International Business Machines Corporation

Sahil Bansal

Anbang Xu

Harshit Kumar

Lu An

Seema Nagar

Ruchi Mahindru

Gargi Banerjee Dasgupta

Xiaotong Liu

Atul Kumar

Systems, methods and/or computer program products maximizing answer coherence of virtual agents responding to multi-part user queries, using relationships among extracted chunks corresponding to support document(s). Relationships are extracted by mining entities from text and images of support document(s) and mapping entities to an otology. Induced subgraphs for chunks, based on extracted entities are created and compared. Depending on amounts of overlap and/or relationships between subgraphs, relationships among chunks are identified. Chunks relationships can be complementary, contained within one another, instances of one another, or not related at all. For a given multi-part query, a query answer graph is created comprising answer nodes corresponding to potential answer candidates associated with each chunk. Using the edges between nodes and relationships identified between chunks, coherence scores are calculated along answer pathways, whereby answer pathways with the highest coherence score are selected to respond to the query.

Multi-chunk relationship extraction and maximization of query answer coherence

Identifying an log anomaly resolution by generating a knowledge base linking each of a plurality of incidents with historical anomalous log lines, calculating a resolution specificity score for each knowledge base record, identifying a run-time anomalous log line using the knowledge base, predicting a category for the run-time anomalous log line, identifying resolutions according to the category, ranking the resolutions according to the resolution specificity scores, and recommending a resolution according to the ranking.

Identifying log anomaly resolution from anomalous system logs

One or more computer processors classify each log line in a plurality of unlabeled log lines as an erroneous log line or a non-erroneous log line. The one or more computer processors templatize each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines. The one or more computer processors cluster erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters. The one or more computer processors eliminate the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold. The one or more computer processors train a log anomaly model utilizing=remaining erroneous log template clusters and remaining non-erroneous log template clusters. The one or more computer processors identify a subsequent log line as anomalous or non-anomalous utilizing the trained log anomaly model.

Unlabeled log anomaly continuous learning

Growing community of inventors

Kurukshetra, India

Sahil Bansal