Failure prediction in a computing system based on machine learning applied to alert data

Patent metadata

Field	Value
Publication number	US-11829233-B2
Application number	US-202217576490-A
Country	US
Kind code	B2
Filing date	Jan 14, 2022
Priority date	Jan 14, 2022
Publication date	Nov 28, 2023
Grant date	Nov 28, 2023

Abstract

An embodiment may involve persistent storage containing a machine learning trainer application configured to apply one or more learning algorithms. One or more processors may be configured to: obtain alert data from one or more computing systems; generate training vectors from the alert data, wherein elements within each of the training vectors include: results of a set of statistics applied to the alert data for a particular computing system of the one or more computing systems, and an indication of whether the particular computing system is expected to fail given its alert data; train, using the machine learning trainer application and the training vectors, a machine learning model, wherein the machine learning model is configured to predict failure of a further computing system based on operational alert data obtained from the further computing system; and deploy the machine learning model for production use.

First claim

What is claimed is:

1. A system comprising:
persistent storage containing a machine learning trainer application configured to apply one or more learning algorithms; and
one or more processors configured to:
obtain alert data from one or more computing systems within a managed network, wherein the alert data reflects an attribute of a system component associated with a particular computing system of the one or more computing systems;
generate training vectors from the alert data, wherein elements within each of the training vectors include: results of a set of statistics applied to the alert data for the particular computing system of the one or more computing systems, and an indication of whether the particular computing system is expected to fail given its alert data;
train, using the machine learning trainer application and the training vectors, a machine learning model, wherein the machine learning model is configured to predict failure of a further computing system based on operational alert data obtained from the further computing system; and
deploy the machine learning model for production use with the managed network.

2. The system of claim 1 , wherein the one or more processors are further configured to:
receive the operational alert data obtained from the further computing system;
apply the machine learning model to the operational alert data; and
obtain, from the machine learning model, the indication of whether the further computing system is predicted to fail given the operational alert data.

3. The system of claim 1 , wherein the one or more processors are further configured to:
apply one or more pre-defined escalation rules to the indication; and
based on applying the one or more pre-defined escalation rules to the indication, determine whether to notify an administrator of the further computing system of the indication.

4. The system of claim 1 , wherein the alert data is aggregated into an ordering of alert groups, and wherein at least some of the statistics are applied on basis of the alert groups.

5. The system of claim 4 , wherein the alert groups are ordered based on relevance of the alert data therein to likelihood of failure.

6. The system of claim 1 , wherein the alert data is organized into observation periods, and wherein the statistics include calculation of a slope of a subset of the alert data over two or more of the observation periods.

7. The system of claim 1 , wherein the alert data is organized into observation periods, and wherein the statistics include calculation of a dispersion of a subset of the alert data over two or more of the observation periods.

8. The system of claim 1 , wherein the alert data is organized into observation periods, and wherein the statistics include calculation of an exponential decay of a subset of the alert data over two or more of the observation periods.

9. The system of claim 1 , wherein the indication of whether the particular computing system is expected to fail given its alert data is based on the particular computing system actually failing within a pre-defined time period of producing its alert data.

10. The system of claim 1 , wherein the indication of whether the particular computing system is expected to fail given its alert data is based on a human expert determining that the particular computing system is likely to fail within a pre-defined time period of producing its alert data.

11. A system comprising:
persistent storage containing a machine learning trainer application configured to apply one or more learning algorithms; and
one or more processors configured to:
obtain alert data from one or more computing systems;
generate training vectors from the alert data, wherein generating the training vectors is further configured to:
generate partial training vectors from the alert data;
receive indications of failure related to each of the partial training vectors; and
combine the partial training vectors with their respective indications of failure to obtain the training vectors, and wherein elements within each of the training vectors include: results of a set of statistics applied to the alert data for a particular computing system of the one or more computing systems, and an indication of whether the particular computing system is expected to fail given its alert data;

train, using the machine learning trainer application and the training vectors, a machine learning model, wherein the machine learning model is configured to predict failure of a further computing system based on operational alert data obtained from the further computing system; and
deploy the machine learning model for production use.

12. A computer-implemented method comprising:
obtaining alert data from one or more computing systems within a managed network, wherein the alert data reflects an attribute of a system component associated with a particular computing system of the one or more computing systems;
generating training vectors from the alert data, wherein elements within each of the training vectors include: results of a set of statistics applied to the alert data for the particular computing system of the one or more computing systems, and an indication of whether the particular computing system is expected to fail given its alert data;
training, using a machine learning trainer application and the training vectors, a machine learning model, wherein the machine learning model is configured to predict failure of a further computing system based on operational alert data obtained from the further computing system; and
deploying the machine learning model for production use.

13. The computer-implemented method of claim 12 , further comprising:
receiving the operational alert data obtained from the further computing system;
applying the machine learning model to the operational alert data; and
obtaining, from the machine learning model, the indication of whether the further computing system is predicted to fail given the operational alert data.

14. The computer-implemented method of claim 12 , further comprising:
applying one or more pre-defined escalation rules to the indication; and
based on applying the one or more pre-defined escalation rules to the indication, determining whether to notify an administrator of the further computing system that of the indication.

15. The computer-implemented method of claim 12 , wherein the alert data is aggregated into an ordering of alert groups, and wherein at least some of the statistics are applied on basis of the alert groups.

16. The computer-implemented method of claim 15 , wherein the alert groups are ordered based on relevance of the alert data therein to likelihood of failure.

17. The computer-implemented method of claim 12 , wherein the alert data is organized into observation periods, and wherein the statistics include: calculation of a slope of a subset of the alert data, calculation of a dispersion of the subset of the alert data, and calculation of an exponential decay of the subset of the alert data over two or more of the observation periods.

18. The computer-implemented method of claim 12 , wherein the indication of whether the particular computing system is expected to fail given its alert data is based on a human expert determining that the particular computing system is likely to fail within a pre-defined time period of producing its alert data.

19. A computer-implemented method comprising:
obtaining alert data from one or more computing systems;
generating training vectors from the alert da

Assignees

• Servicenow Inc

Inventors

• Watkins Matthew Lawrence
• Surapaneni Dinesh Kumar Kishorkumar
• Jayaraman Baskar

Classifications

• G06F11/0781 Primary

  Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06F18/2178

  based on feedback of a supervisor · CPC title

• G06F11/008 Primary

  Reliability or availability analysis · CPC title

• G06F2201/81

  Threshold · CPC title