Abstract: An operations management system and related method obtains user activity information representing user interactions with the operations management system responsive to an incident, the incident belonging to a category of incidents. The method represents the user activity information as an itemset. The method further processes the itemset with a mining algorithm to identify one or more items of information frequently accessed for the incident. The method yet further associates the identified one or more items of information with the category of incidents.

Abstract: An approach for training a recurrent neural network to create a model for anomaly detection in the topology of a network is disclosed. The approach comprises, creating an embedding vector for each resource in the network based on applying an embedding algorithm to each resource of the network. A feature vector is then created for each change to a resource in the network based on one or more properties of the change. A recurrent neural network can thus be trained with the embedding vectors and the feature vectors to create a model for anomaly detection in the topology of the network.

Abstract: Topology information including a plurality of snapshots of a network topology associated with respective points in time for a network can be received by an apparatus. Each snapshot is represented as a graph of nodes each corresponding to a network resource and having a node identifier. The graph for each snapshot is modified by replacing nodes representing network resources having the same role in the network with a single aggregated node. Feature learning is performed based on the modified graphs representing the plurality of snapshots, and determines a feature representation for each node in the modified graphs. An identifier for each node in the plurality of snapshots is associated with the corresponding feature representation for use in the correlation of network resources. Node identifiers for nodes in the same aggregated node in a modified graph are associated with the same feature representation.

Abstract: Aspects of the present invention disclose a method, computer program product, and system for predicting cost reduction of event correlation in fault event management. The method includes one or more processors receiving a plurality of candidate correlation groups of events in a set of fault events. The method further includes, for each candidate correlation group of events, one or more processors predicting a resource cost reduction in resolving the respective correlation group of events compared to resolving all events in the respective correlation group individually. The method further includes one or more processors analyzing the predicted resource cost reductions for the plurality of candidate correlation groups of events. The method further includes one or more processors selecting a candidate correlation group based on the analysis of predicted resource cost reductions.

Abstract: Topology information including a plurality of snapshots of a network topology associated with respective points in time for a network can be received by an apparatus. Each snapshot is represented as a graph of nodes each corresponding to a network resource and having a node identifier. The graph for each snapshot is modified by replacing nodes representing network resources having the same role in the network with a single aggregated node. Feature learning is performed based on the modified graphs representing the plurality of snapshots, and determines a feature representation for each node in the modified graphs. An identifier for each node in the plurality of snapshots is associated with the corresponding feature representation for use in the correlation of network resources. Node identifiers for nodes in the same aggregated node in a modified graph are associated with the same feature representation.