Cognitive user interface for technical issue detection by process behavior analysis for information technology service workloads

Patent metadata

Field	Value
Publication number	US-11222296-B2
Application number	US-201816145820-A
Country	US
Kind code	B2
Filing date	Sep 28, 2018
Priority date	Sep 28, 2018
Publication date	Jan 11, 2022
Grant date	Jan 11, 2022

Abstract

Aspects of the invention include receiving, using a processor, a plurality of values of a performance indicator. A statistical analysis of the plurality of values of the performance indicator is performed, using the processor, to detect an anomaly pattern in the plurality of values of the performance indicator. A warning message about the detected anomaly pattern is sent to an alert recipient that is selected by a machine learning model trained to identify alert recipients based at least in part on detected anomaly patterns. Feedback about the warning message is received from the alert recipient. The feedback includes an interest of the alert recipient in receiving warning messages about the detected anomaly pattern. The machine learning model is updated based at least in part on the feedback.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, using a processor, a plurality of values of a performance indicator of an information technology (IT) system;
performing, using the processor, a statistical analysis of the plurality of values of the performance indicator to detect an anomaly pattern in the plurality of values of the performance indicator;
sending a warning message about the detected anomaly pattern to an alert recipient, the alert recipient remote from the processor and selected by a machine learning model trained to identify alert recipients based at least in part on detected anomaly patterns, wherein the machine learning model was trained based at least in part on a set of warning messages with user feedback that were transformed into a vector space and used for training the machine learning model to generate parameter estimates;
receiving feedback about the warning message from the alert recipient, the feedback including an interest of the alert recipient in receiving warning messages about the detected anomaly pattern, the interest of the alert recipient determined based at least in part on a number of mouse clicks and time spent viewing the alert by the alert recipient as measured by a computer interface coupled to a working environment of the alert recipient, the working environment comprising an integrated development engine (IDE); and
retraining the machine learning model based at least in part on the feedback, wherein subsequent to the retraining, the machine learning model selects a different alert recipient for at least one anomaly pattern.

2. The computer-implemented method of claim 1 , wherein the feedback further including whether the detected anomaly pattern represents a technical issue, and the method further comprises updating the statistical quality control analysis based at least in part on the feedback.

3. The computer-implemented method of claim 1 , wherein the statistical analysis is process behavior analysis and the indicators are key performance indicators.

4. The computer-implemented method of claim 1 , wherein the values of the performance indicator are generated based at least in part on a plurality of IT tickets describing service incidents.

5. The computer-implemented method of claim 1 , wherein performing the statistical analysis comprises formulating a multi-dimensional time-series view of the values of the performance indicator.

6. The computer-implemented method of claim 5 , wherein the anomaly pattern is detected based at least in part on the multi-dimensional time-series view exhibiting sudden or gradual fluctuations.

7. The computer-implemented method of claim 1 , further comprising sending a message with educational content to a plurality of recipients, the educational content based at least in part on the feedback.

8. A system comprising:
a memory having computer readable instructions; and
one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising:
receiving a plurality of values of a performance indicator of an information technology (IT) system;
performing a statistical analysis of the plurality of values of the performance indicator to detect an anomaly pattern in the plurality of values of the performance indicator;
sending a warning message about the detected anomaly pattern to an alert recipient, the alert recipient remote from the one or more processors and selected by a machine learning model trained to identify alert recipients based at least in part on detected anomaly patterns, wherein the machine learning model was trained based at least in part on a set of warning messages with user feedback that were transformed into a vector space and used for training the machine learning model to generate parameter estimates;
receiving feedback about the warning message from the alert recipient, the feedback including an interest of the alert recipient in receiving warning messages about the detected anomaly pattern, the interest of the alert recipient determined based at least in part on a number of mouse clicks and time spent viewing the alert by the alert recipient as measured by a computer interface coupled to a working environment of the alert recipient, the working environment comprising an integrated development engine (IDE); and
retraining the machine learning model based at least in part on the feedback, wherein subsequent to the retraining, the machine learning model selects a different alert recipient for at least one anomaly pattern.

9. The system of claim 8 , wherein the feedback further includes whether the anomaly pattern represents a technical issue, and the method further comprises updating the statistical quality control analysis based at least in part on the feedback.

10. The system of claim 8 , wherein the statistical analysis is process behavior analysis and the indicators are key performance indicators.

11. The system of claim 8 , wherein the values of the performance indicator are generated based at least in part on a plurality of IT tickets describing service incidents.

12. The system of claim 8 , wherein performing the statistical analysis comprises formulating a multi-dimensional time-series view of the values of the performance indicator.

13. The system of claim 12 , wherein the anomaly pattern is detected based at least in part on the multi-dimensional time-series view exhibiting sudden or gradual fluctuations.

14. The system of claim 8 , wherein the operations further comprise sending a message with educational content to a plurality of recipients, the educational content based at least in part on the feedback.

15. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:
receiving a plurality of values of a performance indicator of an information technology (IT) system;
performing a statistical analysis of the plurality of values of the performance indicator to detect an anomaly pattern in the plurality of values of the performance indicator;
sending a warning message about the detected anomaly pattern to an alert recipient, the alert recipient remote from the processor selected by a machine learning model trained to identify alert recipients based at least in part on detected anomaly patterns, wherein the machine learning model was trained based at least in part on a set of warning messages with user feedback that were transformed into a vector space and used for training the machine learning model to generate parameter estimates;
receiving feedback about the warning message from the alert recipient, the feedback including an interest of the alert recipient in receiving warning messages about the detected anomaly pattern, the interest of the alert recipient determined based at least in part on a number of mouse clicks and time spent viewing the alert by the alert recipient as measured by a computer interface coupled to a working environment of the alert recipient, the working environment comprising an integrated development engine (IDE); and
retraining the machine learning model based at least in part on the feedback, wherein subsequent to the retraining, the machine learning model selects a different alert recipient for at least one anomaly pattern.

16. The computer program product of claim 15 , wherein the feedback further includes whether the anomaly pattern represents a techn

Assignees

• IBM

Inventors

• Sun Hongtan
• Vukovic Maja
• Murthy Karin
• Batta Raghav
• Sarkar Soumitra

Classifications

• G06N3/09

  Supervised learning · CPC title

• G06N3/091

  Active learning · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title

• H04L41/5009

  Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title