Systems and methods for automated incident response

Patent metadata

Field	Value
Publication number	US-10783453-B2
Application number	US-201715622749-A
Country	US
Kind code	B2
Filing date	Jun 14, 2017
Priority date	Jun 14, 2016
Publication date	Sep 22, 2020
Grant date	Sep 22, 2020

Abstract

Systems and methods for automated incident response are disclosed. In one embodiment, a method for managing response to an incident may include (1) receiving training incident data from a training data source; (2) identifying at plurality of incident-related training keywords in the training data; (3) receiving one of a plurality of tags for each of the plurality of training keywords from a trainer; (4) executing a machine learning process to associate the received tags with the training keywords; (5) receiving incident data related to an incident from an incident data source; (6) identifying a plurality of incident-related keywords in the incident data; (7) automatically tagging the incident-related keyword with one of the plurality of tags; (8) automatically identifying at least one incident pattern from the tags; (9) automatically retrieving a solution for the incident based on similar resolved incidents; and (10) automatically applying the solution to the incident.

First claim

What is claimed is:

1. A method for managing response to an incident, comprising:
at least one computer processor in an incident response system performing the following:
receiving training incident data from a training data source;
identifying at plurality of incident-related training keywords in the training data;
receiving one of a plurality of tags for each of the plurality of training keywords from a trainer;
executing a machine learning process to associate the received tags with the training keywords;
receiving incident data related to an incident from an incident data source;
identifying a plurality of incident-related keywords in the incident data;
automatically tagging the incident-related keyword with one of the plurality of tags;
automatically identifying at least one incident pattern from the tags;
automatically retrieving a solution for the incident based on similar resolved incidents;
automatically applying the solution to the incident;
receiving at least one search term for searching the incident data;
identifying at least one prior incident in the incident data responsive to the at least one search term;
calculating a relevancy score between the search term and at least one prior incident; and
outputting an identification of the at least one prior incident and the relevancy score.

2. The method of claim 1 , wherein the machine learning process is a Term Frequency-Inverse Document Frequency process.

3. The method of claim 1 , wherein natural language processing or cosine similarity is used to measure a similarity between the at least one search term and incident data for the at least one prior incident.

4. The method of claim 1 , wherein the solution comprises a work-around.

5. The method of claim 1 , wherein the incident data source comprises a centralized incident data repository.

6. The method of claim 1 , wherein the incident data source comprises at least one of a hardware source and a software source.

7. The method of claim 1 , wherein the incident data source comprises an incident chat transcript, an incident voice file, and an incident text report.

8. The method of claim 1 , further comprising:
automatically enriching the incident data with enrichment data.

9. The method of claim 8 , wherein the enrichment data identifies at least one of a weekend incident, a beginning of the day incident, an end of the day incident, and an end of month incident.

10. The method of claim 1 , further comprising:
clustering the incident with at least one prior incident.

11. The method of claim 10 , wherein the incident is clustered with at least one prior incident using a hierarchical clustering algorithm or a K-means clustering algorithm.

12. The method of claim 1 , the method may further comprise identifying at least one prior incident that is similar to the incident.

13. The method of claim 1 , wherein the solution comprises a software patch.

14. A system for managing response to an incident, comprising:
an incident response system comprising at least one computer processor and comprising a training engine and a learning engine;
at least one source of training data;
at least one source of incident data
an incident data repository; and
at least one user interface;
wherein:
the training engine receives training incident data from the source of training data;
the training engine identifies a plurality of incident-related training keywords in the training data;
the training engine receives one of a plurality of tags for each of the plurality of training keywords from a trainer;
the training engine executes a machine learning process to associate the received tags with the training keywords;
the learning engine receives incident data related to an incident from the source of incident data;
the learning engine identifies a plurality of incident-related keywords in the incident data;
the learning engine automatically tags the incident-related keyword with one of the plurality of tags;
the incident response system automatically identifies at least one incident pattern from the tags;
the incident response system automatically retrieves a solution for the incident based on similar resolved incidents in the incident data repository;
the incident response system automatically applies the solution to the incident;
the incident response system receives at least one search term for searching the incident data from the user interface;
the incident response system identifies at least one prior incident in the incident data responsive to the at least one search term;
the incident response system calculates a relevancy score between the search term and at least one prior incident; and
the incident response system outputs an identification of the at least one prior incident and the relevancy score to the user interface.

15. The system of claim 14 , wherein natural language processing or cosine similarity is used to measure a similarity between the at least one search term and incident data for the at least one prior incident.

16. The system of claim 14 , wherein the incident data source comprises a centralized incident data repository.

17. The system of claim 14 , wherein the incident data source comprises at least one of a hardware source and a software source.

18. The system of claim 14 , wherein the incident data source comprises an incident chat transcript, an incident voice file, and an incident text report.

Assignees

• Jpmorgan Chase Bank Na

Inventors

• El Sayyed Hani
• Ford Gary
• Thomas Kevin
• Christian Daniel J
• Alamir Salwa Husam
• Bench Simon
• Maile Ian

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N20/00 Primary

  Machine learning · CPC title

• G06Q10/00

  Administration; Management · CPC title

• G06F16/254

  Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses · CPC title

• G06N7/005

  Physics · mapped topic