International Business Machines Corporation

Ian Manning

Vinh Tuan Thai

Jonathan Ian Settle

Anthony T Brew

Eric Thiebaut-George

Luke Taher

Matthew Richard James Thornhill

Jack Richard Buggins

Seema Nagar

Ruchi Mahindru

Paul Basil French

Amitkumar Manoharrao Paradkar

Pooja Aggarwal

Donagh S Horgan

Harshit Kumar

Rohan R Arora

Paul M J Barry

Paul M Barry

Stephen James Hussey

Natalia Udaltsova

Franco Forti

Karan Bhukar

Cormac Cummins

Techniques are provided for dynamic alert suppression policy management. In one embodiment, the techniques involve receiving an event stream, wherein the event stream includes metric values comprising at least one of: log anomaly data and metric anomaly data, determining an anomalous event based on the event stream, determining a persistent region of the anomalous event, determining a quantum representation of the persistent region, determining X-Y values of the persistent region based on the quantum representation, and generating a policy based on a set of the X-Y values.

Dynamic alert suppression policy management

An approach for training a recurrent neural network to create a model for anomaly detection in the topology of a network is disclosed. The approach comprises, creating an embedding vector for each resource in the network based on applying an embedding algorithm to each resource of the network. A feature vector is then created for each change to a resource in the network based on one or more properties of the change. A recurrent neural network can thus be trained with the embedding vectors and the feature vectors to create a model for anomaly detection in the topology of the network.

Anomaly detection in network topology

Topology information including a plurality of snapshots of a network topology associated with respective points in time for a network can be received by an apparatus. Each snapshot is represented as a graph of nodes each corresponding to a network resource and having a node identifier. The graph for each snapshot is modified by replacing nodes representing network resources having the same role in the network with a single aggregated node. Feature learning is performed based on the modified graphs representing the plurality of snapshots, and determines a feature representation for each node in the modified graphs. An identifier for each node in the plurality of snapshots is associated with the corresponding feature representation for use in the correlation of network resources. Node identifiers for nodes in the same aggregated node in a modified graph are associated with the same feature representation.

Generalized correlation of network resources and associated data records in dynamic network environments

Aspects of the present invention disclose a method for automated incident prioritization in network monitoring systems. The method includes one or more processors determining historical sentiment impact scores for one or more incident parameters based at least in part on textual content of customer feedback and changes of a customer sentiment during a time period corresponding to one or more system incidents of the time period. The method further includes assigning a classification to the one or more system incidents, wherein the classification corresponds to the one or more incident parameters. The method further includes determining an active incident sentiment impact score for each of one or more active incidents. The method further includes applying the active incident sentiment impact scores as a factor to prioritize incident handling of the one or more active incidents.

Automated incident prioritization in network monitoring systems

A method and system are provided for retraining an analytic model. The method includes building, by a processor, a Markov chain for the analytic model. The Markov chain has only two states that consist of an alarm state and a no alarm state. The method further includes updating, by the processor, the Markov chain with observed states, for each of a plurality of timestamps evaluated during a burn-in period. The method also includes updating, by the processor, state transition probabilities within the Markov chain, for each of a plurality of timestamps evaluated after the burn-in period. The method additionally includes generating, by the processor, a signal for causing the model to be retrained, responsive to any of the state transition probabilities representing a probability of greater than 0.5 of seeing the alarm state in a previous interval and again in a current interval.

Optimized re-training for analytic models

Mechanisms for anomaly detection in a network management system are provided. The mechanisms collect metric data from a plurality of network devices and determine metric types for the metric data using metric type reference data. The mechanisms determine and apply properties from the metric type reference data to metrics of the determined metric types. The mechanisms monitor subsequent metric data for anomalies that do not conform to the applied properties.

Network anomaly detection

Deploying a model for anomaly detection in time series data. A period of data is received. A model of the period of data is received. It is determined that the model fits a part of the period of data and that the fitted part of the period of data includes the most recent data. A reduced model for the part of the period of data that fit the received model is built. The reduced model is deployed.

Anomaly detection model selection and validity for time series data

Method for monitoring data events using calendars are provided. Aspects include accessing a plurality of calendars, each calendar defining a schedule of calendar days and receiving a plurality of inputs from one or more applications, each input defining a data event for a specific source, for each calendar of the plurality of calendars. Aspects also include maintaining, for each data event source, a count for each calendar day and a count for each non-calendar day, for each calendar of the plurality of calendars. Aspects further include determining, for each data event source, if a comparison of the count for each calendar day and the count for each non-calendar day is statistically significant, and generating an output for a data event source, if the comparison of the count for each calendar day and the count for each non-calendar day is statistically significant.

Monitoring data events using calendars

A computer-implemented method of analyzing a plurality of metrics associated with one or more real-time streams of time-series data. For each metric, a set of time-series data for an interval of time is received, and one or more feature values determined from data of the stream prior to the interval of time are retrieved. One or more updated feature values are determined using the one or more retrieved feature values and the received set of time-series data, and the one or more updated feature values are stored in the store. The values of the metrics are then determined from the updated feature values, the plurality of metrics are then analyzed, for example to perform anomaly detection.

Growing community of inventors

Cork, Ireland

Ian Manning