Abstract: An autonomous controller for SDN, virtual, and/or physical networks can be used to optimize a network automatically and determine new optimizations as a network scales. The controller trains models that can determine in real-time the optimal path for the flow of data from node A to B in an arbitrary network. The controller processes a network topology to determine relative importance of nodes in the network. The controller reduces a search space for a machine learning model by selecting pivotal nodes based on the determined relative importance. When a demand to transfer traffic between two hosts is detected, the controller utilizes an AI model to determine one or more of the pivotal nodes to be used in routing the traffic between the two hosts. The controller determines a path between the two hosts which comprises the selected pivotal nodes and deploys a routing configuration for the path to the network.

Abstract: A multivariate clustering-based anomaly detector can generate an event for consumption by an APM manager that indicates detection of an anomaly based on multivariate clustering analysis after topology-based feature selection. The anomaly detector accumulates time-series data across a series of time instants to form a multivariate time-series data slice or multivariate data slice. The anomaly detector then performs multivariate clustering analysis with the multivariate data slice. The anomaly detector determines whether a multivariate data slice is within a cluster of multivariate data slices. If the multivariate data slice is within the cluster and the cluster is a known anomaly cluster, then the anomaly detector generates an anomaly detection event indicating detection of the known anomaly. The anomaly detector can also determine that a multivariate data slice is within an unknown cluster and generate an event indicating detection of an unknown anomaly.

Abstract: An autonomous controller for SDN, virtual, and/or physical networks can be used to optimize a network automatically and determine new optimizations as a network scales. The controller trains models that can determine in real-time the optimal path for the flow of data from node A to B in an arbitrary network. The controller processes a network topology to determine relative importance of nodes in the network. The controller reduces a search space for a machine learning model by selecting pivotal nodes based on the determined relative importance. When a demand to transfer traffic between two hosts is detected, the controller utilizes an AI model to determine one or more of the pivotal nodes to be used in routing the traffic between the two hosts. The controller determines a path between the two hosts which comprises the selected pivotal nodes and deploys a routing configuration for the path to the network.

Abstract: An autonomous controller for SDN, virtual, and/or physical networks can be used to optimize a network automatically and determine new optimizations as a network scales. The controller trains models that can determine in real-time the optimal path for the flow of data from node A to B in an arbitrary network. The controller processes a network topology to determine relative importance of nodes in the network. The controller reduces a search space for a machine learning model by selecting pivotal nodes based on the determined relative importance. When a demand to transfer traffic between two hosts is detected, the controller utilizes an AI model to determine one or more of the pivotal nodes to be used in routing the traffic between the two hosts. The controller determines a path between the two hosts which comprises the selected pivotal nodes and deploys a routing configuration for the path to the network.

Abstract: An autonomous controller for SDN, virtual, and/or physical networks can be used to optimize a network automatically and determine new optimizations as a network scales. The controller trains models that can determine in real-time the optimal path for the flow of data from node A to B in an arbitrary network. The controller processes a network topology to determine relative importance of nodes in the network. The controller reduces a search space for a machine learning model by selecting pivotal nodes based on the determined relative importance. When a demand to transfer traffic between two hosts is detected, the controller utilizes an AI model to determine one or more of the pivotal nodes to be used in routing the traffic between the two hosts. The controller determines a path between the two hosts which comprises the selected pivotal nodes and deploys a routing configuration for the path to the network.

Abstract: A multivariate path-based anomaly detection and prediction service (“anomaly detector”) can generate a prediction event for consumption by the APM manager that indicates a likelihood of an anomaly occurring based on path analysis of multivariate values after topology-based feature selection. To predict that a set of metrics will travel to a cluster that represents anomalous application behavior, the anomaly detector analyzes a set of multivariate date slices that are not within a cluster to determine whether dimensionally reduced representations of the set of multivariate data slices fit a path as described by a function.

Abstract: To facilitate distinguishing between topics which belong to the same or similar semantic fields, previously-known domain information is modeled with a bipartite graph. The bipartite graph created for the software security domain indicates a set of risks and a set of mitigation actions. A topic categorization system utilizes the bipartite graph to identify which risks and mitigation actions were discussed in a conversation by first using existing NLP techniques to extract relevant topics from conversation text and subsequently mapping the topics to the bipartite graph. A security assessment report identifying potential security threats and corresponding mitigation actions is generated based on the resulting mappings. Conversation fragments which were extracted and mapped are included in the assessment report.

Abstract: A network device associated with a database management system receives information associated with a customer support ticket. Based on information in the database management system, a direct relationship between the received customer support ticket and a customer support ticket in the database may be determined. A graph including nodes representing customer support tickets is generated based on information in the database. Edge prediction is performed on the graph to derive relationships among the nodes in the graph. A predictive relationship between customer support tickets is derived. A relationship data set based on the direct relationship between the customer support tickets and based on the predictive relationship between the customer support tickets is generated. The relationship data set associated with the customer support ticket is communicated to the user device.

Abstract: A multivariate clustering-based anomaly detector can generate an event for consumption by an APM manager that indicates detection of an anomaly based on multivariate clustering analysis after topology-based feature selection. The anomaly detector accumulates time-series data across a series of time instants to form a multivariate time-series data slice or multivariate data slice. The anomaly detector then performs multivariate clustering analysis with the multivariate data slice. The anomaly detector determines whether a multivariate data slice is within a cluster of multivariate data slices. If the multivariate data slice is within the cluster and the cluster is a known anomaly cluster, then the anomaly detector generates an anomaly detection event indicating detection of the known anomaly. The anomaly detector can also determine that a multivariate data slice is within an unknown cluster and generate an event indicating detection of an unknown anomaly.

Abstract: A multivariate path-based anomaly detection and prediction service (“anomaly detector”) can generate a prediction event for consumption by the APM manager that indicates a likelihood of an anomaly occurring based on path analysis of multivariate values after topology-based feature selection. To predict that a set of metrics will travel to a cluster that represents anomalous application behavior, the anomaly detector analyzes a set of multivariate date slices that are not within a cluster to determine whether dimensionally reduced representations of the set of multivariate data slices fit a path as described by a function.

Abstract: In a datacenter setting, a summary of differences and similarities between two or more states of the same or similar systems are predicted. Initially, a Long Short-Term Memory (LSTM) neural network is trained with to predict a summary describing the state change between at least two states of the datacenter. Given a set of training data (at least two datacenter states that are annotated with a state change description), the LSTM neural network learns which similarities and differences between the datacenter states correspond to the annotations. Accordingly, given a set of test data comprising at least two states of a datacenter represented by context graphs that indicate a plurality of relationships among a plurality of nodes corresponding to components of a datacenter, the LSTM neural network is able to determine a state change description that summarizes the differences and similarities between the at least two states of the datacenter.

Abstract: A method includes performing, by a processor: receiving a document containing subject matter related to a course of action, the document comprising a plurality of sub-documents that are related to one another in a time sequence, converting the document to a vector format to generate a vectorized document that encodes a probability distribution of words in the document and transition probabilities between words, applying a machine learning algorithm to the vectorized document to generate an estimated vectorized document, associating the estimated vectorized document with a reference document; predicting future subject matter contained in a future sub-document of the document based on the reference document, and adjusting the course of action responsive to predicting the future subject matter.

Abstract: In a datacenter setting, annotations or descriptions of relevant parts or subgraphs corresponding to components in the datacenter are predicted. Given a set of training data (library of subgraphs seen in the past labeled with a textual description explaining why were they considered relevant enough to be placed in the historical database), the recurrent neural network (RNN) learns how to combine the different textual annotations coming from each relevant region into a single annotation that describes the whole system. Accordingly, given a set of input or test data (datacenter state modeled a context graph that is not annotated), the system determines which regions of the input graph are more relevant, and for each of these regions, the RNN predicts an annotation even in a previously unseen or different datacenter infrastructure.

Abstract: Incomplete state information for nodes of a datacenter is completed utilizing historical state information. A context graph is received having a plurality of nodes that correspond to components of the datacenter, each node including properties that correspond to the represented component. It is determined that at least one of the properties for a node is incomplete. A context hash is derived from the context graph and compared to a plurality of subgraph hashes. Based upon the comparison, one or more subgraphs are identified that are similar to the context hash. Where a single similar subgraph is identified, the property information for the single subgraph is imputed to the context graph to complete the incomplete information. Where more than one similar subgraph is identified, the property information for the identified similar subgraphs is aggregated and the aggregated property information is imputed to the context graph to complete the incomplete information.

Abstract: In a computer server, a ticket element generated by an issue tracking system responsive to a client request is received, where the ticket element includes a data field including data indicative of an attribute. A database including state data stored therein is accessed responsive to receipt of the ticket element. The state data relates a plurality of states that are specific to the attribute. One of the plurality of states related by the state data is identified as corresponding to a future state of the attribute based on a current state of the attribute, and a future probability of escalation of the ticket element is computed based on the future state of the attribute responsive to identification of the one of the plurality of states as corresponding thereto. An action indicator is provided in response to the client request.

Abstract: In a datacenter setting, annotations or descriptions of relevant parts or subgraphs corresponding to components in the datacenter are predicted. Given a set of training data (library of subgraphs seen in the past labeled with a textual description explaining why were they considered relevant enough to be placed in the historical database), the recurrent neural network (RNN) learns how to combine the different textual annotations coming from each relevant region into a single annotation that describes the whole system. Accordingly, given a set of input or test data (datacenter state modeled a context graph that is not annotated), the system determines which regions of the input graph are more relevant, and for each of these regions, the RNN predicts an annotation even in a previously unseen or different datacenter infrastructure.

Abstract: Incomplete state information for nodes of a datacenter is completed utilizing historical state information. A context graph is received having a plurality of nodes that correspond to components of the datacenter, each node including properties that correspond to the represented component. It is determined that at least one of the properties for a node is incomplete. A context hash is derived from the context graph and compared to a plurality of subgraph hashes. Based upon the comparison, one or more subgraphs are identified that are similar to the context hash. Where a single similar subgraph is identified, the property information for the single subgraph is imputed to the context graph to complete the incomplete information. Where more than one similar subgraph is identified, the property information for the identified similar subgraphs is aggregated and the aggregated property information is imputed to the context graph to complete the incomplete information.

Abstract: In a datacenter setting, root causes of anomalies corresponding to components in the datacenter are predicted. Initially, a convolutional neural network (CNN) is utilized to consider the evolution sequence of the datacenter infrastructure. Given a set of training data (sequences of datacenter states that are labeled with root causes of the anomalies present in the sequences), the CNN learns which sequences of datacenter states correspond to the labels of root causes. Accordingly, given a set of input or test data (sequences of datacenter states that are not labeled with root causes of the anomalies present in the sequences), the CNN is able to predict a root cause for the anomaly even in a previously unseen or different datacenter infrastructure.

Abstract: In a datacenter setting, a summary of differences and similarities between two or more states of the same or similar systems are predicted. Initially, a Long Short-Term Memory (LSTM) neural network is trained with to predict a summary describing the state change between at least two states of the datacenter. Given a set of training data (at least two datacenter states that are annotated with a state change description), the LSTM neural network learns which similarities and differences between the datacenter states correspond to the annotations. Accordingly, given a set of test data comprising at least two states of a datacenter represented by context graphs that indicate a plurality of relationships among a plurality of nodes corresponding to components of a datacenter, the LSTM neural network is able to determine a state change description that summarizes the differences and similarities between the at least two states of the datacenter.

Abstract: In a datacenter setting, future states of nodes of a datacenter (each node representing a component of the datacenter in a context graph) are predicted. Initially, historical metrics collected from the datacenter nodes, as well as historical metrics of neighboring nodes. The metrics are aggregated into historical metric summary vector representations of the nodes which are utilized to train a future state predictor to predict future datacenter states. Once trained, metrics may be input into the future state predictor and the future state predictor may be utilized to predict a future state of one or more of the nodes of the datacenter.