Generating recommendations for network incident resolution

Abstract

Cause and remediation data from one or more prior network incidents can be identified using a determined global similarity between these prior incidents and a current incident. Various network data can be collected, and data determined to potentially be relevant to a current incident can be selected or clustered into a single document or file. This document can have relevant features extracted, which can be used to generate a smaller numerical representation, or fingerprint, of the current incident. This fingerprint may be broken down into three categories of incident data, as may include general, topology, and alert categories. These categories of data can be compared for a current network incident and one or more prior incidents using their respective fingerprints, such as by using cosine similarity determinations. These values can be combined into global similarity values, which can be used to identify similar incidents as well as to provide visualization.