Servicenow, Inc.

James Crotinger

Kanwaldeep Kaur Dang

Brian Robert Silverstein

Dariush Shahgoshtasbi

Chinna Babu Polinati

Stephen Scott Tucker

Scott Tucker

Purushottam Amradkhar

Dustin Lennon

Purushottam Shridhar Amradkar

Qingbin Li

Eugen Ardeleanu

Darren Hou

Yujie Fang

Sachin Gupta

Origin text content to be analyzed using natural language processing is received. The received origin text content is preprocessed using one or more processors including by vectorizing at least a portion of the received origin text content and identifying a closest matching centroid to automatically generate a reduced version of the origin text content to assist in satisfying a constraint of a natural language processing model. The reduced version of the origin text content is used as an input to the natural language processing model. A result of the natural language processing model is provided for use in managing a computerized workflow.

Labeled clustering preprocessing for natural language processing

Origin text content to be analyzed using natural language processing is received. A two-dimensional item sequence representation for at least a portion of the received origin text content is generated. Using one or more processors, one or more evaluation metrics are determined based on an analysis of the two-dimensional item sequence representation. A reduced version of the origin text content is automatically generated based on the one or more evaluation metrics to assist in satisfying a constraint of a natural language processing model. The reduced version of the origin text content is used as an input to the natural language processing model.

Multi-dimensional N-gram preprocessing for natural language processing

A system, includes: a distributed cache that stores state information for a plurality of configuration items (CIs). Management, instrumentation, and discovery (MID) servers form a cluster, each of the MID servers including one or more processors that receive, from the distributed cache, a subset of the state information associated with assigned CIs and perform a statistical analysis on the subset of the state information.

Systems and methods for robust anomaly detection

A computing device is provided that is configured to obtain, from a managed network, a plurality of response times of a network-based service provided by the managed network; to train, based on the plurality of response times, a probability distribution to model the managed network; to receive an additional response time from the managed network; to use the probability distribution to determine, for the additional response time, a percentile based on the additional response time; based on the percentile, to determine that the additional response time is anomalously high with respect to the plurality of response times of the network-based service; and to transmit, to a client device associated with the managed network, an indication that the additional response time is anomalously high. The probability distribution includes a central portion based on a plurality of bins and a tail portion based on a parametric distribution.

Hybrid anomaly detection for response-time-based events in a managed network

An anomaly detection module may include a time-series analyzer that classifies current time-series data into at least one of a plurality of classifications based upon historical data and may construct a statistical model representative of the current time-series data based upon the at least one of the plurality of classifications. An anomaly detector monitors a stream of the current time-series data and identifies statistical outliers of the stream of the current time-series data, based upon the statistical model and may determine an anomalous score for the statistical outliers by tracking a history of the statistical outliers; wherein the anomalous score comprises a representation of a magnitude of deviation between the current time-series data and the statistical model over multiple measurements of the current time-series data, over a particular time interval, or both.

Systems and methods for anomaly detection

An apparatus for grouping alerts generated by automated monitoring of at least an operating condition of a machine, represented as a configuration item in a configuration management database, in a computer network. A first event pattern is identified based on configuration items associated with an alert avalanche identified from received historical alert data stored in memory. A second event pattern is identified based on co-occurrences of configuration item pairs in the historical alert data and on at least one conditional probability parameter. At least one alert group is determined by comparing at least one configuration item associated with a current alert to the plurality of configuration items of the first event pattern and of the second event pattern stored in memory. A graphical display region for displaying the alert group is generated.

Growing community of inventors

Kirkland, WA, United States of America

James Crotinger