Systems and methods for responding to electronic security incidents
US-10284587-B1 · May 7, 2019 · US
US11551105B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-11551105-B2 |
| Application number | US-201815958228-A |
| Country | US |
| Kind code | B2 |
| Filing date | Apr 20, 2018 |
| Priority date | Apr 20, 2018 |
| Publication date | Jan 10, 2023 |
| Grant date | Jan 10, 2023 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
Client instance data including a plurality of incidents and a plurality of knowledge elements comprising information relating to resolving one or more of the plurality of incidents is obtained. A validation set is built based on the obtained client instance data, the validation set including fingerprint data of plural fingerprints of known incident-knowledge relationships, each of fingerprint representing a link between one of the incidents and one of the knowledge elements used for resolving the incident. A knowledge element class is predicted from among plural knowledge element classes for each of knowledge element based on the built validation set, the plural knowledge element classes being defined based on respective threshold values indicating a quality of coverage provided by a knowledge element for resolving an incident. Classification data of the plural knowledge elements classified into the plural knowledge element classes is presented with the obtained client instance data.
Opening claim text (preview).
What is claimed is: 1. A system comprising: a non-transitory memory; and one or more hardware processors configured to execute instructions from the non-transitory memory to: obtain client instance data including a plurality of incidents and a plurality of knowledge elements comprising information relating to resolving one or more of the plurality of incidents; build a validation set based on the obtained client instance data, wherein the validation set comprises fingerprint data of a plurality of fingerprints of known incident-knowledge relationships, each of the plurality of fingerprints representing a link between one of the plurality of incidents and one of the plurality of knowledge elements used for resolving the incident; train a prediction engine using machine learning to classify, based on the plurality of fingerprints, the plurality of knowledge elements into a plurality of knowledge element classes, wherein the plurality of knowledge element classes are defined based on respective threshold values, wherein each of the respective threshold values indicates a quality of coverage provided by a respective knowledge element class for resolving an incident; predict, via the trained prediction engine, a knowledge element class from among the plurality of knowledge element classes for each of the plurality of knowledge elements based on the built validation set; and present classification data of the plurality of knowledge elements classified into the plurality of knowledge element classes with the obtained client instance data. 2. The system of claim 1 , wherein training the prediction engine comprises using unsupervised machine learning to train the prediction engine to respectively fit the plurality of incidents and the plurality of knowledge elements into a plurality of common groups, a number of the plurality of common groups being optimized based on the fingerprint data of the plurality of fingerprints included in the validation set, and wherein, for each of the plurality of knowledge elements, the one or more hardware processors are configured to execute instructions from the non-transitory memory to: determine a model fit value indicating how well the knowledge element fits into a corresponding common group; determine a coverage confidence value based on a number of incidents in the corresponding common group, the determined model fit value, and fingerprint data associated with the knowledge element, wherein the prediction engine predicts the knowledge element class of the knowledge element based on the determined coverage confidence value of the knowledge element; and present the plurality of common groups representing the plurality of incidents and the plurality of knowledge elements in respective association with each other. 3. The system of claim 2 , wherein, for each of the plurality of incidents, the one or more hardware processors are configured to execute instructions from the non-transitory memory to: determine a model fit value indicating how well the incident fits into a corresponding common group; determine a coverage confidence value based on a number of knowledge elements in the corresponding common group, the determined model fit value, and fingerprint data associated with the incident; predict an incident class from among a plurality of incident classes for the incident based on the determined coverage confidence value of the incident, wherein the incident class is predicted using the prediction engine that is trained to classify the plurality of incidents into the plurality of incident classes, the plurality of incident classes being defined based on respective threshold values indicating a quality of knowledge coverage available for the incident; and present classification data of the plurality of incidents classified into the plurality of incident classes with the obtained client instance data. 4. The system of claim 1 , wherein training the prediction engine comprises using supervised machine learning to train the prediction engine to classify the plurality of knowledge elements into the plurality of knowledge element classes based on the fingerprint data of the plurality of fingerprints included in the validation set, the fingerprint data of the plurality of fingerprints representing training data for training the prediction engine on each of the plurality of knowledge element classes. 5. The system of claim 4 , wherein training the prediction engine comprises using supervised machine learning to train the prediction engine to classify the plurality of incidents into a plurality of incident classes based on the fingerprint data of the plurality of fingerprints included in the validation set, the fingerprint data of the plurality of fingerprints representing training data for training the prediction engine on each of the plurality of incident classes. 6. The system of claim 1 , wherein the plurality of fingerprints are based on a plurality of fingerprint types including an attachment fingerprint type that indicates a relationship between a given knowledge element and a given incident based on one or more table joins indicating a formal relationship between the given knowledge element and the given incident. 7. The system of claim 1 , wherein the plurality of fingerprints are based on a plurality of fingerprint types including a text similarity fingerprint type that indicates a relationship between a given knowledge element and a given incident based on at least one of: (i) text similarity between at least a portion of a predetermined field of the given incident and at least a portion of a predetermined field of the given knowledge element; and (ii) text similarity between at least the portion of the predetermined field of the given incident and at least a portion of a first predetermined field of an intermediate entity, and text similarity between at least a portion of a second predetermined field of the intermediate entity and at least the portion of the predetermined field of the given knowledge element. 8. The system of claim 1 , wherein the plurality of fingerprints are based on a plurality of fingerprint types including a reference fingerprint type that indicates a relationship between a given knowledge element and a given incident based on at least one of presence of reference information of the given knowledge element in a predetermined field of the given incident, and presence of the reference information of the given knowledge element in an intermediate field of an intermediate entity associated with the given incident. 9. The system of claim 1 , wherein the plurality of incidents are closed incidents that have been resolved. 10. The system of claim 1 , wherein each fingerprint of the plurality of fingerprints in the validation set comprises a known incident-knowledge relationship different from other fingerprints of the plurality of fingerprints. 11. The system of claim 10 , wherein a fingerprint of the plurality of fingerprints in the validation set is selected from a plurality of available fingerprints for a same incident based on a predetermined condition. 12. A non-transitory computer-readable recording medium having stored thereon a program, the recording medium comprising instructions that when executed by one or more processing units cause the one or more processing units to: obtain client instance data including a plurality of incidents and a plurality of knowledge elements comprising information relating to resolving one or more of the plurality of incidents; build a validation set based on the obtained client instance data, wherein the validation set comprises fingerprint data of a plurality of fingerprints of known incid
characterised by the interaction between service providers and their network customers, e.g. customer relationship management · CPC title
Machine learning · CPC title
Knowledge engineering; Knowledge acquisition · CPC title
using machine learning or artificial intelligence · CPC title
Probabilistic graphical models, e.g. probabilistic networks · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.