Near Real-Time System or Network Incident Detection

Patent metadata

Field	Value
Publication number	US-2018204124-A1
Application number	US-201715406131-A
Country	US
Kind code	A1
Filing date	Jan 13, 2017
Priority date	Jan 13, 2017
Publication date	Jul 19, 2018
Grant date	—

Abstract

Systems and arrangements for using temporal analysis to evaluate incidents to determine whether they are likely to cause a significant business impact are provided. Historical data may be analyzed to identify incidents having a significant business impact. The historical data associated with incidents having a significant business impact may be further analyzed to identify a time and/or date at which the incident occurred, as well as the particular system, or the like, impacted by the incident. Normal business hours associated with the system, or the like, may be retrieved and a profile may be generated for the system, or the like. An incident may be received and processed to identify a system, or the like, associated with the incident and profile may be retrieved. The incident data may be compared to the profile to determine whether the incident is likely to cause a significant business impact based, at least in part, on the date and/or time at which it occurred.

First claim

What is claimed is:

1 . A system or network incident detection and analysis computing system, comprising:
at least one processor; a communication interface communicatively coupled to the at least one processor; and at least one memory storing computer-readable instructions that, when executed by the at least one processor, cause a temporal analysis computing device of the system or network incident detection and analysis computing system to:
receive historical data related to system or network incidents, the received historical data including time and date information associated with each incident, and an indication if each incident had a quantified impact above a predetermined threshold;
analyze the received historical data to identify at least one of: a date and time of each incident having a quantified impact above the predetermined threshold;
query a database storing normal hours of operation data for a plurality of systems, applications and networks;
receive normal hours of operation data for the plurality of systems, applications and networks; and
generate a profile for each system, application or network of the plurality of systems, applications and networks based on the at least one of: the date and time of each incident having a quantified impact above the predetermined threshold and normal hours of operation data for each system, application or network associated with each incident having a quantified impact above the predetermined threshold.

2 . The system or network incident detection and analysis computing system of claim 1 , further including instructions that, when executed, cause the temporal analysis computing device to:
receive an incident associated with a system, application or network, the incident including data associated with a date and time of the incident; identify a system, application or network associated with the incident; comparing the data from the received incident with the generated profile for the identified system, application or network associated with the incident to determine whether the incident occurred on a date or at a time that is likely to cause an impact above the predetermined threshold.

3 . The system or network incident detection and analysis computing system of claim 2 , further including generating a notification including a result of the determination of whether the incident occurred on a date or at a time that is likely to cause an impact above the predetermined threshold.

4 . The system or network incident detection and analysis computing system of claim 3 , further including transmitting the generated notification to one or more computing devices.

5 . The system or network incident detection and analysis computing system of claim 1 , wherein comparing the data from the received incident with the generated profile for the identified system, application or network to determine whether the incident occurred on a date or at a time that is likely to cause an impact above the predetermined threshold includes comparing the date and time of the incident to dates and times of historical incidents for the system, application or network having a quantified impact above the predetermined threshold.

6 . The system or network incident detection and analysis computing system of claim 1 , wherein comparing the data from the received incident with the generated profile for the identified system, application or network to determine whether the incident occurred on a date or at a time that is likely to cause an impact above the predetermined threshold includes comparing the hours of operation for the identified system, application or network to the date and time of the incident to determine whether the incident occurred during the normal hours of operation for the system, application or network.

7 . The system or network incident detection and analysis computing system of claim 1 , wherein the normal hours of operation further include a local time zone.

8 . A method, comprising:
receiving, by a system or network incident detection and analysis computing system, historical data related to system or network incidents, the received historical data including time and date information associated with each incident, and an indication if each incident had a quantified impact above a predetermined threshold; analyzing, by the system or network incident detection and analysis computing system, the received historical data to identify at least one of: a date and time of each incident having a quantified impact above the predetermined threshold; querying, by the system or network incident detection and analysis computing system, a database storing normal hours of operation data for a plurality of systems, applications and networks; receiving, by the system or network incident detection and analysis computing system, normal hours of operation data for the plurality of systems, applications and networks; and generating, by the system or network incident detection and analysis computing system, a profile for each system, application or network of the plurality of systems, applications and networks based on the at least one of: the date and time of each incident having a quantified impact above the predetermined threshold and normal hours of operation data for each system, application or network associated with each incident having a quantified impact above the predetermined threshold.

9 . The method of claim 8 , further including:
receiving, by the system or network incident detection and analysis computing system, an incident associated with a system, application or network, the incident including data associated with a date and time of the incident; identifying, by the system or network incident detection and analysis computing system, a system, application or network associated with the incident; comparing, by the system or network incident detection and analysis computing system, the data from the received incident with the generated profile for the identified system, application or network associated with the incident to determine whether the incident occurred on a date or at a time that is likely to cause an impact above the predetermined threshold.

10 . The method of claim 9 , further including generating a notification including a result of the determination of whether the incident occurred on a date or at a time that is likely to cause an impact above the predetermined threshold.

11 . The method of claim 10 , further including transmitting the generated notification to one or more computing devices.

12 . The method of claim 8 , wherein comparing the data from the received incident with the generated profile for the identified system, application or network to determine whether the incident occurred on a date or at a time that is likely to cause an impact above the predetermined threshold includes comparing the date and time of the incident to dates and times of historical incidents for the system, application or network having a quantified impact above the predetermined threshold.

13 . The method of claim 8 , wherein comparing the data from the received incident with the generated profile for the identified system, application or network to determine whether the incident occurred on a date or at a time that is likely to cause an impact above the predetermined threshold includes comparing the hours of operation for the identified system, application or network to the date and time of the incident to determine whether the incident occurred during the normal hours of operation for the system, application or network.

14 . The method of claim 8 , wherein the normal hours o

Assignees

• Bank Of America

Inventors

• Howie Charles C
• Glover Deaundra K
• Price Jesse
• Kephart Aaron

Classifications

• G06F16/00

  Information retrieval; Database structures therefor; File system structures therefor · CPC title

• G06F16/2477

  Temporal data queries · CPC title

• G06N20/00

  Machine learning · CPC title

• G06Q10/0637 Primary

  Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals · CPC title

• G06N5/04 Primary

  Inference or reasoning models · CPC title