Real-time alert storm summarization using knowledge graph

Abstract

In an embodiment, a method for real-time alert storm summarization using knowledge graph is provided. The method involves detecting an alert storm associated with a plurality of electronic devices of an IT infrastructure. A plurality of active alert logs is retrieved and a plurality of IDs corresponding to the plurality of active alert logs is generated. An alert ID dictionary is queried to retrieve and cluster a plurality of alert ID embeddings corresponding to the plurality of alert IDs into a plurality of alert ID clusters. An alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph are extracted. Centrality scores corresponding to the nodes are computed and a set of alert IDs are selected as a root cause of the alert substorm of the alert storm based on the centrality scores.

Description

[0001] REAL-TIME ALERT STORM SUMMARIZATION USING KNOWLEDGE GRAPH FIELD

[0002] The embodiments discussed in the present disclosure are related to realtime alert storm summarization using knowledge graph.

[0003] BACKGROUND

[0004] Service failures in Information Technology (IT) infrastructure can lead to alert storms, which overwhelm the authorities responsible for resolving these issues with numerous alerts. Identifying the primary causes of these service failures is challenging, making the monitoring of such failures a crucial aspect of modern IT infrastructure. Determining the main causes within alert storms is a time-consuming and tedious task. Traditional storm analyzer systems are used to detect alert storms and identify major causes of service failures. These systems typically rely on network topology and alert text-based similarities for this purpose. Additionally, some methods use supervised or unsupervised systems to automate the detection and analysis of major causes. This involves monitoring certain Key Performance Indicators (KPIs) or metrics that affect the quality of experience (QoE) and service for users, raising an alarm when predefined criteria are not met. Moreover, traditional methods of manual analysis and prioritization of alerts are inefficient for the authorities responsible for resolving these failures.

[0005] The subject matter claimed in the present disclosure is not limited to embodiments that solve any disadvantages or that operate only in environments such as those described above. Rather, this background is only provided to illustrateone example technology area where some embodiments described in the present disclosure may be practiced.

[0006] SUMMARY

[0007] According to an aspect of an embodiment, a method for real-time alert storm summarization using knowledge graph is provided. The method may include a set of operations which may include detecting an alert storm associated with a plurality of electronic devices of an Information Technology (IT) infrastructure. The set of operations may further include retrieving, based on the alert storm, a plurality of active alert logs representing a set of alert types. The set of operations may further include generating a plurality of alert identifiers (IDs) corresponding to the plurality of active alert logs. The set of operations may further include querying an alert ID dictionary using the plurality of alert IDs to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs. The set of operations may further include clustering the plurality of alert ID embeddings into a plurality of alert ID clusters. The set of operations may further include obtaining, from the set of alert types, alert types associated with alert ID embeddings of an alert ID cluster of the plurality of alert ID clusters. The set of operations may further include extracting, from an alert casual graph, an alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph. The set of operations may further include computing centrality scores corresponding to the nodes of the alert subgraph. Furthermore, the set of operations may include selecting, from the plurality of alert IDs, a set of alert IDs as a root cause of an alert substorm of the alert storm based on the centrality scores.The objects and advantages of the embodiments will be realized and achieved at least by the elements, features, and combinations particularly pointed out in the claims.

[0008] Both the foregoing general description and the following detailed description are given as examples and are explanatory and are not restrictive of the invention, as claimed.

[0009] BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Example embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:

[0011] FIG. 1 is a diagram representing an example environment related to realtime alert storm summarization using knowledge graph;

[0012] FIG. 2 is a block diagram that illustrates an exemplary system for real-time alert storm summarization using knowledge graph;

[0013] FIG. 3 is an exemplary flowchart for alert ID dictionary generation; FIG. 4 is a diagram that illustrates an exemplary flowchart for generation of an alert causal graph;

[0014] FIGs. 5A and 5B are diagrams that collectively illustrate an exemplary flowchart for real-time alert storm summarization using knowledge graph;

[0015] FIG. 6 is a diagram that illustrates an exemplary scenario of an alert subgraph summary based on a sub-storm;

[0016] FIG. 7 is a diagram that illustrates a flowchart of an example for real-time alert storm summarization using knowledge graph,

[0017] all according to at least one embodiment described in the present disclosure.DESCRIPTION OF EMBODIMENTS

[0018] Some embodiments described in the present disclosure relate to methods and systems for real-time alert storm summarization using knowledge graph. In this disclosure, the system may detect an alert storm associated with a plurality of electronic devices of an Information Technology (IT) infrastructure. The set of operations may further include retrieving, based on the alert storm, a plurality of active alert logs representing a set of alert types. The set of operations may further include generating a plurality of alert identifiers (IDs) corresponding to the plurality of active alert logs. The set of operations may further include querying an alert ID dictionary using the plurality of alert IDs to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs. The set of operations may further include clustering the plurality of alert ID embeddings into a plurality of alert ID clusters. The set of operations may further include obtaining, from the set of alert types, alert types associated with alert ID embeddings of an alert ID cluster of the plurality of alert ID clusters. The set of operations may further include extracting, from an alert casual graph, an alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph. The set of operations may further include computing centrality scores corresponding to the nodes of the alert subgraph. Furthermore, the set of operations may include selecting, from the plurality of alert IDs, a set of alert IDs as a root cause of an alert substorm of the alert storm based on the centrality scores.

[0019] Conventional methods for alert storm summarization involve network topology and alert text-based similarities to generate the summary. Specifically, these methods capture semantic and behavioral information from historical alerts.An alert correlation model (MLP) aggregates these representations to determine correlations between alerts, trained in a supervised setting using labeled data from manual failure reports. The methods depend on labeled data and summarize by grouping newly reported alerts at time “t” with their highest correlated alert within a 5-minute window [t-w, t]. However, these methods do not provide root causes for individual groups. These methods are designed based on network topology to represent cascading failure effects. The graph’s nodes include service incidents from the same failures, with silent nodes identified using KPIs. Community detection algorithms automatically determine the failure impact graph for different failures. In these methods graph representation learning is used to learn embeddings for each unique incident type in an unsupervised manner, encoding interactions in temporal and topological dimensions. However, the approach relies on topology information, involves KPI comparisons to complete the graph, and is limited to grouping alerts within a fixed time window (W). Further, these methods may represent alerts from each cluster being provided to engineers for failure diagnosis. These methods depend on topology and textual similarity, using a similarity matrix that combines textual (a) and topology (1-cQ information for clustering. Without topology information, clustering only groups similar texts.

[0020] The present disclosure may address these challenges by using an alert embedding technique, such as Alert2Vec, to learn correlated alerts and design an automatic alert knowledge graph from alert logs. This approach may enable more efficient, accurate, and timely processing of alert storms, leading to improved management and optimization of solutions for tackling alert storms. Firstly, the system may capture alert co-occurrences in an embedding space relative to deviceinformation, even without system topology. Additionally, the system generates an alert causal graph by using the alert knowledge graph to identify dependencies among alert types and generates summaries using learned embeddings. The system may pinpoint the root cause of the alert storm and the originating device IDs. Furthermore, the system identifies sub-storms and anomalies and provides explanations using the alert causal graph. The alert embedding technique reduces dependency on network topology, improving root cause identification and explainability. The system effectively summarizes alert storms and justifies outcomes using the alert causal graph, even with limited data and without topological information.

[0021] Furthermore, the system may involve unsupervised learning of sophisticated representations of alerts associated with device IDs. Additionally, the system may programmatically generate an alert causal graph using a transformer encoder from historical data to rank alerts and find root causes, instead of relying on topological information for ranking. The present disclosure may also identify precise root causes (alerts and devices) for each detected storm using a centralized storm detector.

[0022] Embodiments of the present disclosure are explained with reference to the accompanying drawings.

[0023] FIG. 1 is a diagram representing an example environment related to realtime alert storm summarization using a knowledge graph, arranged in accordance with at least one embodiment described in the present disclosure. With reference to FIG. 1, there is shown an environment 100. The environment 100 may include a system 102 that hosts a storm detector 106 receiving a stream of active alert logs104, a sub-storm analyzer 108, a root cause detector 110, and a storm summarizer 112. The environment 100 may further include an alert causal graph 114, an alert ID dictionary 116, and a plurality of electronic devices 122. The environment 100 may further include a remote server 118 (that may store a dataset 120) and a communication network 124.

[0024] As used herein, the term “Information Technology (IT) infrastructure” refers to a group of a plurality of electronic devices or technology elements (that may include hardware, software, and networks) that are required to develop, test, deliver, monitor, control, or support IT services. In context of the present disclosure, the IT infrastructure may be associated with the plurality of electronic devices 122 that may be triggering a number of alerts.

[0025] As used herein, the term “alert” may refer to an automated notification that may be triggered by anomalies or specific conditions in the IT infrastructure performance. The anomalies may be related to the health or security of the IT infrastructure. In the context of the term “alert storm”, the term may mean generation of a large number of alerts in a short time duration (e.g., 1 minute), that makes the alert storm difficult to handle and respond to the most important alert that has been triggered. The large number of alerts may cause confusion, delay in incident response, and may lead to alert fatigue, which may diminish the ability to identify root cause or anomalies of the alert storm generated.

[0026] As used herein, the term “stream” refers to a sequence of logs that share the same source (such as an online platform). More specifically, the stream may generally represent the sequence of logs coming from the application instance or resource being monitored. In context of the present disclosure the term “stream” maybe related to the stream of alert logs coming from the plurality of electronic devices 122 of the IT infrastructure.

[0027] As used herein, the term “alert ID” may refer to a unique identifier that may be assigned to an alert type concatenated with a device ID. The alert type may be a concise message or notification associated with an error or incident, and the device ID may be an identifier associated with the device corresponding to the error or incident. For example, the alert type may be “loss of light”, and the device ID may be “DI”, then the alert ID may be “loss of light_Dl.”

[0028] The system 102 may include suitable logic, circuitry, and interfaces that maybe configured to implement the storm detector 106, the sub-storm analyzer 108, the root cause detector 110, and the storm summarizer 112 as computer-executable programs. Specifically, the system 102 may receive the stream of active alert logs 104 from the plurality of electronic devices 122 of the IT infrastructure. The system 102 may use the storm detector 106, the sub-storm analyzer 108, the root cause detector 110 associated with the storm summarizer 112 to select a set of alert IDs as a root cause, generate an alert storm summary and one or more anomalies corresponding to the stream of active alert logs 104. Examples of the system 102 may include, but are not limited to, a computing device, a smartphone, a gaming device, a mainframe machine, a server (or a cluster of servers), a computer workstation, a decentralized computing system, an edge computing device, and / or a consumer electronic (CE) device.

[0029] The storm detector 106 may be a system that continuously monitors the received stream of active alert logs 104 for a time duration. Further, the storm detector 106 may determine a count of active alert logs in the stream of active alertlogs 104. When the count of active alert logs in the stream of active alert logs 104 is above a counted threshold in the time duration, then the alert storm may be said to be detected. Further, upon alert storm detection, the storm detector 106 may retrieve a plurality of active alert logs from the stream of active alert logs 104. For example, the storm detector 106 may be associated with an extreme value theory (EVT) mechanism to detect the alert storm from the stream of active alert logs 104.

[0030] By way of example, and not limitation, the storm detector 106 may be a system that continuously monitors network nodes for performance or health anomalies that may exceed predetermined thresholds. The continuous monitoring helps in identifying and handling of the alert storms, which may be a significant issue in network management or alert management. As used herein, the term “anomalies” may refer to critical issues or deviations from standard behaviors or patterns in the functioning of any layer within the Open Systems Interconnection (OS1) model of the IT infrastructure. Examples of anomalies include signal degradation, hardware failures, or cable faults at the Physical Layer (Layer 1); frame errors, MAC address conflicts, or switch port issues at the Data Link Layer (Layer 2); routing loops, IP address conflicts, or packet loss at the Network Layer (Layer 3); TCP / UDP port scanning, connection timeouts, or retransmission issues at the Transport Layer (Layer 4); session hijacking, session timeout, or synchronization failures at the Session Layer (Layer 5); data encryption / decryption errors, format translation issues, or data compression problems at the Presentation Layer (Layer 6); and application crashes, service unavailability, or protocol violations at the Application Layer (Layer 7). Further, the system 102 may monitor alerts that are triggered by theanomalies to monitor the performance, health, or security of the plurality of electronic devices 122.

[0031] The sub-storm analyzer 108 may receive the plurality of active alert logs retrieved by the storm detector 106. The sub-storm analyzer 108 may further query the alert ID dictionary 116 using the plurality of active alert logs and retrieve a plurality of alert ID embeddings corresponding to the plurality of active alert logs. As used herein, the term “embeddings” may refer to a representation of data in a continuous vector space where each item is mapped to a point in this space. In the context of machine learning and natural language processing, vector embeddings are typically used to convert categorical data, such as words or phrases, into numerical vectors that capture the semantic meaning and relationships between the data. Each alert ID embedding may be a vector embedding of a string that includes an alert type concatenated with a device identifier associated with the alert type. The sub-storm analyzer 108 may further perform clustering of the plurality of alert ID embeddings into a plurality of alert ID clusters as representative of alert substorms of the alert storm.

[0032] Further, the sub-storm analyzer 108 may extract an alert subgraph from an alert causal graph 114. The alert subgraph may represent the alert types as nodes of the alert subgraph and a causal relationship among the alert types with edges between the nodes. In an embodiment, the alert causal graph 114 may be obtained by updating an initialized graph by adding an edge between a pair of nodes of a plurality of nodes. The initialized graph may include the plurality of nodes to represent the plurality of historical alert types that may be specified in a plurality of historical alert logs.In an embodiment, the alert ID dictionary 116 may include a plurality of historical alert IDs as keys of the alert ID dictionary 116 and a plurality of historical alert ID embeddings as values corresponding to the keys in of the alert ID dictionary 116. The plurality of historical alert ID embeddings may be extracted by iteratively retrieving a historical alert ID embedding corresponding to each historical alert ID of the plurality of historical alert IDs from an embedding layer of a trained transformer encoder. The transformer encoder, for example, may be a part of an Alert2Vec module, which may be used to obtain the alert ID dictionary 116. The transformer encoder may be trained on a next alert ID prediction task based on a set of historical alert ID sequences. Further, the set of historical alert ID sequences may be obtained from a plurality of historical alert IDs. Each historical alert ID of a plurality of historical alert IDs may be generated by concatenating the alert type with the device ID associated with a historical alert log. The term “historical alert log” refers to historical alert logs collected from the plurality of electronic devices 122 of the IT infrastructure. In context of the present disclosure, the historical alert log may include an alert type, a device ID, a timestamp, and severity information. The alert type may be triggered on any of the plurality of electronic devices 122. The device ID may be associated with the respective electronic device, the timestamp may correspond to the alert type triggered on the device, and the severity information may be linked to the alert type.

[0033] The root cause detector 110 may include logic, interfaces, and / or code configured to detect the root cause associated with the alert storm. Further the root cause detector 110 may be applied on an acquired input (such as the alert ID dictionary 116 and the alert causal graph 114) to dynamically detect the root causeassociated with an alert substorm of the alert storm. For instance, the root cause detector 110 may be associated with a root cause analysis process that may be configured to determine the root cause associated with a problem (such as an alert storm) in order to determine the appropriate solution towards handling the alerts. In an embodiment, the root cause detector 110 may use the alert subgraph extracted from the alert causal graph 114 to determine the causal relationship among the alert types as nodes of the alert subgraph. Further, the root cause detector 110 may be configured to select the alert IDs corresponding to the alert ID embeddings and remove the device IDs to obtain the alert types for the alert ID cluster. Furthermore, the root cause detector 110 may be configured to compute the centrality scores corresponding to the nodes of the alert subgraph and rank the nodes of the alert subgraph based on the centrality scores. The root cause detector 110 may determine a list of alert IDs corresponding to each of the ranked nodes from the plurality of alert IDs. Further, an alert ID for which an associated timestamp is earliest amongst that of other alert IDs may be determined from the list of alert IDs (i.e., the list of alert IDs may be sorted based on the timestamp). Furthermore, the root cause detector 110 may select a set of alert IDs as a root cause of the alert substorm from the plurality of alert IDs based on the centrality scores. In an embodiment, the root cause detector 110 may be part of the storm summarizer 112, as shown in the FIG. 1.

[0034] The storm summarizer 112 may include logic, interfaces, and / or code configured to generate an alert storm summary. The alert storm summary may include a set of alert IDs as the root cause of the alert substorm and one or more anomalies as one or more disconnected nodes of the alert subgraph. The alert storm summary may further include a description of the root cause, and the device IDassociated with the root cause. The storm summarizer 112 may be configured to use the alert subgraph extracted from the alert causal graph 114 and the alert ID embeddings of the alert ID dictionary 116 to generate an alert storm summary.

[0035] In an embodiment, the storm summarizer 112 may be configured to use ranking of the nodes of the alert subgraph based on the centrality scores to summarize the alert storm. In an embodiment, the storm summarizer 112 may be configured to receive the alert causal graph 114 and the alert ID dictionary 116. The alert ID dictionary 116 may be used to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs (i.e., collecting and sorting similar alerts based on timestamp and severity). The alert causal graph 114 may be used to extract the alert subgraph representing the causal relationship among the alert types as nodes of the alert subgraph (i.e., identifies relationships between different alerts). Further, the storm summarizer 112 maybe configured to remove device IDs from the alert IDs to obtain the alert types for the alert ID cluster to focus on the root cause. Further, the storm summarizer 112 may be configured to summarize the alert storm and provides a concise summary of the alert storm, highlighting key information and actionable insights. An example of the alert sub-storm summary is provided in FIG.

[0036] 6.

[0037] The remote server 118 may include logic, interfaces, and / or code configured to store the dataset 120 comprising historical alert logs 120A. In at least one embodiment, the remote server 118 may be implemented as a plurality of distributed cloud-based resources by use of several technologies that are well known to those ordinarily skilled in the art. In certain embodiments, the functionalities ofthe remote server 118 may be incorporated in its entirety or at least partially in the system 102, without a departure from the scope of the disclosure.

[0038] The dataset 120 may be stored or cached on a device such as the remote server 118 or the system 102. The dataset 120 may include the historical alert logs 120A associated with the plurality of electronic devices 122 of the IT infrastructure. Each of the historical alert logs of the historical alert logs 120A may include an alert type, a device ID, a timestamp, and severity information.

[0039] The plurality of electronic devices 122 may include various electronic devices through which the system 102 may receive the stream of active alert logs 104. Examples of the plurality of electronic devices 122 may include, but are not limited to, router, phone, hub, gateway, switch, a computing device, a mainframe machine, a server (or a cluster of servers), a computer workstation, and / or a consumer electronic (CE) device.

[0040] The communication network 124 may include various communication media through which the system 102 may communicate with remote server 118 or other devices. Examples of the communication network 124 may include, but are not limited to, the Internet, a cloud network, a Wireless Fidelity (Wi-Fi) network, a Personal Area Network (PAN), a Local Area Network (LAN), a cellular network (such as, a Long-term evolution (or 4G) cellular network or a 5G cellular network), a satellite network (such as a network of low earth orbit satellites), and / or a Metropolitan Area Network (MAN)). Various devices in the environment 100 may connect to the communication network 124 using various wired and wireless communication protocols, including TCP / IP, UDP, HTTP, FTP, ZigBee, EDGE, IEEE 802.11, Li-Fi, IEEE 802.16, multi-hop communication, wireless access point (AP),device-to-device communication, cellular communication protocols, and Bluetooth®.

[0041] During operation, an online process may be executed for alert storm / sub-storm summarization, as described herein. As part of the online process, the system 102 may receive a stream of active alert logs 104 over a specified time duration and detect an alert storm associated with a plurality of electronic devices 122 within the IT infrastructure. The detection of an alert storm may be based on whether the count of active alert logs in the stream exceeds a predefined threshold. In one embodiment, the plurality of active alert logs may be retrieved either from the received stream of active alert logs 104 or from a dataset 120 stored on a remote server 118 or within the system 102 itself. In another embodiment, the system 102 may receive input via a user device (not shown). Additionally, the storm detector 106 within the system 102 may detect the alert storm by monitoring the stream of active alert logs 104 using the EVT (Extreme Value Theory) mechanism. This monitoring process with the EVT mechanism provides a timestamp associated with the alert storm, indicating the time of its occurrence. For example, if the alert storm occurred at timestamp 't', the active alert logs up to time ‘t’ may be used as input for the sub-storm analyzer 108. Based on the input, the system 102 may implement the sub-storm analyzer 108 to retrieve a plurality of active alert logs representing a set of alert types, based on the detected alert storm. Simultaneously, the system 102 may generate a plurality of alert identifiers (IDs) corresponding to the plurality of active alert logs. Further, each alert ID of the plurality of alert IDs may be generated by concatenating the alert type with the device id of a corresponding active alert log of the plurality of active alerts. An example of the plurality of alert IDs is shown in table (1), as follows:

[0042]

[0043]

[0044] Table 1: Alerts with Alert IDs

[0045] In another aspect, the system 102 may query the alert ID dictionary 116 using the plurality of alert IDs to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs. The alert ID dictionary 116 maybe queried by passing the plurality of alert IDs to the alert ID dictionary 116. The alert ID dictionary 116 may contain key-value pairs, with each key representing a historical alert ID and the corresponding value representing an alert ID embedding obtained from a trained transformer encoder's embedding layer.

[0046] The system 102 may cluster the plurality of alert ID embeddings into a plurality of alert ID clusters. Each alert ID cluster may include alert ID embeddings corresponding to a portion of the plurality of alert IDs. The clustering may be performed using, for example, Density-based spatial clustering of applications with noise (DBSCAN) method. The DBSCAN method groups points that may be closely packed together in data space (such as embeddings). The DBSCAN identifies clusters based on a threshold for a neighborhood search radius (epsilon) and a minimum number of neighbors (minPts) required to identify a root point. The DBSCAN may find clusters of arbitrary shapes and identify outliers as noise points rather thanforcing such outliers into clusters. In another embodiment, the system 102 may remove device IDs from the alert IDs to obtain the alert types for the alert ID cluster.

[0047] The system 102 may obtain from the set of alert types, the alert types may be associated with alert ID embeddings of an alert ID cluster of the plurality of alert ID clusters. Herein, the alert type may refer to an alert triggered on at least one electronic device of the plurality of electronic devices 122. Examples of the alert type may include, but are not limited to, a Loss of light, a Current drawn exceeded limit, a Loss of signal, a Loss of alignment, a Bit error signal fail, a Bit error signal degrade, a Virtual connection fault, a high bit error rate, and the likes. As used herein, the term “alert substorm” may refer to a subset of the alert storm.

[0048] The system 102 may extract from the alert causal graph 114, an alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph. For instance, the alert subgraph may be extracted from the alert causal graph 114 by selecting, from the plurality of nodes, the nodes which represent the alert types associated with the alert ID embeddings of the alert ID cluster. The nodes may be, for example, A, B, C, D, E, F, G, and H as shown in the alert causal graph 114 of FIG. 1.

[0049] The system 102 may compute centrality scores corresponding to the nodes of the alert subgraph. In an embodiment, each of the centrality scores may be a Closeness Centrality Score (CCS), which maybe computed by equation (1), as follows:

[0050] K f 11 {css -1 1

[0051] (ai ,aj)

[0052]

[0053] where, a; is the node for which CSS is to be calculated,

[0054] K is the number of reachable nodes from a; of the alert subgraph, andd(a; , aj) is the distance from a node a; to another node aj of the alert subgraph. In some cases, the system 102 may rank the nodes of the alert subgraph based on the calculated centrality scores. Further, the system 102 may determine, from the plurality of alert IDs, a list of alert IDs corresponding to each of the ranked nodes. From this list, the system 102 may identify the alert ID with the earliest associated timestamp among the other alert IDs in the list. Furthermore, the system 102 may select, from the plurality of alert IDs, a set of alert IDs (e.g., top-k alert IDs) as the root cause of the alert substorm within the alert storm, based on the centrality scores. In an exemplary embodiment, the system 102 may calculate the centrality scores and reorder the plurality of alert IDs in descending order based on the calculated centrality scores. Further, the system 102 may select the top-k of alert IDs from the reordered plurality of alert IDs and consider the selected top-k alert IDs as the root cause of the alert substorm. For example, if the plurality of alert IDs that may be recorded based on centrality scores includes Loss of Light DI, High Bit error rate_D2, Loss ofSignal_D3, Bit Error rate Signal degrade_D4, Current drawn exceeded limit_D5, Loss of alignment_D6, Secondary database error_D7, Power Input fail_D8, and Loss of Session_D9, then the top-3 alert IDs (i.e. Loss of Light DI, High Bit error rate_D2, and Loss of Signal_D3) may be considered as the root cause of the alert substorm.

[0055] In one embodiment, the set of alert IDs may include the alert ID determined for each of the ranked nodes.

[0056] In order to provide the alert storm or alert sub-storm summary, an offline process may be executed before the online process. The offline process may include training of the transformer encoder for generating alert ID dictionary 116 andobtaining the alert causal graph 114 using the alert knowledge graph model. Further details related to the alert storm summarization generation are provided in FIG. 3 to FIG. 6, for example.

[0057] FIG. 2 is a block diagram that illustrates an exemplary system for real-time alert storm summarization using knowledge graph, arranged in accordance with at least one embodiment described in the present disclosure. FIG. 2 is explained in conjunction with elements from FIG. 1. With reference to FIG. 2, there is shown a block diagram 200 of the system 102. The system 102 may include a processor 202, a memory 204, an I / O device 206, and a network interface 210. The I / O device 206 may be a display device 208, for example. The memory 204 may be coupled to the processor 202 and may store, for example, a clustering model 204A, a transformer encoder 204B, and an embedding layer 2040.

[0058] The processor 202 may include suitable logic, circuitry, and / or interfaces that may be configured to execute program instructions associated with different operations to be executed by the system 102. The processor 202 may include any suitable special-purpose or general-purpose computer, computing entity, or processing device, including various computer hardware or software modules, and may be configured to execute instructions stored on any applicable computer-readable storage media. For example, the processor 202 may include a microprocessor, a microcontroller, a digital signal processor (DSP), an applicationspecific integrated circuit (ASIC), a Field-Programmable Gate Array (FPGA), or any other digital or analog circuitry configured to interpret and / or to execute program instructions and / or to process data. Although illustrated as a single processor in FIG.

[0059] 2, the processor 202 may include any number of processors configured to,individually or collectively, perform or direct performance of any number of operations of the system 102, as described in the present disclosure. Additionally, one or more of the processors may be present on one or more different systems, such as different remote servers.

[0060] In some embodiments, the processor 202 may be configured to interpret and / or execute program instructions and / or process data stored in the memory 204. After the program instructions are loaded into memory 204, the processor 202 may execute the program instructions. Some of the examples of the processor 202 may be a Graphical Processing Unit (GPU), a Central Processing Unit (CPU), a Reduced Instruction Set Computer (RISC) processor, an Application-Specific Integrated Circuit (ASIC) processor, a Complex Instruction Set Computer (CISC) processor, a coprocessor, and / or a combination thereof.

[0061] The memory 204 may include suitable logic, circuitry, and / or interfaces that may be configured to store instructions executable by the processor 202. In certain embodiments, the memory 204 may be configured to store information such as but not limited to the dataset 120 comprising a clustering model 204A and the historical alert logs 120A that comprise the alert type, the device Id, the timestamp, and the severity information associated with the plurality of electronic devices 122 of the IT infrastructure. In some respects, the historical alert logs 120A the clustering model 204A, the transformer encoder 204B, and the embedding layer 2040 may be placed out of the memory 204. The memory 204 may include computer-readable storage media for carrying or having computer-executable instructions or data structures stored thereon. Such computer-readable storage media may include anyavailable media that may be accessed by a general-purpose or special-purpose computer, such as the processor 202.

[0062] By way of example, and not limitation, such computer-readable storage media may include tangible or non-transitory computer-readable storage media, including Random Access Memory (RAM), Read-Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Compact Disc Read-Only Memory (CD-ROM) or other optical disk storage, magnetic disk storage or other magnetic storage devices, flash memory devices (e.g., solid state memory devices), or any other storage medium which may be used to carry or store particular program code in the form of computer-executable instructions or data structures and which may be accessed by a general-purpose or special-purpose computer. Combinations of the above may also be included within the scope of computer-readable storage media. Computer-executable instructions may include, for example, instructions and data configured to cause the processor 202 to perform a certain operation or group of operations associated with the system 102.

[0063] The clustering model 204A may include logic, interfaces, and / or code configured to cluster the plurality of alert ID embeddings into a plurality of alert ID clusters. The clustering model 204A may identify clusters as high-density areas separated by low-density areas. For instance, the clustering model 204A may rely on two parameters such as an epsilon (the radius around each data point) and an minPts (the minimum number of data points within that radius to consider the area dense). Herein, the data points may be classified as core points, border points, or noise points. Thus, the plurality of alert ID clusters may be formed by recursively connecting core points of the plurality of alert ID embeddings and the neighbors ofthe plurality of alert ID embeddings. By way of example, and not limitation, the clustering model 204A may use DBSCAN as an effective method for detecting clusters of varying shapes and sizes without needing a predefined number of the plurality of alert ID clusters.

[0064] The transformer encoder 204B may include logic, interfaces, and / or code configured to process input sequences such as a historical alert ID sequence and generate a vector representation such as a historical alert ID embedding. The trained transformer encoder may include multiple layers, such as an embedding layer 204C. The embedding layer 204C of the trained transformer encoder may be an initial layer that transforms the input (such as a historical alert ID sequence) into a vector representation. The vector representation or a historical alert ID embedding may then be processed by subsequent layers in the trained transformer encoder. The embedding layer 204C of the trained transformer encoder may receive an input {i^, i^,..., i_(t — 1)Ak] to predict the next alert ID i^. Further, each of the alert ID may be initialized with a random embedding in the embedding layer 204C during the training.

[0065] The embedding layer 204C may be crucial for converting the input sequence into a format that may be effectively processed by the neural network layers of the transformer encoder. In an embodiment, the transformer encoder 204B may be trained based on the above-mentioned process may be referred to as a pretrained transformer encoder. As used herein, the term “pre-trained” refers to a model that has been previously trained on a dataset before being fine-tuned or used for inference for a specific task.The I / O device 206 may include suitable logic, circuitry, interfaces, and / or code that may be configured to receive the stream of active alert logs 104. The stream of active alert logs 104 may be an online stream. The I / O device 206 may be further configured to provide an output in response to stream of active alert logs 104. The output may include a root cause associated with the stream of active alert logs 104, the alert storm summary comprising a set of alert IDs as the root cause of the alert substorm and one or more anomalies as one or more disconnected nodes of the alert subgraph. The I / O device 206 may include various input and output devices, which may be configured to communicate with the processor 202 and other components, such as the network interface 210. Examples of the input devices may include, but are not limited to, a touch screen, a keyboard, a mouse, a joystick, and / or a microphone. Examples of the output devices may include, but are not limited to, a display device 208 and a speaker. The I / O device 206 may be configured within the system 102 or outside of the system 102.

[0066] The network interface 210 may communicate with networks, such as the Internet, an Intranet, and / or a wireless network, such as a cellular telephone network, a wireless local area network (LAN) and / or a metropolitan area network (MAN). The wireless communication may use any of a plurality of communication standards, protocols and technologies, such as Global System for Mobile Communications (GSM), Enhanced Data GSM Environment (EDGE), wideband code division multiple access (W-CDMA), Long Term Evolution (LTE), code division multiple access (CDMA), time division multiple access (TDMA), Bluetooth, Wireless Fidelity (Wi-Fi) (such as IEEE 802.11a, IEEE 802.11b, IEEE 802.11g and / or IEEE 802. lln), voice over Internet Protocol (VoIP), light fidelity (Li-Fi), or Wi-MAX.In certain embodiments, the system 102 may include the storm detector 106, the sub-storm analyzer 108, the root cause detector 110 associated with the storm summarizer 112, the remote server 118 and the dataset 120. Modifications, additions, or omissions may be made to the system 102, without departing from the scope of the present disclosure. For example, in some embodiments, the system 102 may include any number of other components that may not be explicitly illustrated or described. Operations of the system 102 including that of the storm detector 106, the sub-storm analyzer 108, the root cause detector 110 associated with the storm summarizer 112 are further described in detail, for example, in FIG. 3, FIG.4, FIG. 5A, FIG. 5B, FIG. 6, and FIG. 7.

[0067] FIG. 3 is an exemplary flowchart for alert ID dictionary generation, in accordance with an embodiment of the disclosure. FIG. 3 is described in conjunction with elements from FIG. 1 and FIG. 2. With reference to FIG. 3, there is shown a flowchart 300. The flowchart 300 is part of an offline process for the generation of the alert ID dictionary 116. The process may be implemented by any suitable system, apparatus, or device, such as the example system 102 of FIG. 1 or processor 202 of FIG. 2.

[0068] At 302, a plurality of historical alert logs may be received. The system 102 may be configured to receive the plurality of historical alert logs (such as the historical alert logs 120A] associated with the IT infrastructure. In an example embodiment, each of the historical alert logs 120A may include an alert type, a device ID, a timestamp, and severity information associated with the alert type. The system 102 may select a historical alert log from the plurality of historical alert logs.At 304, an alert type may be selected. The system 102 may be configured to select an alert type from the selected historical alert log.

[0069] At 306, a device ID may be selected. The system 102 may be configured to select the device ID from the selected historical alert log. The device ID may be associated with an electronic device of the plurality of electronic devices 122.

[0070] At 308, a concatenation operation maybe performed. The system 102 may be configured to concatenate the alert type with the device ID to generate a historical alert ID of a plurality of historical alert IDs. For example, if the alert type is “Loss of alignment” and the device ID associated with the alert type is D6, then the concatenated historical alert ID may be “Loss of alignment_D6”. The concatenation may refer to a string concatenation of two or more strings together using a substring such as an underscore between the strings to form a single larger string.

[0071] At 310, a sorting operation may be performed. The system 102 may be configured to sort the plurality of historical alert IDs based on historical timestamps specified in the plurality of historical alert logs. The historical timestamp may refer to a date-time at which the alert type may be triggered on the electronic device of the plurality of electronic device 122.

[0072] At 312, a grouping operation may be performed. After the sorting, the system 102 may be configured to group the plurality of historical alert IDs into historical alert ID groups based on a specific grouping duration. The grouping of the plurality of historical alert IDs may include categorizing the plurality of historical alert IDs based on time intervals into specified ranges.

[0073] At 314, historical alert ID sequencing may be performed. The system 102 may be configured to obtain a set of historical alert ID sequences from each of thehistorical alert ID groups. Each of the historical alert ID sequences may comprise a sequence of historical alert types of a plurality of historical alert types specified in the plurality of historical alert logs 120A. In an embodiment, the set of historical alert ID sequences may be generated with a fixed length (window) and a stride of 1.

[0074] At 316, training of the transformer encoder 204B may be performed. The system 102 may be configured to train the transformer encoder 204B on a next alert ID prediction task based on the set of historical alert ID sequences. The training may be performed to obtain a trained transformer encoder.

[0075] In an exemplary embodiment, the set of historical alert ID sequences may be S = {sx, s2,..., sn}, where each skhas a sequence of historical alert IDs {i^, i2,..., i _x, i^}, and the transformer encoder 204B may be trained for a self-supervised task i.e., next alert ID prediction. The trained transformer encoder may include multiple layers, such as an embedding layer 204C. The embedding layer 204C of the trained transformer encoder may be an initial layer that transforms the input (such as a historical alert ID sequence) into a vector representation. The vector representation or a historical alert ID embedding may then be processed by subsequent layers in the trained transformer encoder. The embedding layer 204C of the trained transformer encoder may receive an input {i^, i2,..., i_(t — l)Ak] to predict the next alert ID i^. Further, each of the alert ID may be initialized with a random embedding in the embedding layer 204C during the training.

[0076] At 318, a plurality of historical alert ID embeddings may be extracted. The system 102 may be configured to extract the plurality of historical alert ID embeddings by iteratively retrieving a historical alert ID embedding correspondingto each historical alert ID of the plurality of historical alert IDs from the embedding layer 204C of the trained transformer encoder.

[0077] At 320, the alert ID dictionary 116 may be constructed. The system 102 may be configured to construct the alert ID dictionary 116 by including the plurality of historical alert IDs as keys of the alert ID dictionary 116 and the plurality of historical alert ID embeddings as values corresponding to the keys in of the alert ID dictionary 116. Further, the alert ID dictionary 116 may be queried by system 102 to retrieve the plurality of alert ID embeddings, as described in FIG. 5.

[0078] FIG. 4 is a diagram that illustrates an exemplary flowchart for generation of an alert causal graph, in accordance with an embodiment of the disclosure. FIG. 4 is described in conjunction with elements from FIG. 1, FIG. 2, and FIG. 3. With reference to FIG. 4, there is shown an exemplary flowchart 400. Operations of the exemplary flowchart 400 may be implemented by any suitable system, apparatus, or device, such as the example system 102 of FIG. 1 or processor 202 of FIG. 2.

[0079] At 402, a historical alert log reception operation may be performed. The system 102 may be configured to receive a plurality of historical alert logs (such as the historical alert logs 120A] associated with the IT infrastructure. In an example embodiment, each of the historical alert logs 120A of the plurality of historical alert logs may include an alert type, a device ID, a timestamp, and severity information associated with the alert type.

[0080] At 404, a historical alert sequence generation operation maybe performed. The system 102 may be configured to generate a set of historical alert sequences based on the plurality of historical alert logs 120A. The set of historical alert sequences may include historical alert groups. The historical alert groups may beformed by grouping of the plurality of historical alert logs 120A based on a time interval. For instance, historical alerts triggered from time tl to t5 may be grouped together, historical alerts triggered from time t6 to tlO may be grouped together, and so on.

[0081] At 406, a graph initialization operation may be performed. The system 102 may be configured to initialize a graph having a plurality of nodes (Al to A8, as shown) to represent a plurality of historical alert types.

[0082] At 408, the system 102 may select a pair of alert types (e.g., the nodes A6 and A7 as shown with dotted lines) from the plurality of historical alert types.

[0083] At 410A, an inter-device frequency computation operation may be performed. The system 102 maybe configured to compute an inter-device frequency as a first number of times the pair of alert types occur in the historical alert groups given the pair of alert types originated from two different electronic devices of the plurality of electronic devices 122.

[0084] At 410B, an intra-device frequency computation operation may be performed. The system 102 maybe configured to compute an intra-device frequency as a second number of times the pair of alert types occur in the historical alert groups given the pair of alert types originated from the same electronic device of the plurality of electronic devices 122.

[0085] At 412, a normalization operation may be performed. Each of the computed inter-device frequency and the computed intra-device frequency may be normalized. The normalization may be based on a suitable method such as min-max normalization, z-score normalization, or mean normalization.At 414, adjacency score computation may be performed. The system 102 may be configured to compute an adjacency score for the pair of alert types based on the normalized inter-device frequency and the normalized intra-device frequency. Specifically, the adjacency score (A) may be computed based on a weighted formula for each pair of alerts, as given by following equation (2):

[0086] A — a x Njnter+ (1 — a) x Njntra(2)

[0087] where a s [0,1]

[0088] The adjacency score between the pair of alert types [selected at 408) may indicate how often the pair of alert types occurs together. A higher score may mean a stronger relationship, suggesting such alerts are frequently linked. For the initialized graph, a higher adjacency score may indicate a connection between the nodes representing the pair of alert types.

[0089] At 416, it may be determined whether the adjacency score is greater than a threshold score. The threshold may be a pre-defined adjacency score that may be required to trigger a graph update. In case the adjacency score is greater than a threshold score, the control may pass to 418. Otherwise, the control may pass to 422.

[0090] At 418, the system 102 may be configured to add an edge between the pair of nodes [A6 and A7) of the plurality of nodes [Al to A8) based on a determination that the adjacency score is greater than the threshold score. The edge may be a directed edge [from A6 to A7) indicating a relationship or a potential causal link between the pair of nodes [or the pair of alert types).

[0091] At 420, an alert causal graph may be obtained. The system 102 may be configured to update the graph [initialized at 406) by adding the edge between the selected pair of nodes of the plurality of nodes to obtain the alert causal graph 114.Additionally, to obtain the alert causal graph, operations from 408 to 418 may be repeated for all other pairs of the nodes of the initialized graph. Further in an embodiment, the alert causal graph 114 may be used for extraction of the alert subgraph, as described in the FIG. 5.

[0092] In an embodiment, the alert causal graph may be an Alert Knowledge Graph (AKG). The AKG may be a directed graph that models the relationships and potential causal connections between alert types. Further, each alert type may be represented as a node, and edges between nodes may represent the strength of the connection or relationship between these alert types.

[0093] At 422, the system 102 may be configured to select a next pair of nodes of the plurality of nodes to obtain the alert causal graph 114. After the selection, the control may pass to 410A and 410B and operations from 410A to 418 may be repeated. The selection of the next pair of nodes may be based on a determination that the adjacency score is less than the threshold score.

[0094] FIGs. 5A and 5B are diagrams that collectively illustrate an exemplary flowchart for real-time alert storm summarization using knowledge graph, in accordance with an embodiment of the disclosure. FIGs. 5A and 5B are described in conjunction with elements from FIG. 1, FIG. 2, FIG. 3, and FIG. 4. With reference to FIGs. 5A and 5B, there is shown a flowchart 500. The exemplary operations of the flowchart 500 may be implemented by any suitable system, apparatus, or device, such as the example system 102 of FIG. 1 or processor 202 of FIG. 2.

[0095] Operations from 502 to 510 may be part of an offline process. The operations from 502 to 506 represent the generation of the alert ID dictionary 116 by using the historical alert logs 120A with the pre-trained transformer encoder, asdescribed in FIG.3. The operations from 508 to 510 represent the generation of the alert causal graph 114 based on the historical alert logs 120A, as described in F1G.4. Operations from 512 to 542 describe the online process of alert storm summarization, as described herein.

[0096] At 512, a stream of active alert logs may be received. The system 102 may be configured to receive the stream of active alert logs 104 for a time duration. The stream of active alert logs 104 may originate from an online source connected to the plurality of electronic device 122. Further, each the stream of active alert logs 104 may include an alert type triggered on an electronic device of the plurality of electronic devices 122, a device ID associated with the electronic device, a timestamp at which the alert type is triggered on the electronic device, and severity information associated with the alert type.

[0097] At 514, an alert storm detection operation may be performed. The system 102 may be configured to detect the alert storm associated with the plurality of electronic devices 122. The alert storm may be detected based on whether a count of active alert logs in the stream of active alert logs is above a count threshold, and the plurality of active alert logs may be retrieved from the stream of active alert logs. For example, the alert storm may be detected by the storm detector 106. Using the EVT mechanism, the storm detector 106 may monitor the received stream of active alert logs until a specific timestamp. This timestamp indicates the time of occurrence of the alert storm. For example, if the alert storm occurred at timestamp 't', then the active alert logs up to time 't' may be used as input for the sub-storm analyzer 108.”

[0098] At 516, a retrieval operation for the plurality of active alert logs may be performed. The system 102 may be configured to retrieve the plurality of active alertlogs representing a set of alert types from the stream of active alert logs based on the detected alert storm.

[0099] At 518, a generation of a plurality of alert IDs may be performed. The system 102 may be configured to generate the plurality of alert IDs corresponding to the plurality of active alert logs. Each alert ID of the plurality of alert IDs may be generated by concatenating the alert type with the device ID of a corresponding active alert log of the plurality of active alerts.

[0100] At 520, operation for querying the alert ID dictionary 116 of a plurality of alert IDs may be performed. The system 102 may be configured to query the alert ID dictionary 116 (as described in FIG. 3) using the plurality of alert IDs. The alert ID dictionary 116 may be queried to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs.

[0101] At 522, operation to cluster the plurality of alert ID embeddings may be performed. The system 102 may be configured to cluster the plurality of alert ID embeddings into a plurality of alert ID clusters. For example, the clustering algorithm may be a Density-based spatial clustering of applications with noise (DBSCAN) algorithm. The DBSCAN algorithm groups points that may be closely packed together in data space (such as embeddings). The DBSCAN identifies clusters based on a threshold for a neighborhood search radius (epsilon) and a minimum number of neighbors (minPts) required to identify a root point. The DBSCAN may find clusters of arbitrary shapes and identify outliers as noise points rather than forcing such points into clusters. In an embodiment, the system 102 may remove device IDs from the alert IDs to obtain the plurality of alert clusters, each of which may be a representative of an alert substorm of the alert storm.At 524, operation for obtaining an alert type may be performed. The system 102 may be configured to obtain the alert types associated with alert ID embeddings of an alert ID cluster (of the plurality of alert ID clusters) from the set of alert types.

[0102] At 526, operation for extracting an alert subgraph may be performed. The system 102 may be configured to extract from the alert causal graph 114, the alert subgraph representing a causal relationship among the alert types (obtained at 524) as nodes of the alert subgraph.

[0103] At 528, operation for centrality scores computation may be performed. The system 102 may be configured to compute the centrality scores corresponding to the nodes of the alert subgraph. In an embodiment, each of the centrality scores maybe a Closeness Centrality Score (CCS) that is computed by using the equation (1).

[0104] At 530, operation for selecting alert IDs may be performed. The system 102 may be configured to select, from the plurality of alert IDs, alert IDs corresponding to the alert ID embeddings.

[0105] At 532, operation for removing the device IDs may be performed. The system 102 may be configured to remove the device IDs from the selection of the alert IDs to obtain the alert types (i.e., unique alert types) associated with the alert ID cluster. The system 102 may be configured to consider the obtained alert types (at 532) as the nodes of the alert subgraph for which the centrality scores may be calculated.

[0106] At 534, operation for ranking the nodes may be performed. Further, the system 102 may be configured to rank the nodes of the alert subgraph based on the centrality scores.At 536, operation for determining a list of alert IDs may be performed. The system 102 may be configured to determine, from the plurality of alert IDs, a list of alert IDs corresponding to each of the ranked nodes.

[0107] At 538, operation for sorting the list of alert IDs may be performed. The system 102 may be configured to sort list of alert IDs based on timestamps. The system 102 determines, from the list of alert IDs, an alert ID for which an associated timestamp may be earliest amongst that of other alert IDs in the list of alert IDs. The set of alert IDs may include the alert ID determined for each of the ranked nodes.

[0108] At 540, operation for determining the root cause may be performed. The system 102 may be configured to select at least a subset of the set of alert IDs (determined at 538) as the root cause of the alert substorm. For example, top k nodes from the ranked nodes may be selected and a subset of the set of alert IDs corresponding to the top-k nodes may be selected as the root cause of the alert substorm.

[0109] At 542, operation for generating the alert storm summary may be performed. The system 102 may be configured to generate the alert storm summary comprising at least the subset of the set of alert IDs as the root cause of the alert substorm. The alert storm summary may also include one or more anomalies as one or more disconnected nodes (or respective alert IDs) of the alert subgraph. The generated alert storm summary may provide a concise summary, and details associated with the alert substorm. An example of such a summary is provided in FIG.

[0110] 6.

[0111] It should be noted that several iterations of the operations from 524 to 542 may be performed for other alert ID clusters to obtain an alert storm summaryfor each alert substorm. Further details regarding such iterations are omitted from the disclosure for the sake of brevity.

[0112] FIG. 6 is a diagram that illustrates an exemplary scenario of an alert subgraph summary based on a sub-storm, in accordance with an embodiment of the disclosure. FIG.6 is described in conjunction with elements from FIG. 1, FIG.2, FIG. 3, FIG.4, and FIGs. 5A-5B. With reference to FIG.6, an exemplary scenario 600 is shown. Operations associated with scenario 600 may be performed by any suitable system, apparatus, or device, such as the example system 102 of FIG. 1 or processor 202 of FIG. 2. Scenario 600 includes an alert storm summary 602 corresponding to an alert subgraph 604 (obtained from the alert causal graph 114) for a sub-storm 1. The alert storm summary includes the set of alert IDs 602A to 602J corresponding to ranked nodes (such as rank 1 to 10 for sub-storm 1) of the alert subgraph 604.

[0113] During operation, the system 102 may rank the nodes of the alert subgraph 604 based on centrality scores of the nodes. The node with the highest centrality score amongst the nodes of the alert subgraph may be ranked as 1 and considered as the root node of the alert subgraph 604. As shown, for examples, nodes with high centrality scores such as Loss of light 606Aand Loss of Signal 606B maybe considered for root cause determination, and disconnected nodes such as Current drawn exceeded limit 608A and Secondary Database error 608B may be considered for anomaly determination.

[0114] To obtain the alert storm summary 602, the system 102 may determine a list of alert IDs corresponding to each of the ranked nodes. From the list of alert IDs, the system 102 may further determine an alert ID for which an associated timestamp is earliest amongst that of other alert IDs in the list of alert IDs. Thus, the set of alertIDs 602A to 602J (with earliest timestamps) may be obtained for the ranked nodes. The system 102 may include the set of alert IDs 602A to 602J in the alert storm summary 602. As shown, for example, the alert storm summary 602 includes Loss of Light_Dl 602A, Current drawn exceeded limit_D2602B, Loss of Signal_D3602C, loss of alignment_D4_602D, Bit error rate fail_D5602E, Bit error rate degrade_D6602F, Virtual connection failure_D7 602G, High Bit error rate_D8602H, loss of frame_D9 6021, and secondary database error_D10602J. From the set of alert IDs 602A to 602J, top-k (k=2, for example) alert IDs such as Loss of Light_Dl 602A and Loss of Signal_D3602C may be highlighted as the root cause of the sub-storm 1 and alert IDs such as Current drawn exceeded limit_D2 602B and secondary database error_D10 602] (corresponding to the disconnected nodes) may be highlighted as anomalies associated with the sub-storm 1. In some instances, the alert storm summary 602 may also include other sets of alerts IDs (with highlights) for other sub-storms (such as sub-storm 2, sub-storm 3, and so on).

[0115] It should be noted that the embodiment described in FIG. 6 is merely an example embodiment that should not be construed as limiting the present disclosure.

[0116] FIG. 7 is a diagram that illustrates a flowchart of an example for real-time alert storm summarization using knowledge graph, in accordance with an embodiment of the disclosure. FIG. 7 is described in conjunction with elements from FIG. 1, FIG. 2, FIG. 3, FIG. 4, FIGs. 5A-5B, and FIG. 6. With reference to FIG. 7, there is shown the exemplary flowchart 700. The method illustrated in the exemplary flowchart 700 may be performed by any suitable system, apparatus, or device, such as, by the example system 102 of FIG. 1, or processor 202 of FIG. 2. Although illustrated with discrete blocks, the steps and operations associated with one or moreof the blocks of the flowchart 700 may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the particular implementation. The operations may start at 702 and may proceed to 722.

[0117] At 704, an alert storm associated with a plurality of electronic devices of an Information Technology (IT) infrastructure maybe detected.

[0118] At 706, a plurality of active alert logs representing a set of alert types may be retrieved based on the alert storm.

[0119] At 708, a plurality of alert identifiers (IDs) corresponding to the plurality of active alert logs may be generated.

[0120] At 710, an alert ID dictionary may be queried using the plurality of alert IDs. The alert ID dictionary may be queried to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs.

[0121] At 712, the plurality of alert ID embeddings may be clustered into a plurality of alert ID clusters.

[0122] At 714, alert types associated with alert ID embeddings of the alert ID cluster may be obtained from the set of alert types.

[0123] At 716, an alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph may be extracted from an alert casual graph.

[0124] At 718, centrality scores corresponding to the nodes of the alert subgraph may be computed.

[0125] At 720, a set of alert IDs as a root cause of the alert substorm may be selected from the plurality of alert IDs based on the centrality scores.It should be noted that the user device having the display device 208 is merely provided as an exemplary implementation of the system 102 of FIG. 1 and should not be construed as limiting for the scope of the disclosure. The present disclosure may also be applicable to other modifications, deletions, or additions to the display device 208, without a deviation from the scope of the present disclosure.

[0126] Embodiment described in the present disclosure may be used in many application areas such as, computers, routers, data processing systems, storage devices, applications, services, networking system, IT services, cloud data services, alert log analysis, monitoring system, and the likes. The applications benefit mentioned above may reduce the dependency on network topology for generating the alert storm summary and provide identification of the root causes with device IDs and offer explainability for each root cause.

[0127] Various embodiments of the disclosure may provide one or more non-transitory computer-readable storage media configured to store instructions that, in response to being executed, cause a system (such as the system 102) to perform operations. The operations may include detection of an alert storm associated with a plurality of electronic devices of an Information Technology (IT) infrastructure. The operations may further include retrieving, based on the alert storm, a plurality of active alert logs representing a set of alert types. The operations may further include generating a plurality of alert identifiers (IDs) corresponding to the plurality of active alert logs. The operations may further include querying an alert ID dictionary using the plurality of alert IDs to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs. The operations may further include clustering the plurality of alert ID embeddings into a plurality of alert ID clusters. The operationsmay further include obtaining, from the set of alert types, alert types associated with alert ID embeddings of an alert ID cluster of the plurality of alert ID clusters. The operations may further include extracting, from an alert casual graph, an alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph The operations may further include computing centrality scores corresponding to the nodes of the alert subgraph. Furthermore, the operations may include selecting, from the plurality of alert IDs, a set of alert IDs as a root cause of the alert substorm of the alert storm based on the centrality scores.

[0128] As indicated above, the embodiments described in the present disclosure may include the use of a special purpose or general-purpose computer (e.g., the processor 202 of FIG. 2) including various computer hardware or software modules, as discussed in greater detail below. Further, as indicated above, embodiments described in the present disclosure may be implemented using computer-readable media (e.g., the memory 204 or the dataset 120 or data input prepared based on the dataset 120) for carrying or having computer-executable instructions or data structures stored thereon.

[0129] As used in the present disclosure, the terms “module” or “component” may refer to specific hardware implementations configured to perform the actions of the module or component and / or software objects or software routines that may be stored on and / or executed by general purpose hardware (e.g., computer-readable media, processing devices, etc.) of the system 102. In some embodiments, the different components, modules, engines, and services described in the present disclosure may be implemented as objects or processes that execute on the system 102 (e.g., as separate threads). While some of the system 102 and methods describedin the present disclosure are generally described as being implemented in software (stored on and / or executed by general purpose hardware), specific hardware implementations or a combination of software and specific hardware implementations are also possible and contemplated. In this description, a “computing entity” may be any system 102 as previously defined in the present disclosure, or any module or combination of modulates running on the system 102.

[0130] Additionally, if a specific number of an introduced claim recitation is intended, such an intent will be explicitly recited in the claim, and in the absence of such recitation no such intent is present. For example, as an aid to understanding, the following appended claims may contain usage of the introductory phrases "at least one" and "one or more" to introduce claim recitations. However, the use of such phrases should not be construed to imply that the introduction of a claim recitation by the indefinite articles "a" or "an" limits any particular claim containing such introduced claim recitation to embodiments containing only one such recitation, even when the same claim includes the introductory phrases "one or more" or "at least one" and indefinite articles such as "a" or "an" (e.g., “a” and / or “an” should be interpreted to mean “at least one” or “one or more”); the same holds true for the use of definite articles used to introduce claim recitations.

[0131] Further, any disjunctive word or phrase presenting two or more alternative terms, whether in the description, claims, or drawings, should be understood to contemplate the possibilities of including one of the terms, either of the terms, or both terms. For example, the phrase “A or B” should be understood to include the possibilities of “A” or “B” or “A and B.All examples and conditional language recited in the present disclosure are intended for pedagogical objects to aid the reader in understanding the present disclosure and the concepts contributed by the inventor to furthering the art and are to be construed as being without limitation to such specifically recited examples and conditions. Although embodiments of the present disclosure have been described in detail, various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the present disclosure.

Claims

1. We claim:

1. A method, executable by a system, the method comprising:detecting an alert storm associated with a plurality of electronic devices of an Information Technology (IT) infrastructure;retrieving, based on the alert storm, a plurality of active alert logs representing a set of alert types;generating a plurality of alert identifiers (IDs) corresponding to the plurality of active alert logs;querying an alert ID dictionary using the plurality of alert IDs to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs;clustering the plurality of alert ID embeddings into a plurality of alert ID clusters;obtaining, from the set of alert types, alert types associated with alert ID embeddings of an alert ID cluster of the plurality of alert ID clusters;extracting, from an alert causal graph, an alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph;computing centrality scores corresponding to the nodes of the alert subgraph; andselecting, from the plurality of alert IDs, a set of alert IDs as a root cause of an alert substorm of the alert storm based on the centrality scores.

2. The method according to claim 1, further comprising receiving a stream of active alert logs for a time duration,wherein the alert storm is detected based on whether a count of active alert logs in the stream of active alert logs is above a count threshold, and the plurality of active alert logs is retrieved from the stream of active alert logs.

3. The method according to claim 1, wherein each active alert log of the plurality of active alert logs comprises:an alert type of the set of alert types triggered on an electronic device of the plurality of electronic devices,a device id associated with the electronic device,a timestamp at which the alert type is triggered on the electronic device, andseverity information associated with the alert type.

4. The method according to claim 3, wherein each alert ID of the plurality of alert IDs is generated by concatenating the alert type with the device ID of a corresponding active alert log of the plurality of active alerts.

5. The method according to claim 1, further comprising:receiving a plurality of historical alert logs associated with the IT infrastructure, wherein each historical alert log of the plurality of historical alert logs comprises an alert type and a device ID;generating a historical alert ID of a plurality of historical alert IDs by concatenating the alert type with the device ID;sorting the plurality of historical alert IDs based on historical timestamps specified in the plurality of historical alert logs;grouping, after the sorting, the plurality of historical alert IDs into historical alert ID groups based on a specific grouping duration; and obtaining a set of historical alert ID sequences from each of the historical alert ID groups.

6. The method according to claim 5, further comprising:training a transformer encoder on a next alert ID prediction task based on the set of historical alert ID sequences;extracting a plurality of historical alert ID embeddings by iteratively retrieving a historical alert ID embedding corresponding to each historical alert ID of the plurality of historical alert IDs from an embedding layer of the trained transformer encoder; andconstructing the alert ID dictionary by including the plurality of historical alert IDs as keys of the alert ID dictionary and the plurality of historical alert ID embeddings as values corresponding to the keys in of the alert ID dictionary, wherein the alert ID dictionary is queried by:passing the plurality of alert IDs to the alert ID dictionary; and selecting, from plurality of historical alert ID embeddings, a set of historical alert ID embeddings which corresponds to the plurality of alert IDs passed to the alert ID dictionary,wherein the set of historical alert ID embedding is same as the plurality of alert ID embeddings.The method according to claim 1, further comprising:receiving a plurality of historical alert logs associated with the IT infrastructure;generating a set of historical alert sequences based on the plurality of historical alert logs,wherein the set of historical alert sequences comprises historical alert groups, each of which comprises a sequence of historical alert types of a plurality of historical alert types specified in the plurality of historical alert logs;initializing a graph having a plurality of nodes to represent the plurality of historical alert types;selecting a pair of alert types from the plurality of historical alert types; computing an inter-device frequency as a first number of times the pair of alert types occur in the historical alert groups given the pair of alert types originated from two different electronic devices of the plurality of electronic devices;computing an intra-device frequency as a second number of times the pair of alert types occur in the historical alert groups given the pair of alert types originated from same electronic device of the plurality of electronic devices; normalizing the inter-device frequency;normalizing the intra-device frequency;computing an adjacency score for the pair of alert types based on the normalized inter-device frequency and the normalized intra-device frequency; andupdating the graph by adding an edge between a pair of nodes of the plurality of nodes to obtain the alert causal graph, wherein the pair of nodes corresponds to the pair of alert types and the edge is added based on whether the adjacency score is greater than a threshold score.

8. The method according to claim 7, wherein the alert subgraph is extracted from the alert causal graph by selecting, from the plurality of nodes, the nodes which represent the alert types associated with the alert ID embeddings of the alert ID cluster.

9. The method according to claim 1, further comprising:selecting, from the plurality of alert IDs, alert IDs corresponding to the alert ID embeddings; andremoving device IDs from the selection of the alert IDs to obtain the alert types for the alert ID cluster.

10. The method according to claim 1, wherein each of the centrality scores is a Closeness Centrality Score.

11. The method according to claim 1, further comprising:ranking the nodes of the alert subgraph based on the centrality scores;determining, from the plurality of alert IDs, a list of alert IDs corresponding to each of the ranked nodes; anddetermining, from the list of alert IDs, an alert ID for which an associated timestamp is earliest amongst that of other alert IDs in the list of alert IDs,wherein the set of alert IDs includes the alert ID determined for each of the ranked nodes.

12. The method according to claim 11, further comprising generating an alert storm summary including the set of alert IDs as the root cause of the alert substorm and one or more anomalies as one or more disconnected nodes of the alert subgraph.

13. One or more non-transitory computer-readable storage media storing instructions that, in response to being executed, cause a system to perform operations, the operations comprising:detecting an alert storm associated with a plurality of electronic devices of an Information Technology (IT) infrastructure;retrieving, based on the alert storm, a plurality of active alert logs representing a set of alert types;generating a plurality of alert identifiers (IDs) corresponding to the plurality of active alert logs;querying an alert ID dictionary using the plurality of alert IDs to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs;clustering the plurality of alert ID embeddings into a plurality of alert ID clusters;obtaining, from the set of alert types, alert types associated with alert ID embeddings of an alert ID cluster of the plurality of alert ID clusters;extracting, from an alert causal graph, an alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph;computing centrality scores corresponding to the nodes of the alert subgraph; andselecting, from the plurality of alert IDs, a set of alert IDs as a root cause of an alert substorm of the alert storm based on the centrality scores.

14. The one or more non-transitory computer-readable storage media according to claim 13, wherein the operations further comprise receiving a stream of active alert logs for a time duration,wherein the alert storm is detected based on whether a count of active alert logs in the stream of active alert logs is above a count threshold, and the plurality of active alert logs is retrieved from the stream of active alert logs.

15. The one or more non-transitory computer-readable storage media according to claim 13, wherein each active alert log of the plurality of active alert logs comprises:an alert type of the set of alert types triggered on an electronic device of the plurality of electronic devices,a device ID associated with the electronic device,a timestamp at which the alert type is triggered on the electronic device, andseverity information associated with the alert type.

16. The one or more non-transitory computer-readable storage media according to claim 13, wherein the operations further comprise:receiving a plurality of historical alert logs associated with the IT infrastructure, wherein each historical alert log of the plurality of historical alert logs comprises an alert type and a device ID;generating a historical alert ID of a plurality of historical alert IDs by concatenating the alert type with the device ID;sorting the plurality of historical alert IDs based on historical timestamps specified in the plurality of historical alert logs;grouping, after the sorting, the plurality of historical alert IDs into historical alert ID groups based on a specific grouping duration; and obtaining a set of historical alert ID sequences from each of the historical alert ID groups.

17. The one or more non-transitory computer-readable storage media according to claim 16, wherein the operations further comprise:training a transformer encoder on a next alert ID prediction task based on the set of historical alert ID sequences;extracting a plurality of historical alert ID embeddings by iteratively retrieving a historical alert ID embedding corresponding to each historical alertID of the plurality of historical alert IDs from an embedding layer of the trained transformer encoder; andconstructing the alert ID dictionary by including the plurality of historical alert IDs as keys of the alert ID dictionary and the plurality of historical alert ID embeddings as values corresponding to the keys in of the alert ID dictionary, wherein the alert ID dictionary is queried by:passing the plurality of alert IDs to the alert ID dictionary; and selecting, from plurality of historical alert ID embeddings, a set of historical alert ID embeddings which corresponds to the plurality of alert IDs passed to the alert ID dictionary,wherein the set of historical alert ID embedding is same as the plurality of alert ID embeddings.

18. The one or more non-transitory computer-readable storage media according to claim 13, wherein the operations further comprise:receiving a plurality of historical alert logs associated with the IT infrastructure;generating a set of historical alert sequences based on the plurality of historical alert logs,wherein the set of historical alert sequences comprises historical alert groups, each of which comprises a sequence of historical alert types of a plurality of historical alert types specified in the plurality of historical alert logs;initializing a graph having a plurality of nodes to represent the plurality of historical alert types;selecting a pair of alert types from the plurality of historical alert types; computing an inter-device frequency as a first number of times the pair of alert types occur in the historical alert groups given the pair of alert types originated from two different electronic devices of the plurality of electronic devices;computing an intra-device frequency as a second number of times the pair of alert types occur in the historical alert groups given the pair of alert types originated from same electronic device of the plurality of electronic devices; normalizing the inter-device frequency;normalizing the intra-device frequency;computing an adjacency score for the pair of alert types based on the normalized inter-device frequency and the normalized intra-device frequency; andupdating the graph by adding an edge between a pair of nodes of the plurality of nodes to obtain the alert causal graph, wherein the pair of nodes corresponds to the pair of alert types and the edge is added based on whether the adjacency score is greater than a threshold score.

19. The one or more non-transitory computer-readable storage media according to claim 13, wherein the operations further comprise:ranking the nodes of the alert subgraph based on the centrality scores;determining, from the plurality of alert IDs, a list of alert IDs corresponding to each of the ranked nodes; anddetermining, from the list of alert IDs, an alert ID for which an associated timestamp is earliest amongst that of other alert IDs in the list of alert IDs,wherein the set of alert IDs includes the alert ID determined for each of the ranked nodes.

20. A system, comprising:one or more memory devices storing instructions, andone or more processors, coupled to the one or more memory devices, that execute the instructions to perform a process comprising:detecting an alert storm associated with a plurality of electronic devices of an Information Technology (IT) infrastructure;retrieving, based on the alert storm, a plurality of active alert logs representing a set of alert types;generating a plurality of alert identifiers (IDs) corresponding to the plurality of active alert logs;querying an alert ID dictionary using the plurality of alert IDs to retrieve a plurality of alert ID embeddings corresponding to the plurality of alert IDs;clustering the plurality of alert ID embeddings into a plurality of alert ID clusters;obtaining, from the set of alert types, alert types associated with alert ID embeddings of an alert ID cluster of the plurality of alert ID clusters;extracting, from an alert causal graph, an alert subgraph representing a causal relationship among the alert types as nodes of the alert subgraph; computing centrality scores corresponding to the nodes of the alert subgraph; andselecting, from the plurality of alert IDs, a set of alert IDs as a root cause of an alert substorm of the alert storm based on the centrality scores.

Images