Abstract: Generating a neural network model for producing explainable prediction outputs for input data samples is provided. Training dataset of data samples are provided, each having a prediction label indicating a desired prediction output from the model for that sample, and a set of concept vectors are defined comprising a plurality of concept vectors which are associated with respective predefined concepts characterizing information content of the data samples. A set of input vectors are produced from each data sample. A neural network model is trained that includes a cross-attention module for producing a sample embedding for a data sample and a prediction module for producing a prediction output from the sample embedding.

Abstract: The invention is notably directed to a computer-implemented method of clustering anomalies detected in a computerized system. The proposed method makes use of an unsupervised cognitive model, executed based on input datasets to obtain clusters of anomalies. The method accesses input datasets, which correspond to detected anomalies of the computerized system. These anomalies span respective time windows. Each input dataset comprises a set of timeseries of key performance indicators. The key performance indicators of each input dataset extend over a respective time window. That is, each anomaly corresponds to a respective time window. This model includes a first stage, which includes an encoder designed to learn fixed-size representations of input datasets, and a second stage, which is a clustering stage. The model is executed based on the input datasets accessed, the first stage learning fixed-size representations of the input datasets and the second stage clustering the learned representations.

Abstract: Aspects of the present invention disclose a method and system for anomaly detection for a data source. The method includes one or more processors identifying unexpected values of monitoring measurands in a monitored time series utilizing an anomaly detection algorithm. A data source provides sensor data, including values of a first group of measurands, which include monitoring measurands. The method further includes determining that values of a second group of one or more of the measurands of a subset of sensor data indicates an anomaly utilizing the anomaly detection algorithm. The method further includes sending anomalous data indicative of the subset of sensor data to a root cause analysis system and receiving corresponding feedback that is indicative of a result of a root cause analysis of the subset of sensor data and comprises a third group of the measurands. The method further includes adapting the anomaly detection algorithm.

Abstract: Several aspects are provided for dynamically updating an alert-management system that uses a master ruleset to match alerts in a data processing system with automata for handling the alerts. A method comprises training a machine learning model to correlate the alerts with the automata using a training dataset comprising alerts which were successfully handled by the automata. The machine learning model is then applied to correlate unmatched alerts with the automata, wherein the unmatched alerts were not matched to the automata by the master ruleset. The method further comprises analyzing operation of the machine learning model in relation to correlation of the unmatched alerts to define a new ruleset for matching the unmatched alerts with the automata and outputting the new ruleset for auditing of each rule in the new ruleset. In response to approval of an audited rule, the audited rule is added to the master ruleset.

Abstract: Aspects of the present invention disclose a method and system for troubleshooting. The method includes identifying data sources providing sensor data, including a first group of measurands. The method further includes processors determining that values of a second group of the measurands of a subset of the sensor data (provided by a given data source, comprising a component set) indicates an anomaly. The method further includes determining a third group of the measurands that are root cause candidates of the anomaly. The measurands of the third group are provided by the component set. The method further includes assigning a set of coefficients to respective measurands. Each coefficient is indicative of a comparison result of each measurand with a measurand of the third group. The method further includes determining, using the sets of coefficients, whether a specific subset of the component set can be identified as an anomaly root cause.

Abstract: Aspects of the present invention disclose a method and system for troubleshooting. The method includes identifying data sources providing sensor data, including a first group of measurands. The method further includes processors determining that values of a second group of the measurands of a subset of the sensor data (provided by a given data source, comprising a component set) indicates an anomaly. The method further includes determining a third group of the measurands that are root cause candidates of the anomaly. The measurands of the third group are provided by the component set. The method further includes assigning a set of coefficients to respective measurands. Each coefficient is indicative of a comparison result of each measurand with a measurand of the third group. The method further includes determining, using the sets of coefficients, whether a specific subset of the component set can be identified as an anomaly root cause.

Abstract: Aspects of the present invention disclose a method and system for anomaly detection for a data source. The method includes one or more processors identifying unexpected values of monitoring measurands in a monitored time series utilizing an anomaly detection algorithm. A data source provides sensor data, including values of a first group of measurands, which include monitoring measurands. The method further includes determining that values of a second group of one or more of the measurands of a subset of sensor data indicates an anomaly utilizing the anomaly detection algorithm. The method further includes sending anomalous data indicative of the subset of sensor data to a root cause analysis system and receiving corresponding feedback that is indicative of a result of a root cause analysis of the subset of sensor data and comprises a third group of the measurands. The method further includes adapting the anomaly detection algorithm.

Abstract: In an approach to assisting database management, a computer generates one or more combinations of values of one or more database configuration parameters. The computer associates each of the one or more generated combinations of values with an incident probability. The computer defines relationships between the one or more generated combinations and the associated incident probabilities. The computer stores the defined relationships into an object representable as a multi-dimensional matrix, whose dimensions correspond to a plurality of database configuration parameters used to generate the combinations of values. The computer traverses the object to identify a path in the matrix. The computer returns the identified path for enabling subsequent interpretation thereof as a rule for passing from a first database configuration, corresponding to the first one of the one or more generated combinations, to a second database configuration, corresponding to the second one of the one or more generated combinations.

Abstract: In an approach to assisting database management, a computer generates one or more combinations of values of one or more database configuration parameters. The computer associates each of the one or more generated combinations of values with an incident probability. The computer defines relationships between the one or more generated combinations and the associated incident probabilities. The computer stores the defined relationships into an object representable as a multi-dimensional matrix, whose dimensions correspond to a plurality of database configuration parameters used to generate the combinations of values. The computer traverses the object to identify a path in the matrix. The computer returns the identified path for enabling subsequent interpretation thereof as a rule for passing from a first database configuration, corresponding to the first one of the one or more generated combinations, to a second database configuration, corresponding to the second one of the one or more generated combinations.

Abstract: In one embodiment, a computer-implemented method includes obtaining incident data related to a plurality of servers, including a first server. Configuration data is obtained for each of the plurality of servers. The configuration data includes information about a set of one or more configuration items of the first server. A predictive modeler is trained to predict incident characteristics, based at least in part on the incident data and the configuration data. A modification is selected to the set of configuration items of the first server. Predicted incident characteristics of the first server are simulated, by a computer processor, based on the selected modifications. It is recommended that the selected modifications be made to the first server if predetermined criteria are met by the simulation.

Abstract: In one embodiment, a computer-implemented method includes obtaining incident data related to a plurality of servers, including a first server. Configuration data is obtained for each of the plurality of servers. The configuration data includes information about a set of one or more configuration items of the first server. A predictive modeler is trained to predict incident characteristics, based at least in part on the incident data and the configuration data. A modification is selected to the set of configuration items of the first server. Predicted incident characteristics of the first server are simulated, by a computer processor, based on the selected modifications. It is recommended that the selected modifications be made to the first server if predetermined criteria are met by the simulation.