Systems and methods for automated incident response

Patent metadata

Field	Value
Publication number	US-2019228342-A1
Application number	US-201715622749-A
Country	US
Kind code	A1
Filing date	Jun 14, 2017
Priority date	Jun 14, 2016
Publication date	Jul 25, 2019
Grant date	—

Abstract

Systems and methods for automated incident response are disclosed. In one embodiment, a method for managing response to an incident may include (1) receiving training incident data from a training data source; (2) identifying at plurality of incident-related training keywords in the training data; (3) receiving one of a plurality of tags for each of the plurality of training keywords from a trainer; (4) executing a machine learning process to associate the received tags with the training keywords; (5) receiving incident data related to an incident from an incident data source; (6) identifying a plurality of incident-related keywords in the incident data; (7) automatically tagging the incident-related keyword with one of the plurality of tags; (8) automatically identifying at least one incident pattern from the tags; (9) automatically retrieving a solution for the incident based on similar resolved incidents; and (10) automatically applying the solution to the incident.

First claim

What is claimed is:

1 . A method for managing response to an incident, comprising:
at least one computer processor in an incident response system performing the following:
receiving training incident data from a training data source;
identifying at plurality of incident-related training keywords in the training data;
receiving one of a plurality of tags for each of the plurality of training keywords from a trainer;
executing a machine learning process to associate the received tags with the training keywords;
receiving incident data related to an incident from an incident data source;
identifying a plurality of incident-related keywords in the incident data;
automatically tagging the incident-related keyword with one of the plurality of tags;
automatically identifying at least one incident pattern from the tags;
automatically retrieving a solution for the incident based on similar resolved incidents; and
automatically applying the solution to the incident.

2 . The method of claim 1 , wherein the machine learning process is a Term Frequency-Inverse Document Frequency process.

3 . The method of claim 1 , further comprising:
receiving at least one search term for searching the incident data; identifying at least one prior incident in the incident data responsive to the at least one search term; calculating a relevancy score between the search term and at least one prior incident; and outputting an identification of the at least one prior incident and the relevancy score.

4 . The method of claim 3 , wherein natural language processing or cosine similarity is used to measure a similarity between the at least one search term and incident data for the at least one prior incident.

5 . The method of claim 1 , wherein the solution comprises a work-around.

6 . The method of claim 1 , wherein the incident data source comprises a centralized incident data repository.

7 . The method of claim 1 , wherein the incident data source comprises at least one of a hardware source and a software source.

8 . The method of claim 1 , wherein the incident data source comprises an incident chat transcript, an incident voice file, and an incident text report.

9 . The method of claim 1 , further comprising:
automatically enriching the incident data with enrichment data.

10 . The method of claim 9 , wherein the enrichment data identifies at least one of a weekend incident, a beginning of the day incident, an end of the day incident, and an end of month incident.

11 . The method of claim 1 , further comprising:
clustering the incident with at least one prior incident.

12 . The method of claim 11 , wherein the incident is clustered with at least one prior incident using a hierarchical clustering algorithm or a K-means clustering algorithm.

13 . The method of claim 1 , the method may further comprise identifying at least one prior incident that is similar to the incident.

14 . The method of claim 1 , wherein the solution comprises a software patch.

15 . A system for managing response to an incident, comprising:
an incident response system comprising at least one computer processor and comprising a training engine and a learning engine; at least one source of training data; at least one source of incident data an incident data repository; and at least one user interface; wherein:
the training engine receives training incident data from the source of training data;
the training engine identifies a plurality of incident-related training keywords in the training data;
the training engine receives one of a plurality of tags for each of the plurality of training keywords from a trainer;
the training engine executes a machine learning process to associate the received tags with the training keywords;
the learning engine receives incident data related to an incident from the source of incident data;
the learning engine identifies a plurality of incident-related keywords in the incident data;
the learning engine automatically tags the incident-related keyword with one of the plurality of tags;
the incident response system automatically identifies at least one incident pattern from the tags;
the incident response system automatically retrieves a solution for the incident based on similar resolved incidents in the incident data repository; and
the incident response system automatically applies the solution to the incident.

16 . The system of claim 15 , wherein:
the incident response system receives at least one search term for searching the incident data from the user interface; the incident response system identifies at least one prior incident in the incident data responsive to the at least one search term; the incident response system calculates a relevancy score between the search term and at least one prior incident; and the incident response system outputs an identification of the at least one prior incident and the relevancy score to the user interface.

17 . The system of claim 15 , wherein natural language processing or cosine similarity is used to measure a similarity between the at least one search term and incident data for the at least one prior incident.

18 . The system of claim 15 , wherein the incident data source comprises a centralized incident data repository.

19 . The system of claim 15 , wherein the incident data source comprises at least one of a hardware source and a software source.

20 . The system of claim 15 , wherein the incident data source comprises an incident chat transcript, an incident voice file, and an incident text report.

Assignees

• Jpmorgan Chase Bank Na

Inventors

• El Sayyed Hani
• Ford Gary
• Thomas Kevin
• Christian Daniel J
• Alamir Salwa Husam
• Bench Simon
• Maile Ian

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N20/00 Primary

  Machine learning · CPC title

• G06F16/254

  Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses · CPC title

• G06Q10/00

  Administration; Management · CPC title

• G06N7/005

  Physics · mapped topic