International Business Machines Corporation

Luke Taher

David Griffin

Vinh Tuan Thai

Matthew Richard James Thornhill

Ian Manning

Jack Richard Buggins

Jorge Alberto Diaz Garcia

Kilian David Joseph Collender

Charles John Scates

Keith Jeremy Posner

Matthew Richard James Thornhil

Diogo Alexandre Ferreira Ramos

Mark O'Riordan

Matthew R J Thornhill

Madeleine Frost

Paul Barry

Embodiments are disclosed for a method. The method includes, for each of multiple vertices, generating a vertex weighting representative of a relative importance of a vertex within the network topology. The method also includes, for each of the one or more edges, generating an edge weighting representative of a relative importance of an edge within the network topology. Further, the method includes generating the abstract graph of the network topology based on a plurality of vertex weightings and one or more edge weightings.

Network topology monitoring

An approach for training a recurrent neural network to create a model for anomaly detection in the topology of a network is disclosed. The approach comprises, creating an embedding vector for each resource in the network based on applying an embedding algorithm to each resource of the network. A feature vector is then created for each change to a resource in the network based on one or more properties of the change. A recurrent neural network can thus be trained with the embedding vectors and the feature vectors to create a model for anomaly detection in the topology of the network.

Anomaly detection in network topology

Method and system are provided for user authentication using original and modified images. The method includes receiving an original image for a user, where the original image is a private image that meets certain configured criteria. The method uses a pre-trained Convolutional Neural Network (CNN) model to extract one or more image features of the original image and feeds the extracted image feature into a Generative Adversarial Network (GAN) image generator to realistically modify the extracted image feature to generate a modified image. The method authenticates a user based on recognition of a presented original image or a presented modified image.

User authentication using original and modified images

A computer-implemented method for generation of dashboard templates for operations management is disclosed. The computer-implemented method includes monitoring a user interactions with an editable dashboard user interface when handling issue instances to gather chart selections, wherein a chart is a graphical visualization of one or more parameters of a data source. The computer-implemented method further includes identifying an issue type to chart pairs from the gathered chart selections and, for each pair, generalizing the one or more data source parameters. The computer-implemented method further includes identifying from the gathered chart selections common associations between the issue type and a chart visualization type. The computer-implemented method further includes storing dashboard information for an issue type including one or more likely chart visualization types for one or more generalized data source parameters, wherein the dashboard information is available to generate a dashboard template for a new issue instance of the issue type.

Generation of dashboard templates for operations management

Scalable mining method, computer system and computer program product for temporally correlated events that works with input data that is non-transactional in nature and detects high correlation relationships between events with low support thresholds. The scalable mining method manages a large scale of input data by executing the mining process in a distributed manner in a clustered cloud environment via nodes.

Method for scalable mining of temporally correlated events

A method for dynamically generating an optimized processing pipeline for tasks is provided. The method identifies one or more tasks to be executed from defined tasks that are defined declaratively as a number of stages of input data, data transformations, and output data. The method processes the identified tasks to determine dependencies between the tasks based on their defined stages and creates one or more optimized data processing pipelines by performing a dependency resolution procedure on stages of all tasks in parallel using the task dependencies to determine the order of the stages and removing duplication of stages between tasks.

Dynamically generating an optimized processing pipeline for tasks

A method, a computer program product, and a computer system co-assign operators to service an incident with a first operator educating a second operator of skills used in servicing the incident. The method includes determining a type of incident and determining a command group used for the type of incident according to a first mapping based on historical resolutions of historical incidents. The method includes determining the first operator for co-assignment according to a second mapping based on successful historical resolutions of historical incidents by the first operator. The method includes determining the second operator for the co-assignment according to the second mapping that further maps the command group and the second operator based on a lack of experience in using the command group. The method includes co-assigning the incident to the first operator and the second operator.

Training operators through co-assignment

Runbook deployment based on confidence evaluation. Obtaining a runbook based on commands, where the commands relate to resolving an incident and determining an aggregated skill level of operators for the runbook based on historical resolutions of incidents by the operators. A confidence measure of the runbook is determined according to the aggregated skill level for the runbook. Deployment of the runbook is performed in accordance with the confidence measure.

Runbook deployment based on confidence evaluation

Method and system are provided for identifying problem graphs in an information technology infrastructure network. The method includes: selecting a set of nodes in a topology, wherein the nodes of the topology represent resources in an information technology infrastructure network; querying historical timeseries data for the selected nodes, wherein the timeseries data records changes in state of the resources represented by the nodes; and analyzing the timeseries data for the selected nodes across problem time periods to produce a set of historical directional rules defining one or more historic problem graph. The method may search the historic problem graphs for current problem state nodes to determine likely causing nodes and affected nodes of a current problem.

Identifying problem graphs in an information technology infrastructure network

Topology information including a plurality of snapshots of a network topology associated with respective points in time for a network can be received by an apparatus. Each snapshot is represented as a graph of nodes each corresponding to a network resource and having a node identifier. The graph for each snapshot is modified by replacing nodes representing network resources having the same role in the network with a single aggregated node. Feature learning is performed based on the modified graphs representing the plurality of snapshots, and determines a feature representation for each node in the modified graphs. An identifier for each node in the plurality of snapshots is associated with the corresponding feature representation for use in the correlation of network resources. Node identifiers for nodes in the same aggregated node in a modified graph are associated with the same feature representation.

Generalized correlation of network resources and associated data records in dynamic network environments

Generation, by machine logic, of runbooks for problem events. Generation of runbooks including the following operations: receiving operator commands in a command line interface for an event group relating to an issue, wherein the operator commands resolve the issue; and storing the operator commands as related artifacts of the event group with mapping to affected resources. The method may match arguments of the operator commands to event metadata fields of events in the event group to generalize the arguments to the event metadata and to generate a runbook of generalized operator commands for future instances of an event group of a similar type.

Generating runbooks for problem events

A method, a computer program product, and a computer system assign an operator to service an incident. The method includes determining a type of incident. The method includes determining a command group based on the type of incident according to a first mapping. The first mapping is indicative of a mapping between the command group and the type of incident based on historical resolutions of historical incidents. The command group includes at least one command used in resolving the type of incident for a historical incident. The method includes determining an operator who has used the command group according to a second mapping. The second mapping is indicative of a mapping between the command group and the operator based on historical resolutions of historical incidents. The operator has used at least one command in the command group. The method includes assigning the operator to the incident.

Growing community of inventors

Heswall, United Kingdom

Luke Taher