International Business Machines Corporation

Xiaotong Liu

Anbang Xu

Rama Kalyani T Akkiraju

Harshit Kumar

Zhe Liu

Lu An

Yingbei Tong

Seema Nagar

Jalal U Mahmud

Vibha Singhal Sinha

Pooja Aggarwal

Pritam S Gundecha

Atri Mandal

Salil Ahuja

Neil Boyette

Prateeti Mohapatra

Amita Misra

Shirley M Han

Sahil Bansal

Akhil Tandon

Hau-Wen Chang

Jiayun Zhao

An-Jie Andy Tu

Pujitha Kara

An approach is disclosed that retrieves a set of current system data corresponding to a computer system and a set of current outputs from an anomaly detection model that is monitoring the computer system. The current system data and the anomaly detection model outputs are input to a trained anomaly detection supervisor model. The trained anomaly detection supervisor model processes the inputs and provides a set of performance data corresponding to the anomaly detection model. The anomaly detection model is then adjusted when the set of performance data indicates that the anomaly detection model is performing below a threshold.

Performance monitoring in the anomaly detection domain for the IT environment

A computer-implemented method, a computer program product, and a computer system for log anomaly detection. A computer receives a windowed log of incoming raw log messages. A computer compares statistical distribution metrics of entities in the windowed log with a statistical distribution extracted from a real-time statistical model for the entities. In response to the statistical distribution metrics being statistically different from the statistical distribution extracted from the real-time statistical model for the entities, a computer tags the windowed log as an entity anomaly. A computer computes a distance between an average word embedding vector in the windowed log and a statistical distribution extracted form a real-time statistical model for word embeddings. In response to the distance being greater than a predetermined threshold, a computer tags the windowed log as a word embedding anomaly. A computer sends to a user an alert with an anomaly severity level.

Log anomaly detection in continuous artificial intelligence for it operations

One or more computer processors classify each log line in a plurality of unlabeled log lines as an erroneous log line or a non-erroneous log line. The one or more computer processors templatize each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines. The one or more computer processors cluster erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters. The one or more computer processors eliminate the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold. The one or more computer processors train a log anomaly model utilizing=remaining erroneous log template clusters and remaining non-erroneous log template clusters. The one or more computer processors identify a subsequent log line as anomalous or non-anomalous utilizing the trained log anomaly model.

Unlabeled log anomaly continuous learning

Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.

Severity computation of anomalies in information technology operations

A method, system, and a computer program product automatically select training data for updating a model by applying human-annotated training data to a model to generate results that are evaluated to identify correct case results and false case results that are categorized into error type categories for use in building error models corresponding to the error type categories, where each error model is built from at least failed case results belonging to a corresponding error type, and where unlabeled data samples are applied to each error model to compute an error likelihood for each unlabeled data sample with respect to each error type category, thereby enabling the selection and display of unlabeled data samples for annotation by a subject matter expert based on a computed error likelihood for the one or more unlabeled data samples in a specified error type category meeting or exceeding an error threshold requirement.

Method and system for unlabeled data selection using failed case analysis

A method, system and a computer program product are provided for aligning embeddings of multiple languages and domains into a shared embedding space by transforming monolingual embeddings into a multilingual embeddings in a first shared embedding space using a cross-lingual learning process, and then transforming the multilingual embeddings into cross-domain, multilingual embeddings in a second shared embedding space using a cross-domain learning process.

Method and system for language and domain acceleration with embedding alignment

A method for log data sampling is disclosed. The method includes receiving logs of a computer system. A log comprises information regarding an operation of the computer system. The method also includes determining a sample of the logs by applying a set of sampling methods to the logs. The method further includes providing the sample of the logs as an input to an anomaly detection model for the computer system. The anomaly detection model identifies a fault in the operation of the computer system based on the input.

Data selection and sampling system for log parsing and anomaly detection in cloud microservices

Aspects of the disclosure provide for a method. In at least some examples, the method includes receiving logs of a computer system, wherein a log comprises information regarding an operation of the computer system. The method also includes performing a course analysis of the logs to identify invariants, parameters, and gray area terms included in the logs, wherein gray area terms are terms included in the logs that are undefined between identifications of invariant or parameter by the course analysis. The method also includes performing a fine analysis to identify each of the gray area terms as either an invariant or a parameter to generate first log parsing templates, wherein the fine analysis is a sequence labeling analysis. The method also includes performing a similarity analysis to combine similar templates from among the first log parsing templates to form second log templates.

Log parsing template generation

A method, system and a computer program product are provided for generating a natural language model that is substantially independent of languages and domains by transforming monolingual embeddings into a multilingual embeddings in a first shared embedding space using a cross-lingual learning process, and then transforming the multilingual embeddings into cross-domain, multilingual embeddings in a second shared embedding space using a cross-domain learning process, where the multilingual embeddings and/or cross-domain, multilingual embeddings are evaluated to measure a degree to which the embeddings associate a set of target concepts with a set of attribute words.

Method and system for language and domain acceleration with embedding evaluation

A method, a computer program product, and an information handling system is provided for reducing cost and improving real-time performance for analyzing and representing customer care communication progression based on tone assessments by monitoring communications between a plurality of customers and a plurality of representatives to form a plurality of interaction histories. Analyzing a text form of the plurality of interaction histories according to a Tone Latent Dirichlet Allocation [T-LDA] model to determine a plurality of conversation tones. Mapping the plurality of conversation tones to a plurality of conversation phases and providing a representation of the conversation tones identifying a first customer tone at a first conversation phase and a second customer tone at a second conversation phase.

Growing community of inventors

San Jose, CA, United States of America

Xiaotong Liu