International Business Machines Corporation

Michael Elton Nidd

Jinho Hwang

Larisa Shwartz

Dirk Husemann

Srinivasan Parthasarathy

Frank Bagehorn

Qing Wang

Ota Sandr

Altynbek Orumbayev

Bo Yang

Joel W Branch

Suzanne K McIntosh

Metin Feridun

Axel Tanner

Birgit Monika Pfitzmann

Reto Josef Hermann

Jakub Krchák

Michal Mýlek

Marion Lee Blount

Raghav Batta

Iqbal I Mohomed

Ruediger Rissmann

Tomás Ondrej

Maja Vukovic

Jonathan Lenchner

Canturk Isci

Rajarshi Das

George E Stark

Francois Bernard Dolivo

Michael Moser

Michal Mylek

Rhonda L Childress

Li Xiao

Chi Zhang

Alberto Giammaria

Florian Graf

Srinivas Babu Tummalapenta

Kun Bai

Andreas Schade

Stefan Georg Hild

Pritam S Gundecha

Harshit Kumar

Carl Binding

Amar Prakash Azad

Gerhard A Widmayer

Tengfei Ma

Dorothea W Wiesmann

Michael Tacci

Ioana Giurgiu

Jill L Jermyn

Shao Yang Yu

Randall M George

Min Xiang

Michelle Rivers

Jonathan T Waddilove

Rudiger Rissmann

Rodrigo Otavio Castrillon

Hagen Völzer

Alexandre Francisco Da Silva

Tomáš Ondrej

Francois Dolivo

Several aspects are provided for dynamically updating an alert-management system that uses a master ruleset to match alerts in a data processing system with automata for handling the alerts. A method comprises training a machine learning model to correlate the alerts with the automata using a training dataset comprising alerts which were successfully handled by the automata. The machine learning model is then applied to correlate unmatched alerts with the automata, wherein the unmatched alerts were not matched to the automata by the master ruleset. The method further comprises analyzing operation of the machine learning model in relation to correlation of the unmatched alerts to define a new ruleset for matching the unmatched alerts with the automata and outputting the new ruleset for auditing of each rule in the new ruleset. In response to approval of an audited rule, the audited rule is added to the master ruleset.

Alert management in data processing systems

A method, a computer system, and a computer program product for a shiftleft topology construction is provided. Embodiments of the present invention may include collecting datasets. Embodiments of the present invention may include extracting topological entities from the datasets. Embodiments of the present invention may include correlating a plurality of data from the topological entities. Embodiments of the present invention may include mapping the topological entities. Embodiments of the present invention may include marking entry points for a plurality of subgraphs of the topological entities. Embodiments of the present invention may include constructing a topology graph.

Shiftleft topology construction and information augmentation using machine learning

Embodiments of the present invention provide methods, computer program products, and systems. Embodiments of the present invention can dynamically determine one or more endpoints to fulfill a user request. Embodiments of the present invention can select the dynamically determined one or more endpoints as the one or more endpoints that fulfill the user request. Embodiments of the present invention can execute the selected one or more endpoints to fulfill the user request.

Just in time assembly of transactions

A method, a computer system, and a computer program product for security risk analysis is provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.

Shift-left security risk analysis

Techniques that facilitate feedback loop learning between artificial intelligence systems are provided. In one example, a system includes a monitoring component and a machine learning component. The monitoring component identifies a data pattern associated with data for an artificial intelligence system. The machine learning component compares the data pattern to historical data patterns for the artificial intelligence system to facilitate modification of at least a component of the artificial intelligence system and/or one or more dependent systems of the artificial intelligence system.

Feedback loop learning between artificial intelligence systems

A method, a computer system, and a computer program product for mapping operational records to a topology graph. Embodiments of the present invention may include generating an event frequent pattern using operational records. Embodiments of the present invention may include integrating topology-based event frequent patterns. Embodiments of the present invention may include mapping the operational records with an embedding engine. Embodiments of the present invention may include predicting incident events. Embodiments of the present invention may include receiving labeled patterns to the embedding engine for an active learning cycle.

Automatic mapping of records without configuration information

In an approach to risk prediction for bug-introducing changes, a computer retrieves one or more historic pull requests. A computer determines a unique file linking for each file included in the historic pull requests. A computer generates a file risk dataset. A computer performs chronological partitioning on the file risk dataset. A computer determines bug-introducing changes in the file risk dataset. A computer computes a collaborative file association between two or more of the files in the file risk dataset. A computer labels each of the files in the file risk dataset with an associated risk of introducing a bug. A computer generates a labelled file risk inducing ground truth dataset. A computer inputs the labelled file risk inducing ground truth dataset to a file risk prediction model. A computer extracts pull request features from the historic pull requests. A computer generates a pull request risk prediction model.

Pull request risk prediction for bug-introducing changes

In an approach to linking operational data with issues, a new event is received. The new event is associated to a story, where the story is related to an identified problem within the system, and further where the new event is associated with the story using machine learning techniques. The story is associated to related change requests based on a similarity between the story and related change requests, where the similarity between the story and the related change requests is associated using the machine learning techniques. A cost is calculated for the story. Responsive to associating the new event with a specific change request, the priority of the specific change request is updated based on the cost for the story.

Linking operational events with system changes

An approach to recommending corrective action to computing system event errors. The approach may include generating a textual description of an event error. The approach may include transforming the textual description into feature vectors with a domain-specific word embedding module. The approach may also include generating a recommendation to correct the event error based on an analysis of the feature vectors. Additionally, the recommendation may be presented for verification.

Computing system event error corrective action recommendation

A computer implemented method for identifying an application topology includes identifying a sandbox environment corresponding to an application of interest, analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment indicating a first topology, identifying a production system corresponding to the application of interest, querying the production system to identify a set of structural dependencies indicating a second topology, and creating a complete topology of the cloud application by combining the first topology and the second topology. A computer program product and computer system for identifying an application topology are additionally disclosed herein.

Application topology discovery

Various embodiments manage the migration of servers. In one embodiment, a set of server-level dependency information is obtained for servers to be migrated from a source computing environment to a target computing environment. A set of network configuration data is obtained for a plurality of network devices associated with the servers. The set of server-level dependency information is updated to include one or more additional dependencies of at least one of the servers based on the set of network configuration data. Updating the set of server-level dependency information generates an updated set of dependency information. The servers are assigned to multiple migration groups based on the updated set of dependency information. The migration groups optimize cross-group dependencies among the migration groups.

Using network configuration analysis to improve server grouping in migration

Systems, computer-implemented methods, and computer program products to facilitate discovery of an inexplicit link between a change and an incident in a computing environment are provided. According to an embodiment, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components can comprise an analysis component that determines a defined link strength corresponding to links between change data and incident data in a computing environment. The computer executable components further comprise an extraction component that employs a model to identify an inexplicit link between the change data and the incident data based on the defined link strength.

Discovery of an inexplicit link between a change and an incident in a computing environment

Mechanisms are provided for virtualizing physical sensors and providing sensor data to a requestor using the virtualized physical sensors. The mechanisms obtain sensor data from a plurality of physical sensors and storing the sensor data in a virtual sensor storage system of the data processing system in at least one standardized format. A request from a requestor for a first type of sensor data is received which does not specify a particular physical sensor. A portion of the sensor data stored in the virtual sensor storage system is retrieved in response to receiving the request, the portion of sensor data corresponding to the type of sensor data requested in the request from the requestor. The retrieved portion of the sensor data is returned to the requestor in a format corresponding to a physical sensor configured to provide the requested type of sensor data.

Sensor virtualization through cloud storage and retrieval mechanisms

Training a random forest model to relate settings of a network security device to undesirable behavior of the network security device is provided. A determination of a corresponding set of settings associated with each region of lowest incident probability is made using a random forest. The plurality of identified desired settings are presented as options for changing the network security device from the as-is settings to the identified desired settings. A choice is received from the plurality of options. The choice informs the random forest model. The random forest model ranks for a new problematic network security device the plurality of options for changing the new problematic network security device from as-is settings to desired settings by aggregating an identified cost of individual configuration changes, thereby identifying a most cost-effective setting for the network security device to achieve a desired output of the network security device.

Deriving optimal actions from a random forest model

Growing community of inventors

Zurich, Switzerland

Michael Elton Nidd