Abstract: A computer-implemented method is presented for automatically generating alerting rules. The method includes identifying, via offline analytics, abnormal patterns and normal patterns from history logs based on machine learning, statistical analysis and deep learning, the history logs stored in a history log database, automatically generating the alerting rules based on the identified abnormal and normal patterns, and transmitting the alerting rules to an alerting engine for evaluation. The method further includes receiving a plurality of online log messages from a plurality of computing devices connected to a network, augmenting the plurality of online log messages, and extracting information from the plurality of augmented online log messages to be provided to the alerting engine, the alerting engine configured to approve and enforce the alerting rules automatically generated by the offline analytics processing.

Abstract: Methods and systems for deploying images to computing systems include predicting an environment for a plurality of processing nodes. Image deployment to the plurality of processing nodes is simulated to determine a subset of the plurality of processing nodes for deployment. One or more images is pre-loaded to the subset of the plurality of processing nodes in advance of a deployment time.

Abstract: Performing an operation comprising transforming an input dataset to a predefined format, extracting, from the transformed dataset, a plurality of features describing the transformed dataset, and generating, by a machine learning (ML) algorithm executing on a processor and based on an ML model, a plurality of rules for modifying the transformed dataset to conform with a first data model.

Abstract: Methods and systems for processing records include extracting feature vectors from words in an unstructured portion of a record. The feature vectors are weighted based similarity to a topic vector from a structured portion of the record associated with the unstructured portion. The weighted feature vectors are classified using a machine learning model to determine respective probability vectors that assign a probability to each of a set of possible relations for each feature vector. Relations between entities are determined within the record based on the probability vectors. An action is performed responsive to the determined relations.

Abstract: A system and method for attribute discovery for operation objects from operation data includes segmenting a name of each of a plurality of operation objects based on one or more special characters used in the name of each operation object. A similarity comparison of the operation objects is performed by extracting common subsequences from substrings in operation data in a same log as a target object, and a string similarity is computed of the extracted common subsequences. Numerical attributes are determined by calculating statistical metrics for fields in the log, and additional information of the operation objects is discovered based on the determined numerical attributes.

Abstract: A method and system for relation discovery from operation data includes classifying categories of extracted entities from operation data into three or more classes identified in a knowledge base. A log affiliation of the extracted entities is determined, and relations of the extracted entities are identified according to a log affiliation. The identified relations information of the extracted entities is associated with operation objects of the operation data.

Abstract: Systems and methods for ticket classification and response include labeling tickets with a ticket classifier that assigns a ticket label and an associated confidence score to each ticket. Tickets are clustered according to semantic similarity to form ticket clusters. A template associated with each ticket cluster is determined. Templates and the respective ticket clusters are clustered according to semantic similarity to form one or more ticket super-clusters. Tickets that have below-threshold confidence scores are labeled according to the one or more ticket super-clusters. The tickets are automatically responded to.

Abstract: Embodiments facilitating performance anomaly detection are described. A computer-implemented method comprises: detecting, by a device operatively coupled to one or more processing units, based on monitoring data of a plurality of performance metrics of a monitored device, at least one trend within the monitoring data of the respective performance metrics; removing, by the device, the at least one trend from the monitoring data of the respective performance metrics to generate modified data of the respective performance metrics; and detecting, by the device, a performance anomaly based on the modified data of the respective performance metrics and a behavior clustering model comprising at least one steady state.

Abstract: Embodiments generally relate transforming data for a target schema. In some embodiments, a method includes receiving input data, where the input data includes a plurality of segments, and where the segments include a plurality of source fields containing target data. The method further includes characterizing the input data based at least in part on a plurality of predetermined metrics, where the predetermined metrics determine a structure of the input data. The method further includes mapping the target data in the source fields of the segments to a plurality of target fields of a target schema based at least in part on the characterizing. The method further includes populating the target fields of the target schema with the target data from the source fields based at least in part on the mapping.

Abstract: Techniques for Bayesian-based event grouping are provided. One technique includes determining a group of alarm events from received alarm events; in response to the group of alarm events matching a group of historical alarm events, determining a first correlation, wherein the group of historical alarm events comprises correlated events associated with a same entity; and determining a root cause of the group of alarm events based on the first correlation.

Abstract: A method and system for enabling transfer of widgets across containers at runtime. According to embodiments of the present invention, a user is allowed to transfer a widget across containers at runtime, for example, moving a widget that has been deployed and operated in one widget container to another, even though the destination widget container originally does not support the widget. Specifically, the widget being transferred can keep consistency in terms of data and state before and after the transfer. Furthermore, the user can implement the cross-container transfer of widgets at runtime by, for example, convenient interaction means like a drag-and-drop operation. In this way, the user can operate and interact with Web applications in a more convenient and flexible way.

Abstract: A system and method for attribute discovery for operation objects from operation data includes segmenting a name of each of a plurality of operation objects based on one or more special characters used in the name of each operation object. A similarity comparison of the operation objects is performed by extracting common subsequences from substrings in operation data in a same log as a target object, and a string similarity is computed of the extracted common subsequences. Numerical attributes are determined by calculating statistical metrics for fields in the log, and additional information of the operation objects is discovered based on the determined numerical attributes.

Abstract: A method and system for relation discovery from operation data includes classifying categories of extracted entities from operation data into three or more classes identified in a knowledge base. A log affiliation of the extracted entities is determined, and relations of the extracted entities are identified according to a log affiliation. The identified relations information of the extracted entities is associated with operation objects of the operation data.

Abstract: Embodiments of the present invention relate to a computer-implemented method, system and computer program product facilitating launching a middleware-based application. In some embodiments, a computer-implemented method includes: preparing, by a device operatively coupled to one or more processing units, an execution environment for middleware to be included in a container hosted on a machine; detecting, by the device, a request to schedule an application to be executed in the machine using the middleware; and in response to the request being detected, launching, by the device, the application within the container based on the prepared execution environment.

Abstract: Systems, computer-implemented methods and/or computer program products that facilitate automatically mapping different data types are provided. In one embodiment, a computer-implemented method comprises: constructing, by a system operatively coupled to a processor, an index from one or more classifier models for one or more data types; scoring and ranking, by the system, one or more candidate pairs for the one or more data types based on confidence score; and analyzing, by the system, how the one or more candidate pairs are scored and automatically generating the one or more classifier models used to construct the index.

Abstract: A method is provided for data matching between a set of source data structures and a set of target data structures. The method includes obtaining, using a processor device configured to perform machine learning, source to target matching results with matching scores, based on the sets of source and target data structures. The method further includes calculating, by the processor device, context information for data structure pairs based on a structure similarity and an ontology similarity between constituent data structures thereof. Each of data structure pairs include as the constituent data structures a respective source data structure and a respective target data structure from the sets of source and target data structures. The method also includes updating, by the processor device, the matching scores based on the context information. The method additionally includes controlling, by the processor device, a hardware device responsive to at least one updated matching score.

Abstract: A method, system, and computer program product, include extracting information related to one or more processes of one or more applications running on a virtual machine from a memory of the virtual machine, building at least one first application signature based on the extracted information, and identifying the one or more applications running on the virtual machine by matching the at least one first application signature with one or more second application signatures previously stored.

Abstract: A log augmentation system is provided for augmenting log management in a distributed micro-services environment. The log augmentation system includes a trigger device for triggering an augmentation process responsive to micro-service related events and a context of the micro-service related events. The log augmentation system further includes an augmentation rules database with rule management components for determining an augment direction, an augmentation target, and an augmentation correlation relating to the distributed micro-services. The log augmentation system also includes a coordinator for coordinating the augmentation process in the distributed micro-service using a rule-based decision approach. The log augmentation system additionally includes a labeler for applying a set of labels to augment log entries responsive to instructions from the coordinator derived from results of the rule-based decision approach used by the coordinator.

Abstract: Determining a characteristic of a configuration file that is used to discover configuration files in a target machine, a computer identifies, using information associated with a configuration item of a machine, a candidate configuration file related to the configuration item of the machine, from among a plurality of files from the machine. The computer extracts a value of a feature of the candidate configuration file and aggregates the candidate configuration file with a second candidate configuration file related to the same configuration item identified from among a plurality of files from a second machine, based on the extracted value. The computer then determines a configuration file related to the configuration item from among the aggregated candidate configuration files based on a result of the aggregation, and determines a characteristic of the configuration file related to the configuration item.

Abstract: Embodiments facilitating performance anomaly detection are described. A computer-implemented method comprises: detecting, by a device operatively coupled to one or more processing units, based on monitoring data of a plurality of performance metrics of a monitored device, at least one trend within the monitoring data of the respective performance metrics; removing, by the device, the at least one trend from the monitoring data of the respective performance metrics to generate modified data of the respective performance metrics; and detecting, by the device, a performance anomaly based on the modified data of the respective performance metrics and a behavior clustering model comprising at least one steady state.