Utilizing machine learning models with a centralized repository of log data to predict events and generate alerts and recommendations

Patent metadata

Field	Value
Publication number	US-2022019935-A1
Application number	US-202016929866-A
Country	US
Kind code	A1
Filing date	Jul 15, 2020
Priority date	Jul 15, 2020
Publication date	Jan 20, 2022
Grant date	—

Abstract

A device may receive log data from application logs associated with applications, service logs associated with services, and server logs associated with server devices. The device may store the log data. The device may perform natural language processing on the log data to convert the log data into event data identifying events associated with categories. The device may process the event data, with a first machine learning model, to identify patterns in the event data and to generate an alert based on the patterns. The device may process the event data, with a second machine learning model, to generate a correlation matrix for the event data and to predict an event based on the correlation matrix. The device may process the event data, with a third machine learning model, to classify the event data based on the categories and to generate a recommendation based on classifying the event data.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by a device, log data from application logs associated with applications, service logs associated with services, and server logs associated with server devices; storing, by the device, the log data in a centralized log repository; performing, by the device, natural language processing on the log data, stored in the centralized log repository, to convert the log data into event data identifying events associated with categories; processing, by the device, the event data, with one or more first machine learning models, to identify patterns in the event data and to generate an alert based on the patterns; processing, by the device, the event data, with one or more second machine learning models, to generate a correlation matrix for the event data and to predict an event based on the correlation matrix; processing, by the device, the event data, with one or more third machine learning models, to classify the event data based on the categories and to generate a recommendation based on classifying the event data; and performing, by the device, one or more actions based on one or more of the alert, the event, or the recommendation.

2 . The method of claim 1 , wherein performing the one or more actions comprises one or more of:
providing data identifying the one or more of the alert, the event, or the recommendation for display; causing an application to be reprogrammed based on the one or more of the alert, the event, or the recommendation; causing one of the server devices to restart based on the one or more of the alert, the event, or the recommendation; or causing a new server device to be implemented based on the one or more of the alert, the event, or the recommendation.

3 . The method of claim 1 , wherein performing the one or more actions comprises one or more of:
causing a robot to be dispatched to service one of the server devices based on the one or more of the alert, the event, or the recommendation; causing a technician to be dispatched to service one of the server devices based on the one or more of the alert, the event, or the recommendation; or retraining one or more of the one or more first machine learning models, the one or more second machine learning models, or the one or more third machine learning models based on the one or more of the alert, the event, or the recommendation.

4 . The method of claim 1 , wherein the one or more first machine learning models include one or more of:
a support vector machine model, a random forest model, a Monte Carlo tree search model, or a temporal difference learning model.

5 . The method of claim 1 , wherein the one or more second machine learning models include one or more of:
a support vector machine model, a random forest model, an auto regressive integrated moving average (ARIMA) model, a seasonal ARIMA model, or a vector autoregressive moving average with exogenous regressors model.

6 . The method of claim 1 , wherein the one or more third machine learning models include one or more of:
a support vector machine model, a random forest model, a Monte Carlo tree search model, a temporal difference learning model, or a dynamic sentence generation model.

7 . The method of claim 1 , wherein processing the event data, with the one or more first machine learning models, to identify the patterns in the event data and to generate the alert based on the patterns comprises:
identifying application behavior patterns based on the event data; identifying historical critical issue data from user ticket data of the event data; classifying the event data based on the application behavior patterns and the history critical issue data; and generate the alert for a critical event identified based on classifying the event data.

8 . A device, comprising:
one or more memories; and one or more processors, communicatively coupled to the one or more memories, configured to:
receive log data from application logs associated with applications, service logs associated with services, and server logs associated with server devices;
store the log data in a centralized log repository for a predetermined retention time period;
perform natural language processing on the log data, stored in the centralized log repository, to convert the log data into event data identifying events associated with categories;
selectively:
process the event data, with one or more first machine learning models, to identify patterns in the event data and to generate an alert based on the patterns;
process the event data, with one or more second machine learning models, to generate a correlation matrix for the event data and to predict an event based on the correlation matrix; or
process the event data, with one or more third machine learning models, to classify the event data based on the categories and to generate a recommendation based on classifying the event data; and

perform one or more actions based on one or more of the alert, the event, or the recommendation.

9 . The device of claim 8 , wherein the one or more processors, when processing the event data, with the one or more second machine learning models, to generate the correlation matrix for the event data and to predict the event based on the correlation matrix, are configured to:
separate critical events from the event data; insert impact data in the event data without the critical events; identify correlations and seasonal variations in the event data and the impact data; generate the correlation matrix based on the correlations and the seasonal variations in the event data and the impact data; and predict the event based on the correlation matrix.

10 . The device of claim 8 , wherein the one or more processors, when processing the event data, with the one or more third machine learning models, to classify the event data based on the categories and to generate the recommendation based on classifying the event data, are configured to:
classify the event data into the categories; identify, based on classifying the event data into the categories, correlations between application response times and hardware metrics of the server devices; and generate the recommendation based on the correlations between the application response times and the hardware metrics of the server devices.

11 . The device of claim 8 , wherein the log data includes data identifying one or more of:
authentication, authorization, and access data associated with the applications, the services, and the server devices, threats associated with the applications, the services, and the server devices, changes associated with the applications, the services, and the server devices, resource usage associated with the applications, the services, and the server devices, or availability data associated with the applications, the services, and the server devices.

12 . The device of claim 8 , wherein the event data includes data identifying one or more of:
a debug event associated with debugging one of the applications, the services, or the server devices, a warning event associated with one of the applications, the services, or the server devices, a critical event associated with one of the applications, the services, or the server devices, an information event associated with one of the applications, the services, or the server devices, or an error event associated with one of the applications, the services, or the server devices.

13 . The device of claim 8 , wherein the one or more processors, when performing the one or more actions, are configured to:
generate a

Assignees

• Accenture Global Solutions Ltd

Inventors

• Ghatage Prakash
• Sampat Nirav Jagdish
• Viswanathan Kumar
• Thangaraj Naveen Kumar
• Sundarakrishnan Sattish
• Kurhekar Kaustubh
• Price Richard Stephen Vincent

Classifications

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06F18/24323

  Tree-organised classifiers · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title

• G06F11/3065

  Monitoring arrangements determined by the means or processing involved in reporting the monitored data (error or fault reporting or logging G06F11/0766) · CPC title