Microsoft Technology Licensing, LLC

Navendu Jain

Rahul Potharaju

Ishai Menache

Luhui Hu

Vitaly Voloshin

Mingshi Wang

Liyuan Zhang

James R Larus

Rajeev Dubey

Joseph K W Chan

Ang Chen

Christian L Belady

Kris Kuppuswamy Ganjam

Danny Allen Reed

Christian Herwarth Borgs

Rachel Lemberg

Jennifer Tour Chayes

Gal Tamir

Zakie Mashiah

Adam James Betz

Tamar Agmon

Ilan Lobel

F Bruce Shepherd

Joseph (Seffi) Naor

Huy P M Dao

Hamid Nazerzadeh

Shane Hu

Albert Gordon Greenberg

Ryen William White

Sudipta Sengupta

Parveen Kumar Patel

Aman Kansal

David A Maltz

Jessica Lundin

Roman Batoukov

Changhoon Kim

Charles Joseph Williams

Keiji Kanazawa

Parantap Lahiri

Sai Sankalp Arrabolu

John Anthony Morman

Thomas William Potthast, Iii

Anastasiia Pronska

Hrishikesh Devadatta Kulkarni

Irina Frumkin

Ohad Shamir

Jason Michael Deakins

Alia Maisel Buckner

Russell Joseph Trupiano

Bill A Haase

Mei Liang

Wei Luo

Lingzhi Sun

Vivek Jain

David Douglas DeBarr

Rui Miao

Joseph Kw Chan

Laura M Cruz

Niv Buchbinder

Gae-won You

Hua He

Dan Reed

C J Williams

Joseph KW Chan

Gae-Won You

Techniques are described herein that are capable of generating a mitigation workflow for a computing service using historical mitigation workflows. A determination is made that a historical technical issue that was encountered by a first computing service corresponds to a current technical issue that is encountered by a second computing service. A workflow, which is configured to mitigate the current technical issue, is generated to include historical mitigation operations that are included in historical mitigation workflows that were performed to mitigate the historical technical issue based at least in part on the historical technical issue corresponding to the current technical issue.

Generating a mitigation workflow for mitigating a technical issue of a computing service using historical mitigation workflows

Operational metrics of a distributed collection of servers in a cloud environment are analyzed by a service to intelligently machine learn which operational metric is highly correlated to incidents or failures in the cloud environment. To do so, metric values of the operational metrics are analyzed over time by the service to check whether the operation metrics exceed a particular metric threshold. If so, the service also checks whether such spikes in the operation metric above the metric thresholds occurred during known cloud incidents. Statistics are calculated reflecting the number of times the operational metrics spiked during times of cloud incidents and spiked during times without cloud incidents. Correlation scores based on these statistics are calculated and used to select the correlated operational metrics that are most correlated to cloud failures.

IT monitoring recommendation service

A hierarchical network analytics system operated by a computing device or system is described. In some example techniques, the analytics system may determine results of a plurality of first level analyses each based at least in part on results of a respective plurality of data queries that return respective subsets of a plurality of types of network data. The analytics system may determine a result of a second level analysis based at least in part on results of the plurality of first level analyses.

Hierarchical network analysis service

Examples described herein generally relate to identifying a set of service events corresponding to an incident report, querying a multiple-layer relational graph to determine one or more other service events related to the set of service events, detecting a pattern in the set of service events and a subset of the one or more other service events, and indicating, via a user interface and based on the incident report, the subset of the one or more other service events as related to the incident report.

Techniques for correlating service events in computer network diagnostics

Described herein are various technologies pertaining to providing assistance to an operator in a data center with respect to failures in the data center. An alarm is received, and a failing device is identified based upon content of the alarm. Failure conditions of the alarm are mapped to a failure symptom that may be exhibited by the failing device, and troubleshooting options previously employed to mitigate the failure symptom are retrieved from historical data. Labels are respectively assigned to the troubleshooting options, where a label is indicative of a probability that a troubleshooting option to which the label has been assigned will mitigate the failure symptom.

Identifying troubleshooting options for resolving network failures

Methods for automatic and intelligent incident routing are performed by systems and apparatuses. The methods intelligently optimize routing of incidents to correct owners from a pool of many possible owners by utilizing learning models and algorithms based on feature vectors. Users provide information related to incidents of services or systems. The information is cleaned and featurized to generate a feature vector for the incident. The systems and apparatuses intelligently and automatically determine sets of candidate recipients based on outputs of algorithms, e.g., machine learning algorithms, such as classifiers using the feature vectors as inputs. Classifiers may utilize models or algorithms trained with featurizations used for feature vectors. Sets of candidate recipients are provided to users for selection of a recipient for the information from the set of candidate recipients instead of from all the possible recipients. Methods for intelligent bug and feedback routing are also performed by systems and apparatuses.

System and method for intelligent incident routing

Computing systems for efficient incident management in large scale computer systems are described herein. In one embodiment, an incident management system can be configured to, in response to receiving a user input requesting an unidentified incident management service, convert an alphanumerical string of the user input into a pixelated matrix having multiple pixels individually corresponding to a character or number in the alphanumerical string. The incident management system can then feed the converted pixelated matrix into a neural network to identify one or more incident management services corresponding to the received user input with a corresponding probability value. The incident management system can then perform an application programming interface (API) call to execute a computer application to provide one of the identified incident management services to the user.

Efficient incident management in large scale computer systems

Methods, systems, and computer program products are provided for generating an actionability measure for events occurring in a computing environment. A data retriever is configured to receive, in an event management system, an event indication generated in the computing environment regarding an event. In implementations, the event indication includes characteristics relating to the generation of the event. An actionability measure generator is configured to analyze the characteristics relating to the generation of the event. The actionability measure generator generates an actionability measure for the event indication based at least on the analysis of the characteristics, where the actionability measure defines an action level for the event indication. An automated action executor executes an action in the event management system for changing a state of the event indication that is dependent on the generated actionability measure.

Actionability metric generation for events

Embodiments relate to detecting and mitigating network intrusions. Packets are inspected at their source/destination hosts to identify packet trends local to the hosts. The local packet trends are combined to identify network-wide packet trends. The network-wide packet trends are used to detect anomalies or attacks, which in turn informs mitigation actions. The local inspection may be performed by reconfigurable/reprogrammable 'smart' network interfaces (NICs) at each of the hosts. Local inspection involves identifying potentially suspect packet features based on statistical prevalence of recurring commonalities among the packets; pre-defined threat patterns are not required. For network-wide coherence, each host/NIC uses the same packet-identifying and occurrence-measuring algorithms. An overlay or control server collects and combines the local occurrence-measures to derive the network-wide occurrence-measures. The network-wide occurrences can be used to automatically detect and mitigate completely new types of attack packets.

Hybrid hardware-software distributed threat analysis

A system and method is provided for generating a dynamic comprehensive domain review. A domain review engine obtains authoritative literature associated with a domain to extract insights using entity recognition and relationship extraction, and ranks the extracted results to generate a dynamic domain review.

Domain review system for identifying entity relationships and corresponding insights

A knowledge base can include a dictionary associated with classes of a model, e.g., an ontology. A text segment that is not found in the dictionary can be received. Feature(s) can be determined for the text segment and, based partly on providing the feature(s) to a classifier, a set of values can be determined. The distribution can include values respectively corresponding to the classes. One of the values can be greater than a predetermined threshold. That value can correspond to a class. An indication identifying the class can be presented via a user interface having functionality to provide input that the text segment is associated with the class, is not associated with the class, or is associated with another class. Based at least partly on adding a new class to the ontology, a precedence table indicating priorities between motifs defining relationships between classes of the ontology can be updated.

Knowledge base for analysis of text

A system for managing allocation of resources based on service level agreements between application owners and cloud operators. Under some service level agreements, the cloud operator may have responsibility for managing allocation of resources to the software application and may manage the allocation such that the software application executes within an agreed performance level. Operating a cloud computing platform according to such a service level agreement may alleviate for the application owners the complexities of managing allocation of resources and may provide greater flexibility to cloud operators in managing their cloud computing platforms.

Resource management for cloud computing platforms

Growing community of inventors

Seattle, WA, United States of America

Navendu Jain