Systems and method for incident forecasting

Patent metadata

Field	Value
Publication number	US-2019349273-A1
Application number	US-201815979122-A
Country	US
Kind code	A1
Filing date	May 14, 2018
Priority date	May 14, 2018
Publication date	Nov 14, 2019
Grant date	—

Abstract

A system includes a memory and a processor configured to analyze a data set to determine a first number of incidents during a first period of time and a second number of incidents during a second period of time, train a plurality of models predict a number of incidents during the second period of time, wherein the plurality of respective models comprise a random forest model, a drift model, and a naïve seasonal drift model, identifying the model that best predicted the number of incidents during the second period of time, and utilizing the identified model to predict a third number of incidents within a set allowable range of values during a third period of time, and upper and lower limits of the third number of incidents during the third period of time based on a set confidence level and displaying the third number of incidents during the third period of time.

First claim

1 . A system, comprising:
a non-transitory memory; and one or more hardware processors configured to read instructions from the non-transitory memory to perform operations comprising:
analyzing a data set to determine a first number of incidents during a first period of time and a second number of incidents during a second period of time;
training a plurality of respective models to generate a predicted second number of incidents during the second period of time based on the first number of incidents during the first period of time, wherein the plurality of respective models comprise a random forest model, a drift model, and a naive seasonal drift model
comparing the predicted second number of incidents generated by each of the plurality of models to an actual number of incidents during the second period of time;
identifying a selected model of the plurality of models with the predicted second number of incidents that was closest to the actual number of incidents during the second period of time;
utilizing the selected model to predict:
a third number of incidents during a third period of time, wherein the third number of incidents is within a set allowable range of values, wherein the third period of time occurs subsequent to the second period of time;
an upper limit of the third number of incidents during the third period of time based on a set confidence level; and
a lower limit of the third number of incidents during the third period of time based on the set confidence level; and

causing to be displayed, via a graphical user interface, the predicted third number of incidents, the predicted upper limit of the third number of incidents, and the predicted lower limit of the third number of incidents during the third period of time.

2 . The system of claim 1 , wherein identifying the selected model of the plurality of models comprises calculating a root mean squared error (RMSE) between the predicted second number of incidents generated by each of the plurality of models and the actual number of incidents during the second period of time.

3 . The system of claim 1 , wherein the plurality of respective models is selectable via the graphical user interface.

4 . The system of claim 1 , wherein identifying the selected model of the plurality of models comprises considering weights assigned to one or more of the plurality of models.

5 . The system of claim 1 , wherein a first length of the first period of time, a second length of the second period of time, a third length of the third period or time, or a combination there of are configurable via the graphical user interface.

6 . The system of claim 1 , wherein the allowable range of values is configurable via the graphical user interface.

7 . The system of claim 1 , wherein the confidence level is configurable via the graphical user interface.

8 . The system of claim 1 , wherein the operations comprise caching the predicted third number of incidents during the third period of time in a database table as a comma separated value field.

9 . A system, comprising:
an enterprise management datacenter remotely located from one or more client networks; a client instance hosted by the enterprise management datacenter, wherein the client instance is generated for the one or more client networks, wherein the enterprise management datacenter is configured to perform operations comprising:
analyzing a data set to determine a first number of incidents during a first period of time and a second number of incidents during a second period of time;
training a plurality of respective models to generate a predicted second number of incidents during the second period of time based on the first number of incidents during the first period of time, wherein the plurality of respective models comprise a random forest model, a drift model, and a naive seasonal drift model
comparing the predicted second number of incidents generated by each of the plurality of models to an actual number of incidents during the second period of time;
identifying a selected model of the plurality of models with the predicted second number of incidents that was closest to the actual number of incidents during the second period of time;
utilizing the selected model to predict:
a third number of incidents during a third period of time, wherein the third number of incidents is within a set allowable range of values, wherein the third period of time occurs subsequent to the second period of time;
an upper limit of the third number of incidents during the third period of time based on a set confidence level; and
a lower limit of the third number of incidents during the third period of time based on the set confidence level; and

causing to be displayed, via a graphical user interface, the predicted third number of incidents, the predicted upper limit of the third number of incidents, and the predicted lower limit of the third number of incidents during the third period of time.

10 . The system of claim 9 , wherein identifying the selected model of the plurality of models comprises calculating a root mean squared error (RMSE) between the predicted second number of incidents generated by each of the plurality of models and the actual number of incidents during the second period of time.

11 . The system of claim 9 , wherein the plurality of respective models is selectable via the graphical user interface.

12 . The system of claim 9 , wherein a first length of the first period of time, a second length of the second period of time, a third length of the third period or time, or a combination there of are configurable via the graphical user interface.

13 . The system of claim 9 , wherein the allowable range of values is configurable via the graphical user interface.

14 . The system of claim 9 , wherein the confidence level is configurable via the graphical user interface.

15 . The system of claim 9 , wherein the operations comprise caching the predicted third number of incidents during the third period of time in a database table as a comma separated value field.

16 . A method of forecasting event data, comprising:
analyzing, via a processor, a data set to determine a first number of incidents during a first period of time and a second period of time; training, via the processor, a plurality of respective models to generate a predicted second number of incidents during a second period of time based on the first number of incidents during the first period of time, wherein the plurality of respective models comprise a random forest model, a drift model, and a naïve seasonal drift model; comparing, via the processor, the predicted second number of incidents generated by each of the plurality of models to an actual number of incidents during the second period of time; identifying, via the processor, a selected model of the plurality of models with the predicted second number of incidents that was closest to the actual number of incidents during the second period of time; utilizing, via the processor, the selected model to predict:
a third number of incidents during a third period of time, wherein the third number of incidents is within a set allowable range of values, wherein the third period of time occurs subsequent to the second period of time;
an upper limit of the third number of incidents during the third period of time based on a set confidence level; and
a lower limit of the third number of incidents during the third period of time based on the set confidence level; and
displaying, via a graphical user interface, the predicted third number of incidents, t

Assignees

• Servicenow Inc

Inventors

• Rikovic Tabak Aida
• Shahand Shayan
• Mohamed Ahmed Hany Abdelaziz
• Nagarajan Abhijith Thette
• Ninness Robert Andrew

Classifications

• H04L43/045 Primary

  for graphical visualisation of monitoring data · CPC title

• G06F11/3006 Primary

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title

• G06F18/22

  Matching criteria, e.g. proximity measures · CPC title

• G06F18/24323

  Tree-organised classifiers · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title