be included in the one or more processors on thesystem 100. - For example, referring now to
FIG. 5 ,exemplary control logic 500 for classifying and resolving software production incident tickets by a system, such assystem 100, is depicted by a flowchart in accordance with some embodiments of the present disclosure. As illustrated in the flowchart, thecontrol logic 500 includes the steps of receiving an incident ticket atstep 501, extracting a plurality of keywords from the incident ticket atstep 502, and deriving a query vector corresponding to the incident ticket based on the plurality of keywords atstep 503. Thecontrol logic 500 further includes the steps of classifying the incident ticket into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and a plurality of vectors derived from a plurality of past incident tickets atstep 504. The plurality of vectors are derived based on a plurality of keywords and their corresponding occurrences in the plurality of past incident tickets. - In some embodiments, the
control logic 500 further includes the step of determining a unique number representation for each of the plurality of keywords. Further, in some embodiments, thecontrol logic 500 further includes the step of deriving the plurality of vectors from the plurality of past incident tickets by categorizing the plurality of past incident tickets in an incident repository into at least two category based on a mechanization status, extracting the plurality of keywords from the plurality of past incident tickets for each category, and deriving the plurality of vectors based on the plurality of keywords and their corresponding occurrences in plurality of past incident tickets for each category. In some embodiments, deriving the plurality of vectors comprises deriving the plurality of vectors for at least one of all keywords, noun keywords, and verb keywords. Further, in some embodiments, deriving the plurality of vectors comprises deriving the plurality of vectors for at least one of a mode, a median, and a range for the plurality of keywords. Further, in some embodiments, deriving the plurality of vectors comprises normalizing each of the plurality of vectors. - In some embodiments, extracting the plurality of keywords at
step 502 comprises pre-processing the incident ticket for stemming or for removing at least one of a stop word (e.g., punctuations, numbers, etc.). Further, in some embodiments, classifying atstep 504 comprises performing a nearest neighbor classification based on at least one of a similarity and a dissimilarity between the query vector and the plurality of vectors. In some embodiments, the similarity comprises a cosine similarity, the dissimilarity comprises a Euclidean distance, and performing the nearest neighbor classification comprises determining a decision parameter based on the cosine similarity and the Euclidean distance. Further, in some embodiments, classifying atstep 504 further comprises deriving one or more feature matrices based on the plurality of vectors, and comparing the query vector and the one or more feature matrices. - In some embodiments, the
control logic 500 further includes the step of resolving the incident ticket using an existing solution for the positive mechanization incident ticket by identifying the existing solution from a plurality of existing solutions indexed in a knowledge repository based on the incident ticket, and invoking one or more scripts associated with the existing solution. Further, in some embodiments, thecontrol logic 500 further includes the step of updating the incident repository with the incident ticket and, for the positive mechanization incident ticket, with the existing solution. - Referring now to
FIG. 6 ,exemplary control logic 600 for classifying and resolving software production incident tickets is depicted in greater detail by a flowchart in accordance with some embodiments of the present disclosure. As illustrated in the flowchart, thecontrol logic 600 includes the steps of acquiring past incident tickets from the ITSM atstep 601, and categorizing the past incident tickets into at least 2 categories based on their corresponding mechanization status atstep 602. Thecontrol logic 600 further includes the steps of pre-processing the incident tickets for each category atstep 603, extracting keywords from pre-processed incident tickets for each category atstep 604, and determining unique number representations for each of the plurality of keywords for each category atstep 605. Thecontrol logic 600 further includes the step of deriving a plurality of vectors based on the plurality of keywords and their corresponding occurrences in plurality of past incident tickets for each category atstep 606. The vectors may be derived for different training corpuses of keywords (e.g., all keywords, noun keywords, verb keywords, etc.) and for different types of frequency of occurrences (e.g., mode, median, range, etc.). In some embodiments, feature matrices may be derived based on the plurality of vectors for each category. Thecontrol logic 600 further includes the step of normalizing each of the plurality of vectors and/or feature matrices atstep 607. - Additionally, the
control logic 600 includes the steps of receiving an incident ticket from the event correlation engine or the ITSM atstep 608, pre-processing the incident ticket atstep 609, extracting keywords from pre-processed incident ticket atstep 610, determining unique number representations for each of the plurality of keywords atstep 611, and deriving a query vector based on the plurality of keywords atstep 612. Thecontrol logic 600 further includes the step of classifying the incident tickets into at least one of a positive mechanization incident ticket and a negative mechanization incident ticket based on a comparison of the query vector and the plurality of vectors or the feature matrices atstep 613. The classification involves performing a nearest neighbor classification by determining a decision parameter based on the cosine similarity and the Euclidean distance. - The
control logic 600 further includes the step of determining if the incident ticket is a positive mechanization incident ticket or not atstep 614. If the incident ticket is positive mechanization incident ticket, then thecontrol logic 600 includes the step of resolving the incident ticket using an existing solution atstep 615. In some embodiments, resolving atstep 615 may further comprise identifying the existing solution from a plurality of existing solutions indexed in a knowledge repository (i.e., SK-Base) atstep 616, and invoking one or more scripts associated with the existing solution atstep 617. Thecontrol logic 600 further includes the step of updating the incident repository within ITSM with the incident ticket and the associated resolution (i.e., existing solution) atstep 618. The ITSM may subsequently implement the provided resolution. However, if the incident ticket is not a positive mechanization incident ticket, then thecontrol logic 600 directly flows to step 618 and updates the incident repository within ITSM with the incident ticket. In such cases, the incident ticket is taken for manual resolution. - As will be also appreciated, the above described techniques may take the form of computer or controller implemented processes and apparatuses for practicing those processes. The disclosure can also be embodied in the form of computer program code containing instructions embodied in tangible media, such as floppy diskettes, CD-ROMs, hard drives, or any other computer-readable storage medium, wherein, when the computer program code is loaded into and executed by a computer or controller, the computer becomes an apparatus for practicing the invention. The disclosure may also be embodied in the form of computer program code or signal, for example, whether stored in a storage medium, loaded into and/or executed by a computer or controller, or transmitted over some transmission medium, such as over electrical wiring or cabling, through fiber optics, or via electromagnetic radiation, wherein, when the computer program code is loaded into and executed by a computer, the computer becomes an apparatus for practicing the invention. When implemented on a general-purpose microprocessor, the computer program code segments configure the microprocessor to create specific logic circuits.
- The disclosed methods and systems may be implemented on a conventional or a general-purpose computer system, such as a personal computer (PC) or server computer. Referring now to
FIG. 7 , a block diagram of anexemplary computer system 701 for implementing embodiments consistent with the present disclosure is illustrated. Variations ofcomputer system 701 may be used for implementingsystem 100 and incident classification andresolution engine 200 for classifying and resolving software production incident tickets.Computer system 701 may comprise a central processing unit (“CPU” or “processor”) 702.Processor 702 may comprise at least one data processor for executing program components for executing user- or system-generated requests. A user may include a person, a person using a device such as such as those included in this disclosure, or such a device itself. The processor may include specialized processing units such as integrated system (bus) controllers, memory management control units, floating point units, graphics processing units, digital signal processing units, etc. The processor may include a microprocessor, such as AMD Athlon, Duron or Opteron, ARM's application, embedded or secure processors, IBM PowerPC, Intel's Core, Itanium, Xeon, Celeron or other line of processors, etc. Theprocessor 702 may be implemented using mainframe, distributed processor, multi-core, parallel, grid, or other architectures. Some embodiments may utilize embedded technologies like application-specific integrated circuits (ASICs), digital signal processors (DSPs), Field Programmable Gate Arrays (FPGAs), etc. -
Processor 702 may be disposed in communication with one or more input/output (I/O) devices via I/O interface 703. The I/O interface 703 may employ communication protocols/methods such as, without limitation, audio, analog, digital, monaural, RCA, stereo, IEEE-1394, serial bus, universal serial bus (USB), infrared, PS/2, BNC, coaxial, component, composite, digital visual interface (DVI), high-definition multimedia interface (HDMI), RF antennas, S-Video, VGA, IEEE 802.n/b/g/n/x, Bluetooth, cellular (e.g., code-division multiple access (CDMA), high-speed packet access (HSPA+), global system for mobile communications (GSM), long-term evolution (LTE), WiMax, or the like), etc. - Using the I/
O interface 703, thecomputer system 701 may communicate with one or more I/O devices. For example, the input device 704 may be an antenna, keyboard, mouse, joystick, (infrared) remote control, camera, card reader, fax machine, dongle, biometric reader, microphone, touch screen, touchpad, trackball, sensor (e.g., accelerometer, light sensor, GPS, gyroscope, proximity sensor, or the like), stylus, scanner, storage device, transceiver, video device/source, visors, etc.Output device 705 may be a printer, fax machine, video display (e.g., cathode ray tube (CRT), liquid crystal display (LCD), light-emitting diode (LED), plasma, or the like), audio speaker, etc. In some embodiments, atransceiver 706 may be disposed in connection with theprocessor 702. The transceiver may facilitate various types of wireless transmission or reception. For example, the transceiver may include an antenna operatively connected to a transceiver chip (e.g., Texas Instruments WiLink WL1283, Broadcom BCM4750IUB8, Infineon Technologies X-Gold 618-PMB9800, or the like), providing IEEE 802.11a/b/g/n, Bluetooth, FM, global positioning system (GPS), 2G/3G HSDPA/HSUPA communications, etc. - In some embodiments, the
processor 702 may be disposed in communication with acommunication network 708 via anetwork interface 707. Thenetwork interface 707 may communicate with thecommunication network 708. The network interface may employ connection protocols including, without limitation, direct connect, Ethernet (e.g., twisted pair 10/100/1000 Base T), transmission control protocol/internet protocol (TCP/IP), token ring, IEEE 802.11a/b/g/n/x, etc. Thecommunication network 708 may include, without limitation, a direct interconnection, local area network (LAN), wide area network (WAN), wireless network (e.g., using Wireless Application Protocol), the Internet, etc. Using thenetwork interface 707 and thecommunication network 708, thecomputer system 701 may communicate withdevices computer system 701 may itself embody one or more of these devices. - In some embodiments, the
processor 702 may be disposed in communication with one or more memory devices (e.g.,RAM 713,ROM 714, etc.) via astorage interface 712. The storage interface may connect to memory devices including, without limitation, memory drives, removable disc drives, etc., employing connection protocols such as serial advanced technology attachment (SATA), integrated drive electronics (IDE), IEEE-1394, universal serial bus (USB), fiber channel, small computer systems interface (SCSI), etc. The memory drives may further include a drum, magnetic disc drive, magneto-optical drive, optical drive, redundant array of independent discs (RAID), solid-state memory devices, solid-state drives, etc. - The memory devices may store a collection of program or database components, including, without limitation, an operating system 716, user interface application 717, web browser 718, mail server 719, mail client 720, user/application data 721 (e.g., any data variables or data records discussed in this disclosure), etc. The operating system 716 may facilitate resource management and operation of the
computer system 701. Examples of operating systems include, without limitation, Apple Macintosh OS X, Unix, Unix-like system distributions (e.g., Berkeley Software Distribution (BSD), FreeBSD, NetBSD, OpenBSD, etc.), Linux distributions (e.g., Red Hat, Ubuntu, Kubuntu, etc.), IBM OS/2, Microsoft Windows (XP, Vista/7/8, etc.), Apple iOS, Google Android, Blackberry OS, or the like. User interface 717 may facilitate display, execution, interaction, manipulation, or operation of program components through textual or graphical facilities. For example, user interfaces may provide computer interaction interface elements on a display system operatively connected to thecomputer system 701, such as cursors, icons, check boxes, menus, scrollers, windows, widgets, etc. Graphical user interfaces (GUIs) may be employed, including, without limitation, Apple Macintosh operating systems' Aqua, IBM OS/2, Microsoft Windows (e.g., Aero, Metro, etc.), Unix X-Windows, web interface libraries (e.g., ActiveX, Java, Javascript, AJAX, HTML, Adobe Flash, etc.), or the like. - In some embodiments, the
computer system 701 may implement a web browser 718 stored program component. The web browser may be a hypertext viewing application, such as Microsoft Internet Explorer, Google Chrome, Mozilla Firefox, Apple Safari, etc. Secure web browsing may be provided using HTTPS (secure hypertext transport protocol), secure sockets layer (SSL), Transport Layer Security (TLS), etc. Web browsers may utilize facilities such as AJAX, DHTML, Adobe Flash, JavaScript, Java, application programming interfaces (APIs), etc. In some embodiments, thecomputer system 701 may implement a mail server 719 stored program component. The mail server may be an Internet mail server such as Microsoft Exchange, or the like. The mail server may utilize facilities such as ASP, ActiveX, ANSI C++/C#, Microsoft .NET, CGI scripts, Java, JavaScript, PERL, PHP, Python, WebObjects, etc. The mail server may utilize communication protocols such as internet message access protocol (IMAP), messaging application programming interface (MAPI), Microsoft Exchange, post office protocol (POP), simple mail transfer protocol (SMTP), or the like. In some embodiments, thecomputer system 701 may implement a mail client 720 stored program component. The mail client may be a mail viewing application, such as Apple Mail, Microsoft Entourage, Microsoft Outlook, Mozilla Thunderbird, etc. - In some embodiments,
computer system 701 may store user/application data 721, such as the data, variables, records, etc. (e.g., incident tickets, keywords, unique number representations of keywords, vectors, feature matrices, mechanization statuses, use cases, descriptions, scripts, configuration item, KD-tree, and so forth) as described in this disclosure. Such databases may be implemented as fault-tolerant, relational, scalable, secure databases such as Oracle or Sybase. Alternatively, such databases may be implemented using standardized data structures, such as an array, hash, linked list, struct, structured text file (e.g., XML), table, or as object-oriented databases (e.g., using ObjectStore, Poet, Zope, etc.). Such databases may be consolidated or distributed, sometimes among the various computer systems discussed above in this disclosure. It is to be understood that the structure and operation of the any computer or database component may be combined, consolidated, or distributed in any working combination. - As will be appreciated by those skilled in the art, the techniques described in the various embodiments discussed above result in automated, efficient, and speedy resolution of tickets based on intelligent classification. The identification of automation candidates through the classification reduces the human error and the time delay of providing accurate resolution. In other words, the techniques described in the various embodiments discussed above increase the productivity of the automation solutions while at the same time reduce the manual effort.
- The specification has described system and method for classifying and resolving software production incident tickets. The illustrated steps are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
- Furthermore, one or more computer-readable storage media may be utilized in implementing embodiments consistent with the present disclosure. A computer-readable storage medium refers to any type of physical memory on which information or data readable by a processor may be stored. Thus, a computer-readable storage medium may store instructions for execution by one or more processors, including instructions for causing the processor(s) to perform steps or stages consistent with the embodiments described herein. The term “computer-readable medium” should be understood to include tangible items and exclude carrier waves and transient signals, i.e., be non-transitory. Examples include random access memory (RAM), read-only memory (ROM), volatile memory, nonvolatile memory, hard drives, CD ROMs, DVDs, flash drives, disks, and any other known physical storage media.
- It is intended that the disclosure and examples be considered as exemplary only, with a true scope and spirit of disclosed embodiments being indicated by the following claims.
- Having thus described the basic concept of the invention, it will be rather apparent to those skilled in the art that the foregoing detailed disclosure is intended to be presented by way of example only, and is not limiting. Various alterations, improvements, and modifications will occur and are intended to those skilled in the art, though not expressly stated herein. These alterations, improvements, and modifications are intended to be suggested hereby, and are within the spirit and scope of the invention. Additionally, the recited order of processing elements or sequences, or the use of numbers, letters, or other designations therefore, is not intended to limit the claimed processes to any order except as may be specified in the claims. Accordingly, the invention is limited only by the following claims and equivalents thereto.
Claims (20)
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
IN201641001810 | 2016-01-18 | ||
IN201641001810 | 2016-01-18 | ||
IN201641002564 | 2016-01-22 |
Publications (3)
Publication Number | Publication Date |
---|---|
US20170212756A1 US20170212756A1 (en) | 2017-07-27 |
US20180032330A9 true US20180032330A9 (en) | 2018-02-01 |
US10067760B2 US10067760B2 (en) | 2018-09-04 |
Family
ID=55486533
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/069,633 Active 2036-11-19 US10067760B2 (en) | 2016-01-18 | 2016-03-14 | System and method for classifying and resolving software production incidents |
Country Status (3)
Country | Link |
---|---|
US (1) | US10067760B2 (en) |
EP (1) | EP3193265A1 (en) |
CN (1) | CN106980634A (en) |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10547507B2 (en) | 2015-12-22 | 2020-01-28 | International Business Machines Corporation | Automated change monitoring and improvement recommendation system for incident reduction in information technology infrastructure |
US20200183678A1 (en) * | 2016-12-08 | 2020-06-11 | Xiang Tan | Software classification |
US11086857B1 (en) | 2018-05-15 | 2021-08-10 | Intuit Inc. | Method and system for semantic search with a data management system |
US11170026B1 (en) * | 2019-05-28 | 2021-11-09 | Intuit Inc. | System and method for identifying questions of users of a data management system |
US11271829B1 (en) * | 2020-11-19 | 2022-03-08 | Kyndryl, Inc. | SLA-aware task dispatching with a task resolution control |
US11423066B2 (en) | 2019-09-12 | 2022-08-23 | Intuit Inc. | System and method for reducing user query ambiguity through chatbot clarifying questions |
Families Citing this family (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10855561B2 (en) * | 2016-04-14 | 2020-12-01 | Oracle International Corporation | Predictive service request system and methods |
US10685292B1 (en) * | 2016-05-31 | 2020-06-16 | EMC IP Holding Company LLC | Similarity-based retrieval of software investigation log sets for accelerated software deployment |
US10783453B2 (en) * | 2016-06-14 | 2020-09-22 | Jpmorgan Chase Bank, N.A. | Systems and methods for automated incident response |
AU2017203826B2 (en) * | 2016-06-23 | 2018-07-05 | Accenture Global Solutions Limited | Learning based routing of service requests |
US11176464B1 (en) | 2017-04-25 | 2021-11-16 | EMC IP Holding Company LLC | Machine learning-based recommendation system for root cause analysis of service issues |
JP7221590B2 (en) * | 2017-11-16 | 2023-02-14 | ヤフー株式会社 | Extraction device, extraction method, and extraction program |
FR3076031A1 (en) * | 2017-12-22 | 2019-06-28 | Thales | INCIDENT TICKET LEARNING CATEGORIZATION METHOD, CATEGORIZATION SYSTEM AND COMPUTER PROGRAM PRODUCT THEREOF |
US11631017B2 (en) * | 2018-01-09 | 2023-04-18 | Microsoft Technology Licensing, Llc | Federated intelligent assistance |
JP7132480B2 (en) * | 2018-02-05 | 2022-09-07 | 富士通株式会社 | Information extraction method, information extraction program, and information processing device |
US10489728B1 (en) * | 2018-05-25 | 2019-11-26 | International Business Machines Corporation | Generating and publishing a problem ticket |
US10769043B2 (en) * | 2018-06-25 | 2020-09-08 | Hcl Technologies Ltd. | System and method for assisting user to resolve a hardware issue and a software issue |
US10970632B2 (en) * | 2018-06-25 | 2021-04-06 | Hcl Technologies Ltd | Generating a score for a runbook or a script |
US11042581B2 (en) | 2018-07-03 | 2021-06-22 | International Business Machines Corporation | Unstructured data clustering of information technology service delivery actions |
US10938678B2 (en) * | 2018-08-21 | 2021-03-02 | Accenture Global Solutions Limited | Automation plan generation and ticket classification for automated ticket resolution |
US10853697B2 (en) * | 2018-08-28 | 2020-12-01 | Beijing Jingdong Shangke Information Technology Co., Ltd. | System and method for monitoring online retail platform using artificial intelligence and fixing malfunction |
US20200202302A1 (en) * | 2018-12-21 | 2020-06-25 | Microsoft Technology Licensing, Llc | Classifying and routing enterprise incident tickets |
US11368358B2 (en) * | 2018-12-22 | 2022-06-21 | Fujitsu Limited | Automated machine-learning-based ticket resolution for system recovery |
US11941082B2 (en) * | 2019-04-12 | 2024-03-26 | Ul Llc | Technologies for classifying feedback using machine learning models |
US11803887B2 (en) * | 2019-10-02 | 2023-10-31 | Microsoft Technology Licensing, Llc | Agent selection using real environment interaction |
US11741194B2 (en) * | 2020-03-23 | 2023-08-29 | Cognizant Technology Solutions India Pvt. Ltd. | System and method for creating healing and automation tickets |
US11694025B2 (en) | 2020-05-04 | 2023-07-04 | Kyndryl Inc. | Cognitive issue description and multi-level category recommendation |
US20220026862A1 (en) * | 2020-07-22 | 2022-01-27 | Accenture Global Solutions Limited | Determination of task automation using an artificial intelligence model |
CN111930943B (en) * | 2020-08-12 | 2022-09-02 | 中国科学技术大学 | Method and device for detecting pivot bullet screen |
US20220207388A1 (en) * | 2020-12-28 | 2022-06-30 | Dell Products L.P. | Automatically generating conditional instructions for resolving predicted system issues using machine learning techniques |
US11762894B2 (en) | 2021-11-29 | 2023-09-19 | International Business Machines Corporation | Event management in computer system |
Citations (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20010006892A1 (en) * | 1997-07-29 | 2001-07-05 | Barnett Richard E. | Apparatus and method for automatically programming frequency scanning radio receivers |
US20020157096A1 (en) * | 2001-04-23 | 2002-10-24 | Nec Corporation | Method of and system for recommending programs |
US6647139B1 (en) * | 1999-02-18 | 2003-11-11 | Matsushita Electric Industrial Co., Ltd. | Method of object recognition, apparatus of the same and recording medium therefor |
US20040006736A1 (en) * | 2002-07-04 | 2004-01-08 | Takahiko Kawatani | Evaluating distinctiveness of document |
US20070244874A1 (en) * | 2006-03-27 | 2007-10-18 | Yahoo! Inc. | System and method for good nearest neighbor clustering of text |
US20090240498A1 (en) * | 2008-03-19 | 2009-09-24 | Microsoft Corporation | Similiarity measures for short segments of text |
US20100223671A1 (en) * | 2009-03-02 | 2010-09-02 | Fujitsu Limited | Document checking apparatus, computer-readable recording medium, and document checking method |
US20110044431A1 (en) * | 2009-08-21 | 2011-02-24 | Avaya Inc. | Communications History Log System |
US20110154123A1 (en) * | 2009-07-07 | 2011-06-23 | Data Robotics, Inc. | System and Method for Protecting Users of Data Storage Systems Against Know Problems |
US20120209847A1 (en) * | 2011-02-16 | 2012-08-16 | Clearwell Systems, Inc. | Methods and systems for automatically generating semantic/concept searches |
US20130262082A1 (en) * | 2012-03-28 | 2013-10-03 | Xerox Corporation | Natural language incident resolution |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH096799A (en) * | 1995-06-19 | 1997-01-10 | Sharp Corp | Document sorting device and document retrieving device |
CN103020164B (en) * | 2012-11-26 | 2015-06-10 | 华北电力大学 | Semantic search method based on multi-semantic analysis and personalized sequencing |
-
2016
- 2016-03-02 EP EP16158341.4A patent/EP3193265A1/en not_active Withdrawn
- 2016-03-14 US US15/069,633 patent/US10067760B2/en active Active
- 2016-03-16 CN CN201610149047.3A patent/CN106980634A/en not_active Withdrawn
Patent Citations (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20010006892A1 (en) * | 1997-07-29 | 2001-07-05 | Barnett Richard E. | Apparatus and method for automatically programming frequency scanning radio receivers |
US6647139B1 (en) * | 1999-02-18 | 2003-11-11 | Matsushita Electric Industrial Co., Ltd. | Method of object recognition, apparatus of the same and recording medium therefor |
US20020157096A1 (en) * | 2001-04-23 | 2002-10-24 | Nec Corporation | Method of and system for recommending programs |
US20040006736A1 (en) * | 2002-07-04 | 2004-01-08 | Takahiko Kawatani | Evaluating distinctiveness of document |
US20070244874A1 (en) * | 2006-03-27 | 2007-10-18 | Yahoo! Inc. | System and method for good nearest neighbor clustering of text |
US20090240498A1 (en) * | 2008-03-19 | 2009-09-24 | Microsoft Corporation | Similiarity measures for short segments of text |
US20100223671A1 (en) * | 2009-03-02 | 2010-09-02 | Fujitsu Limited | Document checking apparatus, computer-readable recording medium, and document checking method |
US20110154123A1 (en) * | 2009-07-07 | 2011-06-23 | Data Robotics, Inc. | System and Method for Protecting Users of Data Storage Systems Against Know Problems |
US20110044431A1 (en) * | 2009-08-21 | 2011-02-24 | Avaya Inc. | Communications History Log System |
US20120209847A1 (en) * | 2011-02-16 | 2012-08-16 | Clearwell Systems, Inc. | Methods and systems for automatically generating semantic/concept searches |
US20130262082A1 (en) * | 2012-03-28 | 2013-10-03 | Xerox Corporation | Natural language incident resolution |
Cited By (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10547507B2 (en) | 2015-12-22 | 2020-01-28 | International Business Machines Corporation | Automated change monitoring and improvement recommendation system for incident reduction in information technology infrastructure |
US20200183678A1 (en) * | 2016-12-08 | 2020-06-11 | Xiang Tan | Software classification |
US11086857B1 (en) | 2018-05-15 | 2021-08-10 | Intuit Inc. | Method and system for semantic search with a data management system |
US11170026B1 (en) * | 2019-05-28 | 2021-11-09 | Intuit Inc. | System and method for identifying questions of users of a data management system |
US11829388B2 (en) | 2019-05-28 | 2023-11-28 | Intuit Inc. | System and method for identifying questions of users of a data management system |
US11423066B2 (en) | 2019-09-12 | 2022-08-23 | Intuit Inc. | System and method for reducing user query ambiguity through chatbot clarifying questions |
US11271829B1 (en) * | 2020-11-19 | 2022-03-08 | Kyndryl, Inc. | SLA-aware task dispatching with a task resolution control |
Also Published As
Publication number | Publication date |
---|---|
US20170212756A1 (en) | 2017-07-27 |
EP3193265A1 (en) | 2017-07-19 |
US10067760B2 (en) | 2018-09-04 |
CN106980634A (en) | 2017-07-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10067760B2 (en) | System and method for classifying and resolving software production incidents | |
US9779013B2 (en) | Method and system for optimizing a test suite comprising plurality of test cases | |
US10621507B2 (en) | System and method for generating an optimized result set using vector based relative importance measure | |
EP3333703A1 (en) | Method and system for automatically updating automation sequences | |
US20150256475A1 (en) | Systems and methods for designing an optimized infrastructure for executing computing processes | |
US10459951B2 (en) | Method and system for determining automation sequences for resolution of an incident ticket | |
US20180204135A1 (en) | Systems and methods for improving accuracy of classification-based text data processing | |
US10545854B2 (en) | Method and a system for automatically identifying violations in one or more test cases | |
US20180253736A1 (en) | System and method for determining resolution for an incident ticket | |
US10366167B2 (en) | Method for interpretation of charts using statistical techniques and machine learning and creating automated summaries in natural language | |
US20180150555A1 (en) | Method and system for providing resolution to tickets in an incident management system | |
US20180253669A1 (en) | Method and system for creating dynamic canonical data model to unify data from heterogeneous sources | |
US9990183B2 (en) | System and method for validating software development requirements | |
US10636039B2 (en) | Method of generating ontology based on plurality of tickets and an enterprise system thereof | |
US10482074B2 (en) | System and method for classifying data with respect to a small dataset | |
EP3352084B1 (en) | System and method for generation of integrated test scenarios | |
US20230050889A1 (en) | Method and system to generate knowledge graph and sub-graph clusters to perform root cause analysis | |
EP3857403A1 (en) | Method and device for creating and training machine learning models | |
US10102093B2 (en) | Methods and systems for determining an equipment operation based on historical operation data | |
US20200242123A1 (en) | Method and system for improving relevancy and ranking of search result from index-based search | |
US20170277583A1 (en) | System and method for classifying defects occurring in a software environment | |
US20190004890A1 (en) | Method and system for handling one or more issues in a computing environment | |
US20170213168A1 (en) | Methods and systems for optimizing risks in supply chain networks | |
US20220121929A1 (en) | Optimization of artificial neural network (ann) classification model and training data for appropriate model behavior | |
US20180225390A1 (en) | System and method for performing descriptive analysis in data mining |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: WIPRO LIMITED, INDIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:RYALI, PREMCHAND;GURUSWAMAPPA, SHIVAMURTHY HARAVE;BALASUBRAMANIAN, RAMKUMAR;REEL/FRAME:038062/0168 Effective date: 20151228 |
|
FEPP | Fee payment procedure |
Free format text: PETITION RELATED TO MAINTENANCE FEES GRANTED (ORIGINAL EVENT CODE: PTGR); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |