Technology system auto-recovery and optimality engine and techniques

Patent metadata

Field	Value
Publication number	US-11030037-B2
Application number	US-201916354301-A
Country	US
Kind code	B2
Filing date	Mar 15, 2019
Priority date	Nov 27, 2018
Publication date	Jun 8, 2021
Grant date	Jun 8, 2021

Abstract

Disclosed are hardware and techniques for correcting computer process faults by identifying risk associated with correcting a computer process fault and computer processes that may depend on the corrected computer process. The interdependent computer processes in a network may be determined by evaluating a stream of process break flags from a monitoring component coupled to the network. Each computer process break flag in the stream of computer process break flags indicates a process fault detected by the monitoring component and is correlated to a corrective response. The break flag and the corrective response are assigned a risk. A risk matrix accounts for interdependencies between computer processes and identified corrective actions. A final response strategy that corrects the computer process faults is determined using the assigned risk and computer system interdependence. A runbook stores the final response strategy, which may be updated based on changing computer process interdependencies and assigned risk.

First claim

What is claimed is:

1. An apparatus, comprising:
a memory storing programming code; and
a triage processing component, coupled to the memory and, via a communication interface, to a monitoring component that monitors operation of computer implemented processes of a network, operable to execute the stored programming code, that when executed causes the triage processing component to perform functions, including functions to:
evaluate a first process break event received from a monitoring component for a correlation to a possible cause of a potential operational breakdown of a computer process of the computer implemented processes;
based on the correlation to the possible cause of the potential operational breakdown of the computer process, identify corrective actions implementable to fix a computer implemented process exhibiting a symptom of the potential operational breakdown;
populate a risk assessment matrix with a break risk assessment value and a fix risk assessment value assigned to each of the identified corrective actions;
obtain a list of corrective actions correlated to the first process break event from a runbook, wherein the runbook includes a plurality of corrective actions that correct potential operational breakdowns of the computer implemented processes of the network; and
modify the list of corrective actions based on a rule set applied to the risk assessment matrix, wherein the modified list of corrective actions includes at least one of the identified corrective actions as an optimal corrective action.

2. The apparatus of claim 1 , wherein the memory further comprises:
programming code that causes the triage processing component to perform further functions, including functions to:
assign a break risk assessment value indicating a likelihood of occurrence of the potential operational breakdown of the computer implemented process; and
assign a respective fix risk assessment value to each of the identified corrective actions.

3. The apparatus of claim 2 , wherein:
the assigned break risk assessment value has a range from a value indicating the potential operational breakdown has a high likelihood of occurring to a value indicating the potential operation breakdown has a low likelihood of occurring; and
the respective fix risk assessment value assigned to each of the identified corrective actions has a range from a value indicating the potential operational breakdown has a high likelihood of being fixed to a value indicating the potential operation breakdown has a low likelihood of being fixed by a respective identified corrective action.

4. The apparatus of claim 2 , wherein the memory further comprises:
programming code that causes the triage processing component to perform further functions prior to the runbook being modified, including functions to:
identify interdependency risk patterns in the risk assessment matrix populated with the assigned break risk assessment value and the fix risk assessment value assigned for each of the identified corrective actions, wherein the identified interdependency risk patterns indicate risks related to each corrective action in the runbook and effects of implementing each corrective on the computer implemented processes in the network; and
generate, based on the identified interdependency risk patterns, a response strategy incorporating at least one of the corrective actions from the list of corrective actions.

5. The apparatus of claim 1 , wherein the memory further comprises:
programming code that causes the triage processing component to perform further functions when modifying the list of corrective actions, including functions to:
assign an interdependency rating to each corrective action in the list of corrective actions, wherein the interdependency rating quantifies a level of interdependence of each of the computer implemented processes that may be affected by application of each corrective action in the list of corrective actions;
populate the risk assessment matrix with the assigned interdependency rating of each corrective action in the list of corrective actions;
evaluate the risk assessment matrix, based on the assigned interdependency rating of each corrective action in the list of corrective actions to one another; and
in response to the evaluation of the risk assessment matrix, flag a respective corrective action from the list of corrective actions as the optimal corrective action.

6. The apparatus of claim 1 , wherein the risk assessment matrix has elements representing a plurality of computer implemented processes including the computer implemented process.

7. The apparatus of claim 6 , wherein the triage processing component is coupled to receive one or more process break events from multiple monitoring circuits that monitor computer implemented processes in the network; and
the memory further comprises programming code that causes the triage processing component to perform further functions, including functions to:
receive subsequent process break events from one or more of the multiple monitoring circuits coupled to the triage processing component;
generate, based on the received subsequent process break events, break risk assessment values and fix risk assessment values;
populate the risk assessment matrix using the generated break risk assessment values and fix risk assessment values;
identify one corrective action in a revised list of corrective actions for implementing one corrective action to fix potential operational breakdowns indicated by the subsequent break events; and
modify the runbook to include the identified one corrective action as the corrective action to implement when the potential operational breakdowns require fixing.

8. The apparatus of claim 7 , wherein the memory further comprises programming code that causes the triage processing component to perform further functions, including functions to:
produce a copy of the populated risk assessment matrix;
receive successive process break events that follow the subsequent process break events from the one or more of the multiple monitoring circuits coupled to the triage processing component;
generate, based on the received successive process break events, break risk assessment values and fix risk assessment values of the successive process break events;
populate the copy of the risk assessment matrix using the generated break risk assessment values and the generated fix risk assessment values to produce a revised risk assessment matrix;
analyze the break risk assessment values and the fix risk assessment values of the subsequent process break events in the populated risk assessment matrix to the break risk assessment values and the fix risk assessment values of the successive process break events in the revised risk assessment matrix; and
update, based on results of the analysis, the modified runbook to identify one corrective action in the list of corrective actions for implementing the one corrective action to fix the potential operational breakdown.

9. The apparatus of claim 8 , wherein the memory further comprises programming code that causes the triage processing component to perform functions, including functions to:
produce a simulation copy of the populated risk assessment matrix, wherein the simulation copy of the populated risk assessment matrix has elements including previously determined break risk assessment values and fix risk assessment values;
obtain simulated process breaks events as received process break events;
determine, based on the simulated process break events, break risk assessment values and fix risk assessment values of the simulated process break events;
populate the simulation copy of the risk assessment matrix using th

Assignees

• Capital One Services Llc

Inventors

• Gudka Bhavik
• Avirneni Surya
• Barnum Eric
• Patel Milind

Classifications

• G06F11/0793 Primary

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title

• G06F11/079

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/0787

  Storage of error reports, e.g. persistent data storage, storage using memory protection · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title