System and method for identifying and resolving events in system using artificial intelligence model

Abstract

A method of identifying and processing related events using a machine learning-based model, comprising performing, by one or more processors, operations comprising the steps of: clustering a subset of event records from a plurality of event records using the machine learning-based model based on a rolling time window and a number of records in the subset of event records; creating question records based on the clustering event records; using information related to the clustering event record to fill the problem record; associating the clustering event record with the problem record; providing a notification that the question record has been created; receiving a solution of the problem record; based on the solution, a machine learning-based model is updated to learn associations between extracted features of the solution and extracted features of the clustered event records.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of priority to U.S. Application No. 17 / 816,745 filed on August 2, 2022, which claims the benefit of priority to Indian Application No. 202211020902 filed on April 7, 2022, which are incorporated herein by reference in their entirety and become a part of the present invention. Technical Field

[0003] Various embodiments of the present disclosure generally relate to utilizing artificial intelligence models to identify and resolve events in a system, and more specifically, to utilizing artificial intelligence models to identify and resolve clusters of similar recurring events in a system. Background Art

[0004] Making changes to any type of system creates some degree of risk that the system will no longer perform as expected. Furthermore, even if system performance is not immediately affected, system changes may cause subsequent problems, and it may be time consuming to determine the cause of the change in system performance.

[0005] For example, in software, deploying, refactoring, or releasing software code has different kinds of associated risks, depending on what code is being changed. Not having a clear understanding of how fragile or risky a particular code deployment is increases the risk of system outages. For companies, deploying code always involves risk, and platform modernization is a continuous process. Technology transitions are important for any product, and for software companies, they present both risks and opportunities.

[0006] System outages and / or incidents cost the company money in service level agreement claims, but more importantly, rework wastes staff time and can negatively impact the company’s reputation with customers. Errors entering production result in the highest costs, both in terms of ripple effects and direct losses to all downstream teams. Additionally, incident teams may waste time determining the cause of changes in system performance after changes have already been deployed.

[0007] Across the IT landscape, IT business change requests can have varying degrees of risk and impact. In large IT organizations, change-induced incidents can account for 70-80% of critical incidents, placing a heavy burden on IT teams. Modern IT architectures have become increasingly complex. Across the IT landscape, resolving recurring incidents in large systems often involves dispersed personnel and systems as well as individual problem tickets and time-sharing solutions, leading to significant inefficiencies in large IT organizations.

[0008] The present disclosure is directed to overcoming one or more of the challenges set forth above. Summary of the invention

[0009] In certain aspects, the technology described in the present invention relates to a method for identifying and processing events using a machine learning-based model, the method comprising one or more processors performing operations including the following steps: clustering event record subgroups from multiple event records using a machine learning-based model based on a rolling time window and the number of records in the event record subgroup; creating a problem record based on the clustered event records; populating the problem record with information related to the clustered event records; associating the clustered event records with the problem record; providing a notification that a problem record has been created; receiving a solution to the problem record; and updating the machine learning-based model based on the solution to learn the association between the extracted features of the solution and the extracted features of the clustered event records.

[0010] In certain aspects, the technology described in the present invention relates to a method wherein the rolling time window is three months, the number of records is one thousand records, and event records are clustered when a machine learning-based model identifies at least one thousand records in a subgroup of event records in the three-month rolling time window.

[0011] In certain aspects, the technology described herein is directed to a method in which event records are clustered based on one or more of an event description, an event location, or an event record priority.

[0012] In certain aspects, the present technology relates to a method wherein the clustering is performed using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).

[0013] In certain aspects, the technology described in the present invention relates to a method, wherein the information related to the cluster event record includes one or more of an assigned problem management group, an assigned problem manager, a description of the most frequent value in the cluster event record, a short description of the problem, or a long description of the problem.

[0014] In certain aspects, the present technology relates to a method wherein associating clustered event records with a problem record includes updating a field in each clustered event record with an identification of the problem record.

[0015] In certain aspects, the present technology is directed to a method wherein associating the clustered event records with the problem records includes creating a parent / child relationship between the problem records and the clustered event records.

[0016] In certain aspects, the technology described herein relates to a method wherein updating the machine learning-based model includes training the machine learning-based model to learn to cluster associations between new event records and problem records.

[0017] In certain aspects, the technology described in the present invention relates to a method, wherein the operation further includes: when a machine learning-based model indicates that clustered new event records are related to problem records and the clustered new event records are based on unacceptable events, creating a persistent problem record based on the clustered new event records, associating the clustered new event records with the persistent problem records, and associating the persistent problem records with the problem records to indicate that the problems related to the problem records persist.

[0018] In certain aspects, the technology described in the present invention relates to a method, wherein the operation further includes: when a machine learning-based model indicates that the clustered new event records are related to the problem records and the clustered new event records are based on acceptable events, ignoring the creation of new problem records based on the clustered new event records.

[0019] In certain aspects, the technology described in the present invention relates to a computer-implemented system for identifying and processing related events using a machine learning-based model, the computer-implemented system comprising: a memory that can store instructions; and one or more processors that can execute the stored instructions to perform operations including the following steps: clustering event record subgroups from multiple event records using a machine learning-based model based on a rolling time window and the number of records in the event record subgroup; creating a problem record based on the clustered event records; populating the problem record with information related to the clustered event records; associating the clustered event records with the problem record; providing a notification that a problem record has been created; receiving a solution to the problem record; and updating the machine learning-based model based on the solution to learn the association between the extracted features of the solution and the extracted features of the clustered event records.

[0020] In certain aspects, the technology described in the present invention relates to a computer-implemented system, wherein the rolling time window is three months, the number of records is one thousand records, and when a machine learning-based model identifies at least one thousand records in a subgroup of event records in the three-month rolling time window, the event records are clustered.

[0021] In certain aspects, the technology described herein relates to a computer-implemented system in which event records are clustered based on one or more of an event description, an event location, or an event record priority.

[0022] In certain aspects, the present technology relates to a computer-implemented system in which the clustering is performed using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).

[0023] In certain aspects, the technology described in the present invention relates to a computer-implemented system, wherein the information related to the cluster event record includes one or more of an assigned problem management group, an assigned problem manager, a description of the most frequent value in the cluster event record, a short description of the problem, or a long description of the problem.

[0024] In certain aspects, the present technology relates to a computer-implemented system wherein associating the cluster event records with the problem record includes updating a field in each cluster event record with an identification of the problem record.

[0025] In certain aspects, the present technology relates to a computer-implemented system wherein associating the clustered event records with the problem records includes creating a parent / child relationship between the problem records and the clustered event records.

[0026] In certain aspects, the technology described herein relates to a computer-implemented system, wherein updating the machine learning-based model includes training the machine learning-based model to learn to cluster associations between new event records and problem records.

[0027] In certain aspects, the technology described in the present invention relates to a computer-implemented system, wherein the operation further includes: when a machine learning-based model indicates that clustered new event records are related to problem records and the clustered new event records are based on unacceptable events, creating a persistent problem record based on the clustered new event records, associating the clustered new event records with the persistent problem records, and associating the persistent problem records with the problem records to indicate that the problems related to the problem records persist; when a machine learning-based model indicates that the clustered new event records are related to the problem records and the clustered new event records are based on acceptable events, ignoring the creation of a new problem record based on the clustered new event records.

[0028] In certain aspects, the technology described in the present invention relates to a non-temporary computer-readable medium storing instructions, which, when executed by one or more processors, may cause the one or more processors to perform operations including the following steps: clustering event record subgroups from multiple event records using a machine learning-based model based on a rolling time window and the number of records in the event record subgroup; creating a problem record based on the clustered event records; populating the problem record using information related to the clustered event records; associating the clustered event records with the problem record; providing a notification that a problem record has been created; receiving a solution to the problem record; and updating the machine learning-based model based on the solution to learn the association between the extracted features of the solution and the extracted features of the clustered event records.

[0029] As will be apparent from the following examples, the advantages of the disclosed system and method are that, compared to the current isolated improvement measures of each department, the disclosed system and method provide an end-to-end incident handling method, which will help to enhance communication and focus on solving common problems. The disclosed system and method provide a solution for all departments of the company to provide data to all departments so that they can gain insights universally. Therefore, the team can take joint actions to solve related incidents in all departments.

[0030] For example, the disclosed systems and methods can enhance data quality and / or best practices, standardize the resolution of recurring events, and / or resolve the underlying, systemic issues that cause these recurring events. The disclosed systems and methods can aggregate and cluster large numbers of events that humans (or teams of humans) cannot realistically resolve within a reasonable time frame. The disclosed systems and methods can automatically create cluster orders by calling an API from a cloud environment.

[0031] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosed embodiments, as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various exemplary embodiments and, together with the following description, explain the principles of the disclosed embodiments.

[0033] Figure 1 An exemplary system overview for predicting and resolving events in a system using artificial intelligence according to one or more embodiments is shown.

[0034] Figure 2 A flowchart of a method 200 for clustering events in a system and creating a problem record using artificial intelligence according to one or more embodiments is shown.

[0035] Figure 3 A flow chart of a method 300 for using artificial intelligence to resolve and track problem records for events in a system is shown according to one or more embodiments.

[0036] Figure 4 A flow chart of a method 400 for identifying and processing events using a machine learning-based model according to one or more embodiments is shown.

[0037] Figure 5 A flowchart of a method 500 for identifying and processing events using a machine learning-based model is shown according to one or more embodiments.

[0038] Figure 6 An embodiment of a general purpose computer system is shown that can perform the techniques described herein. DETAILED DESCRIPTION

[0039] Various embodiments of the present disclosure generally relate to utilizing artificial intelligence models to identify and resolve events in a system, and more specifically, to utilizing artificial intelligence models to identify and resolve clusters of similar recurring events in a system.

[0040] The subject matter of the present disclosure will be described more fully below with reference to the accompanying drawings, which illustrate specific exemplary embodiments by way of illustration. An "exemplary" embodiment or implementation of the present invention is not to be construed as being preferred or advantageous over other embodiments or implementations; rather, it is intended to reflect or indicate that the embodiment is an "exemplary" embodiment. The subject matter may be embodied in a variety of different forms, and therefore, the subject matter covered or claimed is intended to be interpreted as not being limited to any exemplary embodiment described in the present invention; exemplary embodiments are provided for illustrative purposes only. Similarly, the subject matter claimed or covered should also have a reasonably broad scope. For example, among other aspects, the subject matter may be embodied as a method, device, component, or system. Accordingly, the embodiments may take the form of hardware, software, firmware, or any combination thereof (except the software itself). Therefore, the following detailed description is not intended to be limiting.

[0041] Throughout the specification and claims, in addition to the explicit meaning, terms may also imply or suggest some subtle meanings in the context. Similarly, the phrase "in one embodiment" used in the present invention does not necessarily refer to the same embodiment, and the phrase "in another embodiment" used in the present invention does not necessarily refer to a different embodiment. It is intended that the claimed subject matter includes a combination of all or part of the exemplary embodiments.

[0042] Although the terms used below are used in conjunction with certain specific examples of the present disclosure, these terms are to be interpreted in the broadest sense. In fact, certain terms may even be emphasized below; however, this detailed description section will publicly and specifically define any term that is intended to be interpreted in any limited manner.

[0043] Software companies are constantly trying to avoid disruptions caused by incidents due to reasons such as upgrading software or hardware components or replacing team members.

[0044] One or more embodiments may reduce the burden on companies to identify and resolve incidents. In the context of the present disclosure, an event can be any change in a system, such as an outage or performance change. Events can be reported manually by customers or personnel, automatically recorded by internal systems, or captured in other ways. One or more embodiments may provide solutions for information technology management, governance, and operations to identify and resolve incidents and have an impact in a continuous and dynamic manner. Using applications connected to the system, one or more embodiments can be extended to clients and users of services and software. One or more embodiments may cover many different aspects of the IT operations lifecycle (such as identifying high-risk groups or infrastructure components) and can change the way decisions and reviews are made about incidents. Feedback provided by the incident resolution team can be integrated back into the artificial intelligence model to improve incident resolution over time.

[0045] Figure 1 An exemplary system overview for predicting and resolving events in a system using artificial intelligence according to one or more embodiments is shown.

[0046] like Figure 1 As shown, the problem assessment system 100 may include a relational database 105, which includes a problem table 110 and an event table 115. The problem table 110 and the event table 115 may be provided as one or more tables and may include one or more problems, tasks, risk conditions, events, or changes. The problem table 110 may be managed by a problem management team 120. The relational database 105 may be connected to a gateway 125 in a cloud 121 through encryption, and may send and receive regular updates to and from the cloud 121. The cloud 121 may be a remote cloud service, a local service, or any combination thereof. The cloud 121 may include a gateway 125 connected to a processing API 130, which may be used in conjunction with an event trigger 135 to update an artificial intelligence model 140. The artificial intelligence model 140 may use a container management platform 145 and an event trigger 150 to send data to and receive data from a relational database service 155. The relational database service 155 may be connected to the relational database 105 through the gateway 160 , and may send and receive periodic updates to and from the relational database 105 through the gateway 160 .

[0047] The artificial intelligence model 140 may include a machine learning component. One machine learning technique that may be useful and effective for analysis is a neural network, i.e., a supervised machine learning. However, it should be noted that other machine learning techniques and frameworks may be used to perform the methods contemplated by the present disclosure. For example, the systems and methods may be implemented using other types of supervised machine learning (e.g., regression problems, random forests, etc.), using unsupervised machine learning (e.g., clustering algorithms, principal component analysis (PCA), etc.), and / or using reinforcement learning.

[0048] The problem assessment system 100 can provide an event recognition model that predicts what will happen at each change. This is accomplished using event histories, allowing the system to reverse engineer and identify patterns in incoming events by training an event classification model that will flag changes in events, and clustering events using threshold analysis. Thresholds can be dynamic and targeted to specific allocation groups. This model can proactively cluster events in real time as incident, problem ticket, and script data is collected.

[0049] The problem assessment system 100 can provide a model that can proactively propose code changes / solutions for incoming events by building a classification / probabilistic prediction (e.g., multi-layer perceptron, logistic regression, or artificial neural network) model to identify whether the new event is related to a code change. If the new event is related to a code change, the event history can be used to determine which part of the code needs to be changed to solve the problem. In the code, the event history can identify which branch, file, class, or module should be changed.

[0050] Metadata from various sources can be used here for topic modeling (such as latent Dirichlet distribution or neural topic modeling) and clustering (such as bidirectional encoder representations from Transformers or hierarchical density-based spatial clustering of noisy applications) to create clusters. For example, unsupervised learning can be performed on event descriptions, solution descriptions, issue tracking tickets, and code repository submission instructions. Using topic modeling, the created clusters are automatically labeled. The finalized clusters can be used as classes for training supervised classifier models. Since the amount of data may be very large, various deep learning models such as artificial neural networks, recurrent neural networks, and long short-term memory can be used. Using the final classification labels from the supervised model, the event process can be mapped. These are just examples based on machine learning models, and the present disclosure is not limited to these examples.

[0051] For example, metadata may be provided from a relational database 105 (including incident reports), with information for each incident being accompanied by incident number, closure date / time, category, closure code, closure description, long description, short description, root cause, and assigned group. For example, metadata may be provided from a relational database 105 (including incident reports), with information for each incident being accompanied by issue keywords, description, summary, tags, issue type, fix version, environment, author, and comments. For example, metadata may be provided from a relational database 105 (including incident reports), with information for each incident being accompanied by file name, script name, script type, script description, display identifier, message, submitter type, submitter link, properties, file changes, and branch information. These are merely examples of information that may be used as metadata, and the present disclosure is not limited to these examples.

[0052] Figure 2 A flowchart of a method 200 for clustering events in a system and creating a problem record using artificial intelligence according to one or more embodiments is shown.

[0053] like Figure 2 As shown, operation 205 may include clusters of related events identified by the machine learning model, with a record count threshold of at least 1000 events in a three-month rolling window. The threshold may take a greater or lesser number of records, and the rolling window may be shortened or extended as needed. In operation 210, for the identified cluster of related events, the problem assessment system 100 may create a new problem record in the digital workflow management system. In operation 215, the problem assessment system 100 may populate the new problem record. For example, the new problem record may include a problem management group field, a problem manager, an assignment group or category, a problem short description, and a problem long description. Alternatively or in addition, in operation 220, using the identification of the new problem record, the problem assessment system 100 may update the problem record identification field in all related events identified in the cluster, so that the new problem record includes links to all related events identified in the cluster, and vice versa. Alternatively or in addition, in operation 225, the problem assessment system 100 may create a link relationship between the new problem record and all related events identified in the cluster, so that the new problem record includes links to all related events identified in the cluster, and vice versa. A link relationship may be created in the table, with a parent / child relationship between the new problem record and all related events identified in the cluster. However, the present disclosure is not limited thereto, and other linking methods may be used.

[0054] Figure 3 A flow chart of a method 300 for using artificial intelligence to resolve and track problem records for events in a system is shown according to one or more embodiments.

[0055] In method 200, the problem evaluation system 100 may provide a notification that a new problem record has been created. Figure 3 As shown, in operation 305 , the problem manager may preliminarily determine whether the new problem record is a true event cluster or a false positive.

[0056] If the new problem record is a real event cluster, then in operation 310, the event team may work to resolve the problem identified in the new problem record and provide the solution to the problem assessment system 100. If the new problem record is not a real event cluster, then in operation 350, the problem manager may provide an indication to the problem assessment system 100 to cancel the new problem record. If the new problem record is not a real event cluster, then in operation 355, the problem assessment system 100 may anticipate that no new events will occur for the related event cluster, and the problem assessment system 100 will not create new additional problem records related to the events.

[0057] If the new problem record is a true incident cluster, then in operation 315, the problem manager may provide an indication to the problem assessment system 100 to close the new problem record, and the problem manager may select a closing process. If the closing process is "permanently resolved", for example, in operation 320, the problem assessment system 100 may expect that no new incidents will occur for the related incident cluster. However, if a new incident is identified based on a threshold, the problem assessment system 100 may create another problem record and link it to the previously created problem record, indicating that the problem identified in the previously created problem record still exists and has not been permanently resolved. In operation 325, if the closing process is a known error, the problem assessment system 100 may expect that new incidents will occur for the related incident cluster, but the problem assessment system 100 will not create new additional problem records related to the incidents.

[0058] Figure 4 A flow chart of a method 400 for identifying and processing events using a machine learning-based model according to one or more embodiments is shown.

[0059] like Figure 4As shown, the method 400 for identifying and processing related events using a machine learning-based model may include various operations performed by one or more processors 602. Operation 405 may include clustering event record subgroups from multiple event records using a machine learning-based model based on a rolling time window and the number of records in the event record subgroup. Operation 410 may include creating a problem record based on the clustered event records. Operation 415 may include populating the problem record using information related to the clustered event records. Operation 420 may include associating the clustered event records with the problem record. Operation 425 may include providing a notification that a problem record has been created. Operation 430 may include receiving a solution to the problem record. Operation 435 may include updating the machine learning-based model based on the solution to learn the association between the extracted features of the solution and the extracted features of the clustered event records.

[0060] Figure 5 A flowchart of a method 500 for identifying and processing events using a machine learning-based model is shown according to one or more embodiments.

[0061] Operation 505 may include, wherein the rolling time window is three months, the number of records is one thousand records, and when the machine learning-based model identifies at least one thousand records in the event record subgroup within the three-month rolling time window, the event records are clustered. Operation 510 may include, wherein the event records are clustered based on one or more of an event description, an event location, or an event record priority. Operation 515 may include, wherein the clustering is performed using hierarchical density-based spatial clustering of noise applications (HDBSCAN). Operation 520 may include, wherein the information associated with the clustered event records includes one or more of an assigned problem management group, an assigned problem manager, a description of the most frequent value in the clustered event records, a short problem description, or a long problem description. Operation 525 may include, wherein associating the clustered event records with the problem records includes updating a field in each clustered event record with an identifier of the problem record. Operation 530 may include, wherein associating the clustered event records with the problem records includes creating a parent / child relationship between the problem record and the clustered event records.

[0062] Operation 535 may include, wherein updating the machine learning-based model includes training the machine learning-based model to learn the association between clustered new event records and problem records. Operation 540 may include, when the machine learning-based model indicates that the clustered new event records are related to the problem records and the clustered new event records are based on unacceptable events, creating a persistent problem record based on the clustered new event records, associating the clustered new event records with the persistent problem records, and associating the persistent problem records with the problem records to indicate that the problem associated with the problem records persists. Operation 545 may include, when the machine learning-based model indicates that the clustered new event records are related to the problem records and the clustered new event records are based on acceptable events, ignoring the creation of a new problem record based on the clustered new event records.

[0063] Figure 6 An embodiment of a general purpose computer system is shown that can perform the techniques described herein.

[0064] Unless otherwise specifically stated, as will be apparent from the discussion below, throughout the specification, it should be understood that the terms "processing," "computing," "calculating," "determining," "analyzing," or similar terms refer to the operations and / or processes of a computer or computing system or similar electronic computing device that manipulate and / or convert data represented by physical quantities (such as electronic quantities) into other data also represented by physical quantities.

[0065] Likewise, the term "processor" may refer to any device or portion of a device that processes electronic data, e.g., processes electronic data from registers and / or memory, transforms electronic data into other electronic data, e.g., other electronic data that may be stored in registers and / or memory. A "computer," "computing machine," "computing platform," "computing device," or "server" may include one or more processors.

[0066] Figure 6 An embodiment of a computer system 600 is shown. The computer system 600 may include a set of instructions that, when executed, may cause the computer system 600 to perform any one or more of the methods or computer-based functions disclosed in the present invention. The computer system 600 may operate as a standalone device or may be connected to other computer systems or peripheral devices using a network or the like.

[0067] In a network deployment, the computer system 600 can operate as a server, or as a client user computer in a server-client user network environment, or as a peer computer system in a peer-to-peer (or distributed) network environment. The computer system 600 can also be implemented as a variety of devices, or integrated into a variety of devices, such as a personal computer (PC), a tablet computer, a set-top box (STB), a personal digital assistant (PDA), a mobile device, a palmtop, a laptop, a desktop computer, a communication device, a wireless phone, a landline phone, a control system, a camera, a scanner, a fax machine, a printer, a pager, a personal trusted device, a World Wide Web device, a network router, a switch or a bridge, or any other machine capable of executing a set of instructions (sequential instructions or other instructions). In a specific embodiment, the computer system 600 can be implemented using an electronic device that provides voice, video or data communication. In addition, although the computer system 600 is shown as a single system, the term "system" should also be considered to include a collection of any systems or subsystems that can execute one or more sets of instructions individually or together to perform one or more computer functions.

[0068] like Figure 6 As shown, computer system 600 may include a processor 602, such as a central processing unit (CPU), a graphics processing unit (GPU), or both. Processor 602 may be a component in various systems. For example, processor 602 may be part of a standard personal computer or workstation. Processor 602 may be one or more general-purpose processors, digital signal processors, application-specific integrated circuits, field programmable gate arrays, servers, networks, digital circuits, analog circuits, combinations thereof, or other data analysis and processing devices now known or later developed. Processor 602 may execute software programs, such as manually generated (i.e., programmed) code.

[0069] The computer system 600 may include a memory 604 that can communicate via a bus 608. The memory 604 may be a main memory, a static memory, or a dynamic memory. The memory 604 may include, but is not limited to, computer-readable storage media, such as various types of volatile and non-volatile storage media, including but not limited to random access memory, read-only memory, programmable read-only memory, electrically programmable read-only memory, electrically erasable read-only memory, flash memory, tape or disk, optical media, etc. In one embodiment, the memory 604 includes a cache or random access memory of the processor 602. In an alternative embodiment, the memory 604 is separated from the processor 602, such as a cache memory, system memory, or other memory of the processor. The memory 604 may be an external storage device or database for storing data. Examples include a hard drive, a compact disk ("CD"), a digital video disk ("DVD"), a memory card, a memory stick, a floppy disk, a universal serial bus ("USB") storage device, or any other device that can be used to store data. The memory 604 can be used to store instructions executable by the processor 602. The functions, behaviors, or tasks shown in the figure or described in the present invention can be performed by the processor 602 executing instructions stored in the memory 604. These functions, behaviors, or tasks are independent of the specific type of instruction set, storage medium, processor, or processing strategy, and can be performed by software, hardware, integrated circuits, firmware, microcode, etc., alone or in combination. Likewise, the processing strategy may include multi-processing, multi-tasking, parallel processing, etc.

[0070] As shown, the computer system 600 may further include a display 610, such as a liquid crystal display (LCD), an organic light emitting diode (OLED), a flat panel display, a solid state display, a cathode ray tube (CRT), a projector, a printer, or other display devices known now or developed later for outputting determined information. The display 610 may be used as an interface for a user to view the operation of the processor 602, or specifically as an interface with software stored in the memory 604 or the drive unit 606.

[0071] Additionally or alternatively, the computer system 600 may include an input device 612 that allows a user to interact with any component of the computer system 600. The input device 612 may be a numeric keypad, a keyboard, or a cursor control device such as a mouse, a joystick, a touch screen display, a remote control, or any other device that interacts with the computer system 600.

[0072] The computer system 600 may also include or alternatively include a drive unit 606 implemented as a disk or optical drive. The drive unit 606 may include a computer-readable medium 622, in which one or more sets of instructions 624, such as software, may be embedded. In addition, the instructions 624 may embody one or more methods or logic described in the present invention. During execution by the computer system 600, the instructions 624 may be completely or partially located in the memory 604 and / or the processor 602. As described above, the memory 604 and the processor 602 may also include computer-readable media.

[0073] In some systems, the computer-readable medium 622 includes instructions 624, or receives and executes instructions 624 in response to propagation signals, so that devices connected to the network 670 can communicate voice, video, audio, images, or any other data through the network 670. In addition, instructions 624 can be transmitted or received on the network 670 through the communication port or interface 620 and / or using the bus 608. The communication port or interface 620 can be part of the processor 602 or a separate component. The communication port or interface 620 can be created in software or can be a physical connection in hardware. The communication port or interface 620 can be connected to the network 670, external media, display 610, or any other component or combination thereof in the computer system 600. The connection to the network 670 can be a physical connection, such as a wired Ethernet connection, or a connection can be established wirelessly, as described below. Similarly, additional connections to other components of the computer system 600 can be physical connections or wireless connections can be established. The network 670 can alternatively be directly connected to the bus 608.

[0074] Although the computer-readable medium 622 is shown as a single medium, the term "computer-readable medium" may include a single medium or multiple media, such as a centralized or distributed database, and / or associated caches and servers storing one or more sets of instructions. The term "computer-readable medium" may also include any medium capable of storing, encoding, or carrying a set of instructions that can be executed by a processor or cause a computer system to perform any one or more methods or operations disclosed in the present invention. The computer-readable medium 622 may be a non-transitory computer-readable medium or a tangible computer-readable medium.

[0075] The computer readable medium 622 may include a solid-state memory, such as a memory card or other package containing one or more non-volatile read-only memories. The computer readable medium 622 may be a random access memory or other volatile rewritable memory. In addition or alternatively, the computer readable medium 622 may include a magneto-optical medium or an optical medium, such as a disk, a tape, or other storage device, for capturing a carrier signal, such as a signal conveyed by a transmission medium. A digital file attachment to an email or other independent information archive or archive collection may be considered a distribution medium, i.e., a tangible storage medium. Accordingly, the present disclosure may be considered to include any one or more of a computer readable medium or a distribution medium and other equivalent media and successor media that can be used to store data or instructions.

[0076] In alternative embodiments, dedicated hardware implementations, such as application specific integrated circuits, programmable logic arrays, and other hardware devices, may be constructed to implement one or more of the methods described herein. Applications of the apparatus and systems that may include various implementations may broadly include a variety of electronic and computer systems. One or more implementations described herein may utilize two or more specific interconnected hardware modules or devices to implement functionality, which employ associated control and data signals that may be communicated between or through modules, or as part of an application specific integrated circuit. Accordingly, the system includes software, firmware, and hardware implementations.

[0077] Computer system 600 may be connected to network 670. Network 670 may define one or more networks, including wired or wireless networks. A wireless network may be a cellular telephone network, an 802.11, 802.16, 802.20, or WiMAX network. In addition, such networks may also include public networks (such as the Internet), private networks (such as intranets), or combinations thereof, and may utilize various existing or later developed network protocols, including but not limited to TCP / IP-based network protocols. Network 670 may include a wide area network (WAN) (such as the Internet), a local area network (LAN), a campus network, a metropolitan area network, a direct connection (such as through a universal serial bus (USB) port), or any other network capable of data communication. Network 670 may couple one computing device to another computing device to enable data communication between devices. Network 670 may generally employ any form of machine-readable media for conveying information from one device to another. Network 670 may include a communication method for transmitting information between computing devices. Network 670 may be divided into multiple subnetworks. A subnetwork may allow access to all other components connected to it, or restrict access between components. Network 670 may be considered a public or private network connection and may include, for example, a virtual private network or encryption or other security mechanisms used over the public Internet.

[0078] According to various embodiments of the present disclosure, the methods described in the present disclosure may be implemented by a software program executable by a computer system. In addition, in an exemplary non-limiting embodiment, the embodiments may include distributed processing, component / object distributed processing, and parallel processing. Alternatively, a virtual computer system process may be constructed to implement one or more methods or functions described in the present invention.

[0079] Although this specification describes components and functions that can be implemented in specific embodiments with reference to specific standards and protocols, the disclosure is not limited to such standards and protocols. For example, Internet and other packet-switched network transmission standards (e.g., TCP / IP, UDP / IP, HTML, HTTP) are examples of the state of the art. Such standards are periodically replaced by equivalent standards that have substantially the same functionality, are faster, or are more efficient. Accordingly, alternative standards and protocols that have the same or similar functionality as the standards and protocols disclosed in the present invention may be considered equivalent standards and protocols thereof.

[0080] It should be understood that in one embodiment, the method steps are performed by an appropriate processor (or multiple processors) of a processing (i.e., computer) system by executing instructions (computer readable code) stored in a memory. It should also be understood that the present disclosure is not limited to any specific implementation or programming technology, and the present disclosure can be implemented using any appropriate technology to achieve the functions described in the present invention. The present disclosure is not limited to any specific programming language or operating system.

[0081] It should be understood that in the above description of the exemplary embodiments of the present disclosure, in order to simplify the disclosure and help understand one or more different aspects of the invention, various features of the present disclosure are sometimes grouped together in one embodiment, figure or description. However, this disclosure method should not be interpreted as reflecting an intention that the disclosure required to be protected requires more features than those explicitly set forth in each claim. On the contrary, as described in the following claims, the inventiveness of the present invention lies in not fully including all the features of the aforementioned single disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, and each claim exists independently as a separate embodiment of the present disclosure.

[0082] In addition, those skilled in the art will appreciate that although some embodiments described herein include some features but do not include other features included in other embodiments, the combination of features of different embodiments all fall within the scope of the present disclosure and form different embodiments. For example, in the following claims, any claimed embodiment may be used in any combination.

[0083] In addition, in the present invention, some embodiments are described as a method or a combination of elements of a method, which can be implemented by a computer system processor or other means for performing the function. Therefore, a processor that uses the necessary instructions to perform this method or method element constitutes a means for performing the method or method element. In addition, an element of the device embodiment of the present invention is an example of a means for performing a function, and the function is performed by the element to implement the present disclosure.

[0084] Many specific details are described in the description provided by the present invention. However, it should be understood that embodiments of the present disclosure can be implemented without these specific details. In other cases, well-known methods, structures and techniques have not yet been shown in detail in order not to affect the understanding of this description.

[0085] Likewise, it is important to note that the term "coupled" used in the claims should not be interpreted as limited to direct connections. "Coupled," "connected," and their derivatives may be used. It should be understood that these terms are not synonymous with each other. Therefore, the scope of the expression "device A is coupled to device B" should not be limited to devices or systems where the output of device A is directly connected to the input of device B. This means that there is a path between the output of A and the input of B, which may include other devices or means. "Coupled" may mean that two or more elements are in direct physical or electrical contact, or it may mean that two or more elements are not in direct contact with each other, but can still cooperate or interact with each other.

[0086] Therefore, although the present disclosure has described embodiments that are considered to be preferred embodiments of the present invention, those skilled in the art will recognize that other and further modifications may be made to the present disclosure without departing from the spirit of the present disclosure, and those skilled in the art intend to include all such changes and modifications within the scope of the present disclosure. For example, any formula given above is merely representative of a program that may be used. Functions may be added or deleted from the block diagram, and operations may be interchanged between functional blocks. Steps of the method may be added or deleted within the scope of the present disclosure.

[0087] The above disclosed subject matter may be considered as illustrative subject matter rather than restrictive subject matter, and the attached claims are intended to cover all such modifications, enhancements and other embodiments that fall within the true spirit and scope of the present disclosure. Therefore, to the maximum extent permitted by law, the scope of the present disclosure shall be determined according to the broadest interpretation of the following claims and their equivalents, and shall not be restricted or limited by the above-mentioned specific embodiments. Although various embodiments of the present disclosure have been described, it is obvious to those of ordinary skill in the art that there may be more embodiments within the scope of the present disclosure. Accordingly, the present disclosure is not subject to any restrictions except for the attached claims and their equivalents.

Claims

1. A method for identifying and processing events using a machine learning-based model, the method comprising performing operations by one or more processors including the following steps: clustering event record subgroups from a plurality of event records using a machine learning-based model based on a rolling time window and the number of records in the event record subgroups; Create problem records based on clustered event records; populating the problem record with information related to the clustered event record; Associating clustered event records with problem records; Provides notification that a problem record has been created; Receive solutions to problem records; Based on the solution, the machine learning based model is updated to learn the association between the extracted features of the solution and the extracted features of the clustered event records.

2. The method according to claim 1, wherein: The rolling time window is three months, the number of records is one thousand records, and the event records are clustered when the machine learning-based model identifies at least one thousand records in an event record subgroup in the three-month rolling time window.

3. The method according to claim 1, wherein: The event records are clustered based on one or more of the event description, the event location, or the event record priority.

4. The method according to claim 1, wherein: The clustering was performed using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).

5. The method according to claim 1, wherein: The information related to the cluster event record includes one or more of an assigned problem management group, an assigned problem manager, a description of the most frequent value in the cluster event record, a short description of the problem, or a long description of the problem.

6. The method according to claim 1, wherein: Associating the cluster event records with the problem records includes updating a field in each cluster event record with an identifier of the problem record.

7. The method according to claim 1, wherein: Associating the cluster event record with the problem record includes creating a parent / child relationship between the problem record and the cluster event record.

8. The method according to claim 1, wherein: The updating of the machine learning based model includes training the machine learning based model to learn to cluster associations between new event records and problem records.

9. The method according to claim 8, wherein: The operations further include: When the machine learning-based model indicates that the clustered new event records are related to the problem records and the clustered new event records are based on unacceptable events, a persistent problem record is created based on the clustered new event records, the clustered new event records are associated with the persistent problem records, and the persistent problem records are associated with the problem records to indicate that problems related to the problem records persist.

10. The method according to claim 8, wherein: The operations further include: When the machine learning-based model indicates that the clustered new event records are related to the problem records and the clustered new event records are based on acceptable events, creating new problem records based on the clustered new event records is ignored.

11. A computer-implemented system for identifying and processing relevant events using a machine learning-based model, the computer-implemented system comprising: Memory, which can store instructions; One or more processors can execute stored instructions to perform operations including the following steps: clustering event record subgroups from a plurality of event records using a machine learning-based model based on a rolling time window and the number of records in the event record subgroups; Create problem records based on clustered event records; populating the problem record with information related to the clustered event record; Associating clustered event records with problem records; Provides notification that a problem record has been created; Receive solutions to problem records; Based on the solution, the machine learning based model is updated to learn the association between the extracted features of the solution and the extracted features of the clustered event records.

12. The computer-implemented system of claim 11, wherein: The rolling time window is three months, the number of records is one thousand records, and the event records are clustered when the machine learning-based model identifies at least one thousand records in an event record subgroup in the three-month rolling time window.

13. The computer-implemented system of claim 11, wherein: The event records are clustered based on one or more of the event description, the event location, or the event record priority.

14. The computer-implemented system of claim 11, wherein: The clustering was performed using Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN).

15. The computer-implemented system of claim 11, wherein: The information related to the cluster event record includes one or more of an assigned problem management group, an assigned problem manager, a description of the most frequent value in the cluster event record, a short description of the problem, or a long description of the problem.

16. The computer-implemented system of claim 11, wherein: Associating the cluster event records with the problem records includes updating a field in each cluster event record with an identifier of the problem record.

17. The computer-implemented system of claim 11, wherein: Associating the cluster event record with the problem record includes creating a parent / child relationship between the problem record and the cluster event record.

18. The computer-implemented system of claim 11, wherein: The updating of the machine learning based model includes training the machine learning based model to learn to cluster associations between new event records and problem records.

19. The computer-implemented system of claim 18, wherein: The operations further include: When the machine learning-based model indicates that the clustered new event records are related to the problem records and the clustered new event records are based on unacceptable events, creating a persistent problem record based on the clustered new event records, associating the clustered new event records with the persistent problem records, and associating the persistent problem records with the problem records to indicate that problems related to the problem records persist, When the machine learning-based model indicates that the clustered new event records are related to the problem records and the clustered new event records are based on acceptable events, creating new problem records based on the clustered new event records is ignored.

20. A non-transitory computer readable medium storing instructions which, when executed by one or more processors, cause the one or more processors to perform operations comprising: clustering event record subgroups from a plurality of event records using a machine learning-based model based on a rolling time window and the number of records in the event record subgroups; Create problem records based on clustered event records; populating the problem record with information related to the clustered event record; Associating clustered event records with problem records; Provides notification that a problem record has been created; Receive solutions to problem records; Based on the solution, the machine learning based model is updated to learn the association between the extracted features of the solution and the extracted features of the clustered event records.

Images