Abstract: A computer-implemented method, a computer program product, and a computer system for log anomaly detection. A computer receives a windowed log of incoming raw log messages. A computer compares statistical distribution metrics of entities in the windowed log with a statistical distribution extracted from a real-time statistical model for the entities. In response to the statistical distribution metrics being statistically different from the statistical distribution extracted from the real-time statistical model for the entities, a computer tags the windowed log as an entity anomaly. A computer computes a distance between an average word embedding vector in the windowed log and a statistical distribution extracted form a real-time statistical model for word embeddings. In response to the distance being greater than a predetermined threshold, a computer tags the windowed log as a word embedding anomaly. A computer sends to a user an alert with an anomaly severity level.

Abstract: Methods and systems for budgeted and simplified training of deep neural networks (DNNs) are disclosed. In one example, a trainer is to train a DNN using a plurality of training sub-images derived from a down-sampled training image. A tester is to test the trained DNN using a plurality of testing sub-images derived from a down-sampled testing image. In another example, in a recurrent deep Q-network (RDQN) having a local attention mechanism located between a convolutional neural network (CNN) and a long-short time memory (LSTM), a plurality of feature maps are generated by the CNN from an input image. Hard-attention is applied by the local attention mechanism to the generated plurality of feature maps by selecting a subset of the generated feature maps. Soft attention is applied by the local attention mechanism to the selected subset of generated feature maps by providing weights to the selected subset of generated feature maps in obtaining weighted feature maps.

Abstract: Identifying an log anomaly resolution by generating a knowledge base linking each of a plurality of incidents with historical anomalous log lines, calculating a resolution specificity score for each knowledge base record, identifying a run-time anomalous log line using the knowledge base, predicting a category for the run-time anomalous log line, identifying resolutions according to the category, ranking the resolutions according to the resolution specificity scores, and recommending a resolution according to the ranking.

Abstract: One or more computer processors classify each log line in a plurality of unlabeled log lines as an erroneous log line or a non-erroneous log line. The one or more computer processors templatize each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines. The one or more computer processors cluster erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters. The one or more computer processors eliminate the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold. The one or more computer processors train a log anomaly model utilizing=remaining erroneous log template clusters and remaining non-erroneous log template clusters. The one or more computer processors identify a subsequent log line as anomalous or non-anomalous utilizing the trained log anomaly model.

Abstract: Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.

Abstract: A tool for automatically generating incident management process efficiency metrics utilizing real-time communication analysis. The tool retrieves real-time conversation data from one or more communication sources, wherein the real-time conversation data includes one or more messages having data related to an information technology (IT) incident. The tool performs conversation analysis on the one or more messages. The tool determines one or more timestamps of interest for the IT incident from the one or more messages. The tool generates one or more incident management process efficiency metrics for the IT incident utilizing the one or more timestamps of interest. The tool predicts based, at least in part, on historical conversation data, an outcome for the IT incident. The tool sends the one or more incident management process efficiency metrics and the outcome for the IT incident to a user in a notification.

Abstract: Identifying an log anomaly resolution by generating a knowledge base linking each of a plurality of incidents with historical anomalous log lines, calculating a resolution specificity score for each knowledge base record, identifying a run-time anomalous log line using the knowledge base, predicting a category for the run-time anomalous log line, identifying resolutions according to the category, ranking the resolutions according to the resolution specificity scores, and recommending a resolution according to the ranking.

Abstract: Methods, systems, and computer program products for automatically detecting periods of normal activity by analyzing observability data in IT operations environments are provided herein. A computer-implemented method includes obtaining multiple types of data related to one or more artificial intelligence-related information technology operations; modelling at least a portion of the obtained data as time series data; automatically identifying, from the time series data, one or more time periods associated with one or more given levels of data activity; and performing one or more automated actions, in at least one artificial intelligence-related information technology operations environment, based at least in part on the data corresponding to the one or more identified time periods.

Abstract: A computer-implemented method according to one embodiment includes receiving, utilizing a processor, textual data associated with a conversation between a first participant and a second participant; receiving, utilizing the processor, an objective of the first participant for the conversation between the first participant and the second participant, where the objective is separate from the conversation; determining, utilizing the processor, a dialog act to be entered by the first participant that meets the objective, utilizing a model, including scoring a plurality of proposed dialog acts based on an amount that each proposed dialog act will change a probability of the objective being achieved during the conversation, and determining the dialog act to be entered, based on the scoring; and returning, utilizing the processor, the dialog act to the first participant.

Abstract: One or more computer processors classify each log line in a plurality of unlabeled log lines as an erroneous log line or a non-erroneous log line. The one or more computer processors templatize each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines. The one or more computer processors cluster erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters. The one or more computer processors eliminate the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold. The one or more computer processors train a log anomaly model utilizing=remaining erroneous log template clusters and remaining non-erroneous log template clusters. The one or more computer processors identify a subsequent log line as anomalous or non-anomalous utilizing the trained log anomaly model.

Abstract: One or more computer processors classify each log line in a plurality of unlabeled log lines as an erroneous log line or a non-erroneous log line; templatize each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines; cluster erroneous log templates into erroneous log template clusters and non-erroneous log templates into non-erroneous log template clusters; identify one or more log lines as anomalous utilizing a plurality of factors including a log maturity, a number of encountered log template clusters, and a ratio of classified erroneous log lines to classified non-erroneous log lines; responsive to one or more identified anomalous log lines, validate the identified anomalous log lines utilizing a site reliability engineer and human-in-the-loop validation; train a log anomaly model utilizing one or more validated log lines; and identify a subsequent log line as anomalous utilizing the trained log anomaly model.

Abstract: A computerized method, system and computer program product for building a dialogue flow. One embodiment of the method may comprise receiving an input document, the input document comprising content, and generating, by a question-answer pipeline, a plurality of question-answer pairs from the content of the input document. For each question-answer pair, the method may further comprise feeding the question of the question-answer pair into an intent of a dialogue flow structure, and feeding the answer of the question-answer pair as one response of the intent. The method may further comprise tagging each of the plurality of question-answer pairs with a corresponding document section index, reading, by a conversational agent, the input document to a user, pausing the reading when the conversational agent reaches one of the document section indices in the input document, and in response, reading the question corresponding to the document section indicia to the user.

Abstract: A computerized method, system and computer program product for automatically generating question and answer pairs. One embodiment of the method may comprise receiving an input document, the input document comprising content. The method may further comprise generating, by a first machine learning model from the input document, a plurality of answers based on the content of the input document, and generating, by a second machine learning model from the input document, a question for each of the plurality of answers to form a plurality of question-answer pairs. The method may further comprise ranking, by a third machine learning model, the plurality of question-answer pairs, selecting a predetermined number of highest ranked question-answer pairs, and returning the predetermined number of highest ranked question-answer pairs to a user.

Abstract: Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.

Abstract: An approach is disclosed that retrieves a set of current system data corresponding to a computer system and a set of current outputs from an anomaly detection model that is monitoring the computer system. The current system data and the anomaly detection model outputs are input to a trained anomaly detection supervisor model. The trained anomaly detection supervisor model processes the inputs and provides a set of performance data corresponding to the anomaly detection model. The anomaly detection model is then adjusted when the set of performance data indicates that the anomaly detection model is performing below a threshold.

Abstract: A tool for automatically generating incident management process efficiency metrics utilizing real-time communication analysis. The tool retrieves real-time conversation data from one or more communication sources, wherein the real-time conversation data includes one or more messages having data related to an information technology (IT) incident. The tool performs conversation analysis on the one or more messages. The tool determines one or more timestamps of interest for the IT incident from the one or more messages. The tool generates one or more incident management process efficiency metrics for the IT incident utilizing the one or more timestamps of interest. The tool predicts based, at least in part, on historical conversation data, an outcome for the IT incident. The tool sends the one or more incident management process efficiency metrics and the outcome for the IT incident to a user in a notification.

Abstract: A method, system, and a computer program product automatically select training data for updating a model by applying human-annotated training data to a model to generate results that are evaluated to identify correct case results and false case results that are categorized into error type categories for use in building error models corresponding to the error type categories, where each error model is built from at least failed case results belonging to a corresponding error type, and where unlabeled data samples are applied to each error model to compute an error likelihood for each unlabeled data sample with respect to each error type category, thereby enabling the selection and display of unlabeled data samples for annotation by a subject matter expert based on a computed error likelihood for the one or more unlabeled data samples in a specified error type category meeting or exceeding an error threshold requirement.

Abstract: One embodiment provides a method that includes receiving adjusted labeled data based on emotional tone factors. Words are analyzed using a tone latent Dirichlet allocation (T-LDA) model that models tone intensity using the emotional tone factors and integrating the adjusted labeled data. Representative words are provided for each emotional tone factor based on using the T-LDA model. The representative words are obtained using the T-LDA model based on determining posterior probabilities and adjusting the posterior probabilities based on an auxiliary topic.

Abstract: A method, system and a computer program product are provided for aligning embeddings of multiple languages and domains into a shared embedding space by transforming monolingual embeddings into a multilingual embeddings in a first shared embedding space using a cross-lingual learning process, and then transforming the multilingual embeddings into cross-domain, multilingual embeddings in a second shared embedding space using a cross-domain learning process.

Abstract: In an approach for training customer service agents using persona-based chatbots, a processor retrieves customer service interaction information. A processor analyzes, using natural language processing, the customer service interaction information, wherein the analyzing includes preprocessing and aggregating the customer service interaction information. A processor interacts with a user. A processor provides feedback to the user, based on the user's style and performance during training.