Near real-time system or network incident detection

Patent metadata

Field	Value
Publication number	US-10990915-B2
Application number	US-201715406194-A
Country	US
Kind code	B2
Filing date	Jan 13, 2017
Priority date	Jan 13, 2017
Publication date	Apr 27, 2021
Grant date	Apr 27, 2021

Abstract

Systems and arrangements for determining whether a scheduled modification of a system, or the like, is a likely cause of an incident are provided. Historical data related to previous incidents may be received and analyzed to identify incidents having a significant business impact and the system, or the like, associated with those incidents. Scheduled modification data may be received and may include a system, or the like, for which a modification has occurred, and a time and date at which the modification is occurred. An incident may be received and the system, or the like associated with the incident may be identified and compared to systems, or the like, identified in the scheduled modification data. If there is a match, a determination may be made as to whether the incident occurred at a time and date of the scheduled modification. If so, the scheduled modification may be identified as a likely cause of the incident.

First claim

What is claimed is:

1. A system or network incident detection and analysis computing system, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
at least one memory storing computer-readable instructions that, when executed by the at least one processor, cause a change management computing device of the system or network detection identification analysis computing system to:
receive historical data including data related to incidents associated with a system or network and determined to have a quantified business impact above a predetermined threshold;
process the received historical data;
identify, based on the processed historical data, at least one of: devices and applications associated with each incident and a time and date of each incident;
generate, based on the processed historical data, one or more machine learning datasets including inclusion criteria and exclusion criteria, the inclusion criteria and exclusion criteria being generated based on analysis of keywords and sequences of keywords in the historical data;
receive scheduled system or network modification data, the modification data including a date and time associated with each scheduled modification and at least one of a device and application to which the scheduled modification is being applied;
process the received scheduled system or network modification data to identify the at least one of: devices and applications for which a modification is scheduled;
receive incident data associated with an incident associated with at least one of: a device or application, the incident data including a date and time of the incident, free form text associated with the incident, and an identification of the device or application impacted by the incident;
analyze the received incident data including the free form text associated with the incident using the generated one or more machine learning datasets to determine whether the incident data matches inclusion criteria or exclusion criteria;
responsive to determining that the incident data matches exclusion criteria, process the incident as a low priority incident;
responsive to determining that the incident data matches inclusion criteria, processing the incident as a high priority incident including:
comparing the received incident data to the scheduled system or network modification data to determine whether a modification was scheduled for the at least one of: the device or application;
responsive to determining that a modification was scheduled for the at least one of: the device or application associated with the incident, comparing the date and time of the incident to a date and time associated with the scheduled modification for the at least on of: the device or application associated with the incident;
responsive to determining that the date and time of the incident match a date and time of the scheduled modification, identifying the scheduled modification as a cause of the incident; and
transmitting a notification indicating the scheduled modification was the cause of the incident; and

update the one or more machine learning datasets based on the processing the incident.

2. The system or network incident detection and analysis computing system of claim 1 , wherein the notification is transmitted to one or more user computing devices.

3. The system or network incident detection and analysis computing system of claim 1 , wherein the notification includes a user interface including an alert associated with the modification.

4. The system or network incident detection and analysis computing system of claim 3 , wherein the user interface is displayed on a display associated with a user computing device.

5. The system or network incident detection and analysis computing system of claim 1 , wherein the notification includes an email message including a description of the incident.

6. The system or network incident detection and analysis computing system of claim 5 , wherein the email is transmitted to a predetermined list of recipients based on a type of incident and a priority of incident.

7. The system or network incident detection and analysis computing system of claim 1 , further including determining a confidence level that the modification was the cause of the incident.

8. A method, comprising:
receiving, by a system or network incident detection and analysis computing system, historical data including data related to incidents associated with a system or network and determined to have a quantified business impact above a predetermined threshold;
processing, by the system or network incident detection and analysis computing system, the received historical data;
identifying, by the system or network incident detection and analysis computing system, at least one of: devices and applications associated with each incident and a time and date of each incident;
generating, by the system or network incident detection and analysis computing system and based on the processed historical data, one or more machine learning datasets including inclusion criteria and exclusion criteria, the inclusion criteria and exclusion criteria being generated based on analysis of keywords and sequences of keywords in the historical data;
receiving, by the system or network incident detection and analysis computing system, scheduled system or network modification data, the modification data including a date and time associated with each scheduled modification and at least one of a device and application to which the scheduled modification is being applied;
processing, by the system or network incident detection and analysis computing system, the received scheduled system or network modification data to identify the at least one of: devices and applications for which a modification is scheduled;
receiving, by the system or network incident detection and analysis computing system, incident data associated with an incident associated with at least one of: a device or application, the incident data including a date and time of the incident, free form text associated with the incident, and an identification of the device or application impacted by the incident;
analyzing, by the system or network incident detection and analysis computing system, the received incident data including the free form text associated with the incident using the generated one or more machine learning datasets to determine whether the incident data matches inclusion criteria or exclusion criteria;
responsive to determining that the incident data matches exclusion criteria, processing, by the system or network incident detection and analysis computing system, the incident as a low priority incident;
responsive to determining that the incident data matches inclusion criteria, processing, by the system or network incident detection and analysis computing system, the incident as a high priority incident including:
comparing, by the system or network incident detection and analysis computing system, the received incident data to the scheduled system or network modification data to determine whether a modification was scheduled for the at least one of: the device or application;
responsive to determining that a modification was scheduled for the at least one of: the device or application associated with the incident, comparing, by the system or network incident detection and analysis computing system, the date and time of the incident to a date and time associated with the scheduled modification for the at least one of: the device or application associated with the incident;
responsive to determining that the date and time of the incident match a date and time of the scheduled modification, identifying, by the

Assignees

• Bank Of America

Inventors

• Howie Charles C
• Glover Deaundra K
• Price Jesse
• Kephart Aaron

Classifications

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• G06N20/00

  Machine learning · CPC title