Computer information technology alert remediation selection based on alert similarity

Patent metadata

Field	Value
Publication number	US-11210160-B1
Application number	US-202016992963-A
Country	US
Kind code	B1
Filing date	Aug 13, 2020
Priority date	Aug 13, 2020
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

A new alert associated with a computer information technology issue to be remediated is received. Matching previous alerts similar to the new alert are determined. One or more successful remediation actions of the matching previous alerts are identified. The one or more successful remediation actions are evaluated. A performance of a selected one of the one or more successful remediation actions is initiated.

First claim

What is claimed is:

1. A method, comprising:
receiving a new alert associated with a computer information technology issue to be remediated;
determining matching previous alerts similar to the new alert, wherein determining the matching previous alerts includes identifying a group of similar alerts in an alert data store that are at least substantially similar, according to a specified metric, to the new alert, wherein the specified metric is a vector distance between a feature vector associated with the new alert and candidate clusters of alerts stored in the alert data store;
identifying one or more successful remediation actions of the matching previous alerts;
evaluating the one or more successful remediation actions; and
initiating a performance of a selected one of the one or more successful remediation actions.

2. The method of claim 1 , wherein the computer information technology issue is associated with one or more of the following: an unresponsive software process, an unresponsive software application, a software runtime error, a software failure to execute, or a software failure to terminate.

3. The method of claim 1 , wherein the computer information technology issue is associated with one or more of the following: a power supply failure, a hard drive failure, overheating, a connection cable failure, or a network connectivity failure.

4. The method of claim 1 , further comprising presenting the new alert to an information technology administrator through a user interface of a programmed computer system.

5. The method of claim 1 , wherein the new alert is received from an alert management information technology component that generated the new alert based at least in part on information collected by an event monitoring software agent.

6. The method of claim 1 , wherein determining the matching previous alerts includes comparing one or more parameters associated with the new alert with corresponding parameters of alerts stored in an alert data store.

7. The method of claim 6 , wherein the one or more parameters includes one or more of the following: one or more alert description text keywords, alert description text meaning, software components associated with an alert-triggering underlying information technology problem, or hardware components associated with the alert-triggering underlying information technology problem.

8. The method of claim 1 , wherein the group of similar alerts in the alert data store have been clustered by a machine learning model.

9. The method of claim 1 , wherein identifying the one or more successful remediation actions of the matching previous alerts includes identifying any remediation action that occurred within a specified period of time of corresponding closures of alerts among the matching previous alerts.

10. The method of claim 9 , further comprising storing the identified one or more remediation actions that occurred within the specified period of time of corresponding closures of alerts in a list of successful remediation actions.

11. The method of claim 1 , wherein evaluating the one or more successful remediation actions includes determining a ranking score for each of the one or more successful remediation actions.

12. The method of claim 11 , wherein the each ranking score is based at least in part on a number of times a corresponding one of the one or more successful remediation actions was successful for the matching previous alerts and a number of times the corresponding one remediation action was attempted for the matching previous alerts.

13. The method of claim 11 , wherein the each ranking score is based at least in part on a cost associated with a failure of a corresponding one of the one or more successful remediation actions.

14. The method of claim 1 , wherein initiating the performance of the selected one of the one or more successful remediation actions includes automatically applying the selected successful remediation action to the new alert.

15. The method of claim 1 , wherein the selected one of the one or more successful remediation actions corresponds to a determination made by a user in response to the user being presented with a specified number of remediation action choices to apply to the new alert.

16. The method of claim 15 , wherein the specified number of remediation action choices have been presented to the user via a mobile device.

17. A system, comprising:
one or more processors configured to:
receive a new alert associated with a computer information technology issue to be remediated;
determine matching previous alerts similar to the new alert including by being configured to identify a group of similar alerts in an alert data store that are at least substantially similar, according to a specified metric, to the new alert, wherein the specified metric is a vector distance between a feature vector associated with the new alert and candidate clusters of alerts stored in the alert data store;
identify one or more successful remediation actions of the matching previous alerts;
evaluate the one or more successful remediation actions; and
initiate a performance of a selected one of the one or more successful remediation actions; and

a memory coupled to at least one of the one or more processors and configured to provide at least one of the one or more processors with instructions.

18. The system of claim 17 , wherein the computer information technology issue is associated with one or more of the following: an unresponsive software process, an unresponsive software application, a software runtime error, a software failure to execute, or a software failure to terminate.

19. The system of claim 17 , wherein the computer information technology issue is associated with one or more of the following: a power supply failure, a hard drive failure, overheating, a connection cable failure, or a network connectivity failure.

20. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving a new alert associated with a computer information technology issue to be remediated;
determining matching previous alerts similar to the new alert, wherein determining the matching previous alerts includes identifying a group of similar alerts in an alert data store that are at least substantially similar, according to a specified metric, to the new alert, wherein the specified metric is a vector distance between a feature vector associated with the new alert and candidate clusters of alerts stored in the alert data store;
identifying one or more successful remediation actions of the matching previous alerts;
evaluating the one or more successful remediation actions; and
initiating a performance of a selected one of the one or more successful remediation actions.

Assignees

• Servicenow Inc

Inventors

• Dukhovny Vadim
• Miron Dov
• Gati Ofer
• Makovsky Bnayahu
• Iktelat Mohammad

Classifications

• G06N3/045

  Combinations of networks · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title