International Business Machines Corporation

Anbang Xu

Rama Kalyani T Akkiraju

Jalal U Mahmud

Vibha Singhal Sinha

Pritam S Gundecha

Shereen M Oraby

Xiaotong Liu

Mansurul Bhuiyan

Sabina Tomkins

Haibin Liu

Zhe Liu

Liang Gou

Harshit Kumar

Lu An

Md Mansurul A Bhuiyan

Taiga Nakamura

Yufan Guo

Peifeng Yin

Salil Ahuja

Shirley M Han

Sahil Bansal

Yingbei Tong

Seema Nagar

Ruchi Mahindru

Yunyao Li

Gargi Banerjee Dasgupta

Laura Chiticariu

Pooja Aggarwal

Atri Mandal

Prateeti Mohapatra

Rama K Akkiraju

Neil Boyette

Amita Misra

Alan Akbik

Chenguang Wang

Pujitha Kara

Akhil Tandon

Hau-Wen Chang

An-Jie Andy Tu

Jiayun Zhao

Victor K Ondego

An approach is disclosed that retrieves a set of current system data corresponding to a computer system and a set of current outputs from an anomaly detection model that is monitoring the computer system. The current system data and the anomaly detection model outputs are input to a trained anomaly detection supervisor model. The trained anomaly detection supervisor model processes the inputs and provides a set of performance data corresponding to the anomaly detection model. The anomaly detection model is then adjusted when the set of performance data indicates that the anomaly detection model is performing below a threshold.

Performance monitoring in the anomaly detection domain for the IT environment

A computer-implemented method, a computer program product, and a computer system for log anomaly detection. A computer receives a windowed log of incoming raw log messages. A computer compares statistical distribution metrics of entities in the windowed log with a statistical distribution extracted from a real-time statistical model for the entities. In response to the statistical distribution metrics being statistically different from the statistical distribution extracted from the real-time statistical model for the entities, a computer tags the windowed log as an entity anomaly. A computer computes a distance between an average word embedding vector in the windowed log and a statistical distribution extracted form a real-time statistical model for word embeddings. In response to the distance being greater than a predetermined threshold, a computer tags the windowed log as a word embedding anomaly. A computer sends to a user an alert with an anomaly severity level.

Log anomaly detection in continuous artificial intelligence for it operations

Identifying an log anomaly resolution by generating a knowledge base linking each of a plurality of incidents with historical anomalous log lines, calculating a resolution specificity score for each knowledge base record, identifying a run-time anomalous log line using the knowledge base, predicting a category for the run-time anomalous log line, identifying resolutions according to the category, ranking the resolutions according to the resolution specificity scores, and recommending a resolution according to the ranking.

Identifying log anomaly resolution from anomalous system logs

One or more computer processors classify each log line in a plurality of unlabeled log lines as an erroneous log line or a non-erroneous log line. The one or more computer processors templatize each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines. The one or more computer processors cluster erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters. The one or more computer processors eliminate the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold. The one or more computer processors train a log anomaly model utilizing=remaining erroneous log template clusters and remaining non-erroneous log template clusters. The one or more computer processors identify a subsequent log line as anomalous or non-anomalous utilizing the trained log anomaly model.

Unlabeled log anomaly continuous learning

Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.

Severity computation of anomalies in information technology operations

A tool for automatically generating incident management process efficiency metrics utilizing real-time communication analysis. The tool retrieves real-time conversation data from one or more communication sources, wherein the real-time conversation data includes one or more messages having data related to an information technology (IT) incident. The tool performs conversation analysis on the one or more messages. The tool determines one or more timestamps of interest for the IT incident from the one or more messages. The tool generates one or more incident management process efficiency metrics for the IT incident utilizing the one or more timestamps of interest. The tool predicts based, at least in part, on historical conversation data, an outcome for the IT incident. The tool sends the one or more incident management process efficiency metrics and the outcome for the IT incident to a user in a notification.

Measuring incident management process efficiency metrics utilizing real-time conversation analysis

A computer-implemented method according to one embodiment includes receiving, utilizing a processor, textual data associated with a conversation between a first participant and a second participant; receiving, utilizing the processor, an objective of the first participant for the conversation between the first participant and the second participant, where the objective is separate from the conversation; determining, utilizing the processor, a dialog act to be entered by the first participant that meets the objective, utilizing a model, including scoring a plurality of proposed dialog acts based on an amount that each proposed dialog act will change a probability of the objective being achieved during the conversation, and determining the dialog act to be entered, based on the scoring; and returning, utilizing the processor, the dialog act to the first participant.

Recommending a dialog act using model-based textual analysis

One embodiment provides a method that includes receiving adjusted labeled data based on emotional tone factors. Words are analyzed using a tone latent Dirichlet allocation (T-LDA) model that models tone intensity using the emotional tone factors and integrating the adjusted labeled data. Representative words are provided for each emotional tone factor based on using the T-LDA model. The representative words are obtained using the T-LDA model based on determining posterior probabilities and adjusting the posterior probabilities based on an auxiliary topic.

Machine learning from tone analysis in online customer service

A method, system, and a computer program product automatically select training data for updating a model by applying human-annotated training data to a model to generate results that are evaluated to identify correct case results and false case results that are categorized into error type categories for use in building error models corresponding to the error type categories, where each error model is built from at least failed case results belonging to a corresponding error type, and where unlabeled data samples are applied to each error model to compute an error likelihood for each unlabeled data sample with respect to each error type category, thereby enabling the selection and display of unlabeled data samples for annotation by a subject matter expert based on a computed error likelihood for the one or more unlabeled data samples in a specified error type category meeting or exceeding an error threshold requirement.

Method and system for unlabeled data selection using failed case analysis

A method, system and a computer program product are provided for aligning embeddings of multiple languages and domains into a shared embedding space by transforming monolingual embeddings into a multilingual embeddings in a first shared embedding space using a cross-lingual learning process, and then transforming the multilingual embeddings into cross-domain, multilingual embeddings in a second shared embedding space using a cross-domain learning process.

Method and system for language and domain acceleration with embedding alignment

In an approach for training customer service agents using persona-based chatbots, a processor retrieves customer service interaction information. A processor analyzes, using natural language processing, the customer service interaction information, wherein the analyzing includes preprocessing and aggregating the customer service interaction information. A processor interacts with a user. A processor provides feedback to the user, based on the user's style and performance during training.

Customer care training with situational feedback generation

A method for log data sampling is disclosed. The method includes receiving logs of a computer system. A log comprises information regarding an operation of the computer system. The method also includes determining a sample of the logs by applying a set of sampling methods to the logs. The method further includes providing the sample of the logs as an input to an anomaly detection model for the computer system. The anomaly detection model identifies a fault in the operation of the computer system based on the input.

Data selection and sampling system for log parsing and anomaly detection in cloud microservices

Mechanisms are provided to implement a brand personality inference engine. The mechanisms receive crowdsource information and extract features associated with a brand from the crowdsource information. The crowdsource information comprises natural language content submitted by a plurality of providers to a crowdsource information source. The mechanisms analyze features associated with the brand in accordance with a brand personality model configured to predict a brand personality for the brand based on the features associated with the brand. The mechanisms generate an inferred brand personality data structure, representing a perceived brand personality of providers providing the crowdsource information, and output an output indicating aspects of the perceived brand personality based on the inferred brand personality data structure.

Brand personality inference and recommendation system

Aspects of the disclosure provide for a method. In at least some examples, the method includes receiving logs of a computer system, wherein a log comprises information regarding an operation of the computer system. The method also includes performing a course analysis of the logs to identify invariants, parameters, and gray area terms included in the logs, wherein gray area terms are terms included in the logs that are undefined between identifications of invariant or parameter by the course analysis. The method also includes performing a fine analysis to identify each of the gray area terms as either an invariant or a parameter to generate first log parsing templates, wherein the fine analysis is a sequence labeling analysis. The method also includes performing a similarity analysis to combine similar templates from among the first log parsing templates to form second log templates.

Log parsing template generation

A method, system and a computer program product are provided for generating a natural language model that is substantially independent of languages and domains by transforming monolingual embeddings into a multilingual embeddings in a first shared embedding space using a cross-lingual learning process, and then transforming the multilingual embeddings into cross-domain, multilingual embeddings in a second shared embedding space using a cross-domain learning process, where the multilingual embeddings and/or cross-domain, multilingual embeddings are evaluated to measure a degree to which the embeddings associate a set of target concepts with a set of attribute words.

Growing community of inventors

San Jose, CA, United States of America

Anbang Xu