Machine Learning Root Cause Analysis for IT Incident Data

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current solutions for root cause analysis of machine-generated textual data in IT environments are inefficient due to the vast volume and complexity of data, lack of standardized data structures, and reliance on manual analysis, which limits human operators' ability to identify and address malfunctions effectively.

Innovation Solution

A method and system using machine learning to extract features from machine-generated textual data, generate suitability scores for insights, and select the most relevant insights to determine enriched root causes, enabling automated analysis and recommendation generation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If machine learning techniques are used to automatically analyze machine-generated data, then productivity and response time are improved, but device complexity increases

Engineering Contradiction:
Improveincident analysis speedVSAvoidsystem complexity
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The patent introduces machine learning models as intermediary components between raw machine-generated data and human operators. These models process and enrich incident data automatically, serving as a mediator that handles the complexity of data analysis while presenting simplified insights to users. This resolves the contradiction by automating the analytical workload without requiring human operators to directly manage system complexity.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The system enables self-service analysis through automated machine learning pipelines that independently process incidents, generate enrichments, and provide recommendations without human intervention. The machine learning models autonomously learn from historical data and continuously improve their analysis capabilities, allowing the system to serve itself while maintaining high productivity and reducing the need for complex manual analysis procedures.

Inventive Principle:
Principle #25Self-service

2Ease of operation

If manual analysis of machine-generated data is performed, then ease of operation is maintained, but loss of time and productivity decrease

Engineering Contradiction:
Improveoperational simplicityVSAvoidincident response time
Core Design Contradiction:
Ease of operationVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-processing and enriching incident data using machine learning models before human operators need to review it. The models generate preliminary diagnoses, identify potential root causes, and prepare enriched incident records in advance, so when operators do review incidents, the work is already partially completed. This reduces response time without requiring operators to perform complex analysis manually.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent replaces the mechanical system of manual human analysis with an automated machine learning-based analysis system. Instead of operators manually examining logs and metrics, machine learning algorithms automatically process the data, identify patterns, and generate insights. This substitution dramatically reduces response time while maintaining ease of operation, as the automated system handles the time-consuming analysis tasks.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If comprehensive data collection is performed to improve root cause identification, then measurement precision is improved, but device complexity and difficulty of detecting and measuring increase

Engineering Contradiction:
Improveroot cause identification accuracyVSAvoiddata analysis complexity
Core Design Contradiction:
Measurement precisionVSDifficulty of detecting and measuring

Solution Approach 1:

The machine learning models extract only the most relevant features and insights from comprehensive incident data, separating signal from noise. Instead of requiring operators to analyze all collected data, the models automatically identify and extract key diagnostic information, root cause indicators, and actionable insights. This extraction process maintains measurement precision by focusing on critical data points while reducing the apparent complexity for human operators.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The system transforms raw incident data into enriched parameters and features through machine learning processing. By changing the parameter representation from raw logs and metrics to structured, enriched incident records with pre-computed features and insights, the system improves measurement precision while making the data more manageable and less complex for both automated processing and human review.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentUS10600002B2Machine learning techniques for providing enriched root causes based on machine-generated data
Publication Date: 2020.03.24 SERVICENOW INC
  • US10600002B2 patent drawing
  • US10600002B2 patent drawing
  • US10600002B2 patent drawing

AI summary

A method and system for providing an enriched root cause of an incident using machine-generated textual data. The method includes extracting, from a dataset including machine-generated textual data for a monitored environment, a plurality of features related to a root cause of an incident in the monitored environment; generating a suitability score for each of a plurality of insights with respect to the incident based on the extracted features and a suitability model, wherein the suitability model is created based on a training set including a plurality of training inputs and a plurality of training outputs, wherein each training output corresponds to at least one of the plurality of training inputs; and selecting at least one suitable insight based on the generated suitability scores.