International Business Machines Corporation

Vinh Tuan Thai

Anthony T Brew

Paul M J Barry

Luke Taher

Ian Manning

Jonathan Ian Settle

Donagh S Horgan

Nathan Cullen

Felix Y Chang

Mark N Wegman

Jack Richard Buggins

Cormac Cummins

Fuguo Huang

Louise K Nestor

Diogo Alexandre Ferreira Ramos

Mark O'Riordan

Scalable mining method, computer system and computer program product for temporally correlated events that works with input data that is non-transactional in nature and detects high correlation relationships between events with low support thresholds. The scalable mining method manages a large scale of input data by executing the mining process in a distributed manner in a clustered cloud environment via nodes.

Method for scalable mining of temporally correlated events

A method for dynamically generating an optimized processing pipeline for tasks is provided. The method identifies one or more tasks to be executed from defined tasks that are defined declaratively as a number of stages of input data, data transformations, and output data. The method processes the identified tasks to determine dependencies between the tasks based on their defined stages and creates one or more optimized data processing pipelines by performing a dependency resolution procedure on stages of all tasks in parallel using the task dependencies to determine the order of the stages and removing duplication of stages between tasks.

Dynamically generating an optimized processing pipeline for tasks

Topology information including a plurality of snapshots of a network topology associated with respective points in time for a network can be received by an apparatus. Each snapshot is represented as a graph of nodes each corresponding to a network resource and having a node identifier. The graph for each snapshot is modified by replacing nodes representing network resources having the same role in the network with a single aggregated node. Feature learning is performed based on the modified graphs representing the plurality of snapshots, and determines a feature representation for each node in the modified graphs. An identifier for each node in the plurality of snapshots is associated with the corresponding feature representation for use in the correlation of network resources. Node identifiers for nodes in the same aggregated node in a modified graph are associated with the same feature representation.

Generalized correlation of network resources and associated data records in dynamic network environments

A method and system are provided for retraining an analytic model. The method includes building, by a processor, a Markov chain for the analytic model. The Markov chain has only two states that consist of an alarm state and a no alarm state. The method further includes updating, by the processor, the Markov chain with observed states, for each of a plurality of timestamps evaluated during a burn-in period. The method also includes updating, by the processor, state transition probabilities within the Markov chain, for each of a plurality of timestamps evaluated after the burn-in period. The method additionally includes generating, by the processor, a signal for causing the model to be retrained, responsive to any of the state transition probabilities representing a probability of greater than 0.5 of seeing the alarm state in a previous interval and again in a current interval.

Optimized re-training for analytic models

In a method for visualizing cyclical patterns in metric data, receiving, by one or more processors, data relating to a computer environment. The method further includes creating, by one or more processors, a visualization, wherein the visualization presents the data in a first format. The method further includes causing, by one or more processors, the visualization to be displayed in a user interface. The method further includes receiving, by one or more processors, an indication of a user interaction in the user interface, wherein the user interaction indicates an alternative visualization of the data, wherein the alternative visualization presents the data in a second format that includes a fragment of the received data. The method further includes creating, by one or more processors, the alternative visualization.

Visualization of cyclical patterns in metric data

A method and system for improving virtual keyboard input is provided. The method includes presenting a GUI comprising a character display portion and a virtual touch screen activated keyboard. The virtual touch screen activated keyboard internally includes currently viewable alphabetical character keys and a free sketch area for entering specialized characters not currently viewable via the virtual keyboard. A selection for an alphabetical character is received via the virtual touch screen activated keyboard and presented via the display portion. A user defined motion sketching a character associated with the specialized characters is detected from a user via the free sketch area. The character is converted into one of the specialized characters and presented to the user.

Virtual keyboard improvement

Deploying a model for anomaly detection in time series data. A period of data is received. A model of the period of data is received. It is determined that the model fits a part of the period of data and that the fitted part of the period of data includes the most recent data. A reduced model for the part of the period of data that fit the received model is built. The reduced model is deployed.

Anomaly detection model selection and validity for time series data

Anomaly detection is provided. A first component of a first data resource of a plurality of data resources is identified. Each data resource of the plurality of data resources includes one or more components. A score of the first component is determined based, at least in part, on underlying data of the first component and underlying data of one or more other components of data resources of the plurality of data resources that correspond to the first component. An interest level of the first data resource is determined. A relationship between the score of the first component and the interest level of the first data resource is modeled.

Data resource anomaly detection

A method of identifying topics which a user requires help with when using a software program is described. For each of a plurality of help documents, the help document is associated with a set of topics and their relative prevalence within the help document. User access to the help documents is tracked during use of the software program. Topics in relation to which help was required during use of the software program are identified based on an amount of access to one or more of the help documents and the relative prevalence of topics within the accessed help documents.

Data processing

A method, computer program product, and system for constructing a dynamic knowledge base of software usage patterns. A user action is monitored to identify one or more user action sequences. A common action sequence for the user action is identified, based on the one or more user action sequences. An instructional information resource is identified that corresponds to the common action resource, wherein the instructional information resource is accessed by the user. A database is constructed based on the common action sequence. The database organizes the common action sequences and instruction information resource. The instructional information resource is determined to be above a threshold based on the number of times the user consults the instructional information resource.

Dynamic construction of knowledge base by usage pattern recognition

Software that generates statistical models of events impacting computer systems and uses those models to detect similar events in the future. The software performs the following operations: (i) receiving a snapshot of a first event impacting a computer system, where the snapshot includes a first set of values for a plurality of metrics occurring over a first time period corresponding to the first event; (ii) extracting a first set of feature vectors from the first set of values; (iii) generating a first statistical model representing the first event based, at least in part, on the extracted first set of feature vectors; and (iv) determining that a second event is similar to the first event by comparing the first statistical model to a second set of values for the plurality of metrics occurring over a second time period corresponding to the second event.

Growing community of inventors

Cork, Ireland

Vinh Tuan Thai