International Business Machines Corporation

Harshit Kumar

Ajay Gupta

Pooja Aggarwal

Sachindra Joshi

Anbang Xu

Arvind Agarwal

Amar Prakash Azad

Seema Nagar

Ruchi Mahindru

Larisa Shwartz

Amitkumar Manoharrao Paradkar

Balaji Viswanathan

Gargi Banerjee Dasgupta

Raghav Batta

Mudit Verma

Seep Goel

Xiaotong Liu

Prateeti Mohapatra

Lu An

Sahil Bansal

Nikhil Verma

Vijay Ekambaram

David Nahamoo

Jinho Hwang

Krishnasuri Narayanam

Amith Singhee

Ashok Pon Kumar Sree Prakash

Michael Elton Nidd

Alberto Giammaria

Danish Contractor

Jitendra Ajmera

Pritam S Gundecha

Ian Manning

Rohan R Arora

Jakub Krchák

Matthew Richard James Thornhill

Sumanta Mukherjee

Suranjana Samanta

Eyal Shnarch

Kavya Govindarajan

Surya Shravan Kumar Sajja

Stephen James Hussey

Akhil Tandon

Hau-Wen Chang

Pranjal Gupta

Franco Forti

Karan Bhukar

A computer-implemented method, according to one approach, includes: receiving one or more streams of system log information from one or more microservices, and comparing the received system log information to compressed templates. One or more blocks of the system log information that correspond to one or more of the compressed templates are identified. All static text is removed from the identified blocks. Moreover, runtime variables from the identified blocks are inserted into respective ones of the compressed templates. The streams of system log information are further updated by replacing the identified blocks with the compressed templates having the runtime variables therein.

Lossless compression of system log information

A computer-implemented method, according to one approach, includes: receiving observability data produced by a first portion of a distributed application. The observability data is evaluated and in response to determining that the observability data indicates the first portion of the distributed application is degraded, the amount of the observability data produced by the first portion of the distributed application is increased. Additionally, the amount of observability data produced by other portions of the distributed application that are correlated with the first portion of the distributed application is also increased.

Dynamically adjusting observability based on real-time performance

Techniques are provided for dynamic alert suppression policy management. In one embodiment, the techniques involve receiving an event stream, wherein the event stream includes metric values comprising at least one of: log anomaly data and metric anomaly data, determining an anomalous event based on the event stream, determining a persistent region of the anomalous event, determining a quantum representation of the persistent region, determining X-Y values of the persistent region based on the quantum representation, and generating a policy based on a set of the X-Y values.

Dynamic alert suppression policy management

Methods, systems, and computer program products for mining multi-party collaboration platforms to create triaging trees and playbooks are provided herein. A computer-implemented method includes obtaining, from a multi-user platform, conversations related to at least one technical issue; generating a plurality of triaging trees by analyzing the conversations, wherein each of the triaging trees stores information corresponding to temporal sequences of steps related to diagnosing and resolving said at least one technical issue; and deriving a playbook for resolving said at least one technical issue at least in part by combining two or more of the plurality of triaging trees.

Mining multi-party collaboration platforms to create triaging trees and playbooks

Identifying an log anomaly resolution by generating a knowledge base linking each of a plurality of incidents with historical anomalous log lines, calculating a resolution specificity score for each knowledge base record, identifying a run-time anomalous log line using the knowledge base, predicting a category for the run-time anomalous log line, identifying resolutions according to the category, ranking the resolutions according to the resolution specificity scores, and recommending a resolution according to the ranking.

Identifying log anomaly resolution from anomalous system logs

One or more computer processors classify each log line in a plurality of unlabeled log lines as an erroneous log line or a non-erroneous log line. The one or more computer processors templatize each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines. The one or more computer processors cluster erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters. The one or more computer processors eliminate the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold. The one or more computer processors train a log anomaly model utilizing=remaining erroneous log template clusters and remaining non-erroneous log template clusters. The one or more computer processors identify a subsequent log line as anomalous or non-anomalous utilizing the trained log anomaly model.

Unlabeled log anomaly continuous learning

A computer-implemented method gathers a set of previously filed applications, performs intent identification on the set, clusters applications in the set based on identified common intents, receives input from user and identifying intent of the input, matches the input to a cluster based on a common intent, and generates a new application based on the input using filed applications in a cluster having a common intent between the cluster and the input.

Automatical process application generation

Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.

Severity computation of anomalies in information technology operations

Methods, systems, and computer program products for data filtering with fuzzy attribute association are provided herein. A computer-implemented method includes obtaining one or more rules, specified by an expert, that define a partial ranking of a plurality of fuzzy pairings between (i) a plurality of item attributes for items in a data catalog and (ii) a plurality of user attributes related to said items; generating an interactive session with the expert to resolve one or more ambiguities in the one or more rules; and deriving a scoring function based at least in part on (i) the one or more rules and (ii) the resolved one or more ambiguities, wherein the scoring function generates a comparative score between any two items of said data catalog for a given one of the users associated with the plurality of attributes.

Data filtering with fuzzy attribute association

In an approach to risk prediction for bug-introducing changes, a computer retrieves one or more historic pull requests. A computer determines a unique file linking for each file included in the historic pull requests. A computer generates a file risk dataset. A computer performs chronological partitioning on the file risk dataset. A computer determines bug-introducing changes in the file risk dataset. A computer computes a collaborative file association between two or more of the files in the file risk dataset. A computer labels each of the files in the file risk dataset with an associated risk of introducing a bug. A computer generates a labelled file risk inducing ground truth dataset. A computer inputs the labelled file risk inducing ground truth dataset to a file risk prediction model. A computer extracts pull request features from the historic pull requests. A computer generates a pull request risk prediction model.

Pull request risk prediction for bug-introducing changes

Methods, systems, and computer program products for generating dialog system workspaces are provided herein. A computer-implemented method includes obtaining (i) a set of policy documents and (ii) a set of initial questions; identifying at least one of the policy documents in the set of policy documents that is relevant to answering a given one of the initial questions in the set of initial questions; generating, based at least in part on an analysis of said identified policy document, (i) at least one follow-up question to said given initial question and (ii) two or more candidate answers to said at least one follow-up question; generating a dialog tree comprising at least (i) a parent node corresponding to the at least one follow-up question and (ii) child nodes corresponding to the two or more candidate answers; translating the dialog tree into a dialog workspace; and deploying the dialog workspace in an intelligent dialog system.

Generating dialog system workspaces

One embodiment provides a method, including: obtaining a plurality of previously submitted application documents, wherein each of the previously submitted application documents comprises information provided by a user who initiated a given previously submitted application document; clustering the plurality of previously submitted application documents into clusters of application documents based upon topics of the previously submitted application documents; selecting a representative application document; identifying entities contained within a given representative application document, wherein each of the entities corresponds to information to be entered into a new application document created from the given representative application document; and engaging in a dialogue with a user to create the new application document utilizing a similar representative application document to request information from the user, wherein the similar representative application document comprises a representative application document of a cluster having a topic similar to a topic of the new application document.

Generation and population of new application document utilizing historical application documents

Methods, computer program products, and/or systems are provided that perform the following operations: in an information technology (IT) management system, grouping one or more ongoing service failure events into a service failure record; identifying a representative event for the service failure record; identifying one or more conversations that relate to the one or more ongoing service events; computing, using a similarity algorithm, feature similarity scores for respective conversations of the one or more conversations based, at least in part, on the features associated with the representative event and features associated with the respective conversations; linking a subset of the one or more conversations to the one or more ongoing service events in the service failure record based, at least in part, on the computed feature similarity scores; and providing the service failure record to a collaboration platform utilized in addressing the one or more ongoing service events.

Discovering insights and/or resolutions from collaborative conversations

A form compliance manager configured to create a policy graph corresponding to an electronic image of an offline form and a corresponding instruction set. The form compliance manager further configured to generate an electronically fillable form corresponding to the offline form and including at least a first context cue for a first field in the electronically fillable form. The first context cue can be based on a subgraph of the policy graph associated with the first field, and the subgraph can include field completion information for the first field, field value information for the first field, and field format information for the first field. The electronically fillable form configured to present the first context cue in response to selection of the first field.

Automated electronic form generation with context cues

A method for simplifying user interactions with decision tree dialog managers is provided. The method may include receiving from a client computer, by a server computer, a user input. The server computer may identify one or more candidate nodes of a decision tree corresponding to the received user input. An entropy value may be calculated by the server computer for each of the identified candidate nodes. The server computer may then select a current node from among the candidate nodes, whereby the selected current node has a lowest calculated entropy value. A prompt associated with the selected current node may be transmitted to the user by the server computer.

Simplifying user interactions with decision tree dialog managers

Growing community of inventors

Delhi, India

Harshit Kumar