Abstract: Mechanisms are provided that detect an anomaly in performance of a hybrid application based on a specification of required performance and collected passive monitoring data, and that generate a causal generative model based on relationships between hybrid application components and computing system architecture components extracted from the passive monitoring data. Root cause identification (RCI) logic is executed on the causal generative model to identify a set of candidate root causes of the detected anomaly. One or more probes are identified for active monitoring data collection targeting the identified set of candidate root causes, which are then executed to collect probe data. Reinforcement learning is performed of the RCI logic to update the RCI logic based on the probe data. The set of candidate root causes is updated based on the reinforcement learning.

Abstract: A method, system, and computer program product that is configured to: train at least one model based on a corpus of historical data comprising annotated historical tickets; extract a textual sequence of a historical ticket based on the at least one trained model; determine a sentiment of the textual sequence of the historical ticket; and generate mitigation guidance to mitigate an issue in a current ticket based on the textual sequence of the historical ticket and the determined sentiment of the textual sequence of the historical ticket.

Abstract: A method, system, and computer program product for estimating propagation time for an injected fault are configured to: determine normal execution times of respective services in a call graph of an application; determine normal execution times of respective network communications between ones of the services; determine faulty execution times of respective ones of the services; and generate a propagation time for a particular type of fault injected at a particular fault injection location in the call graph based on the determined normal execution times of respective services, the determined normal execution times of respective network communications, and the determined faulty execution times of respective ones of the services.

Abstract: In an approach to improve enhancing the provisioning cloud resources, embodiments receive a set of potential cloud resource providers and predict a performance for a distributed workload on each potential provider of the set according to a machine learning model. Additionally, embodiments inject fault into the set of potential cloud resource providers and measure an impact of the injected fault upon system performance. Embodiments utilize the injected fault to create a system intervention to ensure that the system intervention is carried out on a network in predetermined system. Further, embodiments provision the distributed workload among the potential cloud resource providers according to dynamic conditions output by the set of potential cloud resources based on the measured impact of the injected fault.

Abstract: Embodiments of the present invention provide methods, computer program products, and systems. Embodiments of the present invention can dynamically determine one or more endpoints to fulfill a user request. Embodiments of the present invention can select the dynamically determined one or more endpoints as the one or more endpoints that fulfill the user request. Embodiments of the present invention can execute the selected one or more endpoints to fulfill the user request.

Abstract: Embodiments for intelligent application scenario testing and error detection by a processor. One or more modified application scenarios may be automatically generated from an initial application scenario having configuration data and a plurality of operations relating to an error. The one or more modified application scenarios are variations of the initial application. The one or more modified application scenarios may be executed to detect the existence or non-existence of the error in the one or more modified application scenarios.

Abstract: A method, a computer system, and a computer program product for security risk analysis is provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.

Abstract: Systems, computer-implemented methods, and computer program products that can facilitate refinement of a predicted event based on explainability data are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise an interpreter component that identifies a probable cause of a predicted event based on explainability data. The computer executable components can further comprise an enrichment component that executes a diagnostic analysis based on the probable cause.

Abstract: A method, computer system, and a computer program for data selection is provided. The present invention may include generating a first model associated with a dataset. The present invention may further include determining a first model performance level associated with the first model based on a plurality of dataset metric values of the dataset. The present invention may further include a plurality of data subsets of a dataset based on the first model performance level failing to exceed a performance threshold and calculating a plurality of subset metric values associated with the plurality of data subsets. The present invention may further include generating a second model associated with at least one data subset based on the plurality of subset metric values and determining an optimization associated with the first model based on a second model performance level associated with the second model exceeding the performance threshold.

Abstract: An approach for end-to-end anomaly detection and anomalous patterns identification is disclosed. The approach leverages the use of a GMM-LASSO (a selection operator-type, Lasso-type, generalized method of moments (GMM) estimator) algorithm and proposes a feedback loop where the window (i.e., anomalous window) is detected and then it is used to detect the anomalous patterns. For example, the approach can classify one or more sequential data; generates one or more vectors based on the one or more sequential data; clusters the one or more vectors into one or more clusters; determines a membership of the one or more vectors associated with the one or more clusters; updates the one or more clusters; and optimizes the one or more clusters with respect to a predefined threshold.

Abstract: A method, a computer program product, and a computer system handle a data gap in sequential data. The method includes receiving the sequential data for a period of time. The method includes selecting the data gap in the sequential data at a timestamp. The method includes determining a sliding window associated with the data gap based on the timestamp for a duration of time. The sliding window includes dependent data from which the data gap depends. The method includes, as a result of the dependent data of the sliding window including at least one window data gap, generating extracted patterns based on the dependent data to mask the at least one window data gap. The method includes determining a prediction to fill the data gap using a prediction model that takes as input modified data based on the dependent data and the extracted patterns.

Abstract: Localizing a faulty microservice in a microservice architecture is achieved by developing healthy execution sequence data for comparison to execution sequences during system failures. Oftentimes the faulty microservice does not emit a failure signal. Frequent sub-sequences arising from log template time series data during healthy execution facilitates localization of faulty services when there is no failure signal from the faulty service.

Abstract: Techniques that facilitate feedback loop learning between artificial intelligence systems are provided. In one example, a system includes a monitoring component and a machine learning component. The monitoring component identifies a data pattern associated with data for an artificial intelligence system. The machine learning component compares the data pattern to historical data patterns for the artificial intelligence system to facilitate modification of at least a component of the artificial intelligence system and/or one or more dependent systems of the artificial intelligence system.

Abstract: Embodiments relate to a computer platform to support processing of informational logs and corresponding performance data to detect and mitigate occurrence of anomalous behavior. Metrics are extracted from the informational logs and correlated with performance data, and in an exemplary embodiment golden signal metrics. A window or block of the logs is classified as potential candidates or indicators of anomalous behavior, which in an embodiment is indicative of potential failure or service outage. A control signal is dynamically issued to an operatively coupled device associated with the window or block of logs. The control signal is configured to selectively control a state of a physical device or process controlled by software, with the control directed at mitigating or eliminating the effect(s) of the anomalous behavior.

Abstract: Systems, computer-implemented methods, and computer program products that can facilitate refinement of a predicted event based on explainability data are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise an interpreter component that identifies a probable cause of a predicted event based on explainability data. The computer executable components can further comprise an enrichment component that executes a diagnostic analysis based on the probable cause.

Abstract: Systems, computer-implemented methods, and computer program products that can facilitate refinement of a predicted event based on explainability data are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise an interpreter component that identifies a probable cause of a predicted event based on explainability data. The computer executable components can further comprise an enrichment component that executes a diagnostic analysis based on the probable cause.

Abstract: In an approach to risk prediction for bug-introducing changes, a computer retrieves one or more historic pull requests. A computer determines a unique file linking for each file included in the historic pull requests. A computer generates a file risk dataset. A computer performs chronological partitioning on the file risk dataset. A computer determines bug-introducing changes in the file risk dataset. A computer computes a collaborative file association between two or more of the files in the file risk dataset. A computer labels each of the files in the file risk dataset with an associated risk of introducing a bug. A computer generates a labelled file risk inducing ground truth dataset. A computer inputs the labelled file risk inducing ground truth dataset to a file risk prediction model. A computer extracts pull request features from the historic pull requests. A computer generates a pull request risk prediction model.

Abstract: Embodiments of the present invention provide computer-implemented methods, computer program products and systems. Embodiments of the present invention can receive position and location information. Embodiments of the present invention can generate a risk score for one or more maneuvers associated with a predicted trajectory of a vehicle. Embodiments of the present invention can generate a visual representation for each of the one or more maneuvers associated with the predicted trajectory of the vehicle based on the generated risk score associated with each maneuver. Embodiments of the present invention can integrate the generated visual representation into a user display.

Abstract: In an approach to risk prediction for bug-introducing changes, a computer retrieves one or more historic pull requests. A computer determines a unique file linking for each file included in the historic pull requests. A computer generates a file risk dataset. A computer performs chronological partitioning on the file risk dataset. A computer determines bug-introducing changes in the file risk dataset. A computer computes a collaborative file association between two or more of the files in the file risk dataset. A computer labels each of the files in the file risk dataset with an associated risk of introducing a bug. A computer generates a labelled file risk inducing ground truth dataset. A computer inputs the labelled file risk inducing ground truth dataset to a file risk prediction model. A computer extracts pull request features from the historic pull requests. A computer generates a pull request risk prediction model.

Abstract: A method, a computer system, and a computer program product for mapping operational records to a topology graph. Embodiments of the present invention may include generating an event frequent pattern using operational records. Embodiments of the present invention may include integrating topology-based event frequent patterns. Embodiments of the present invention may include mapping the operational records with an embedding engine. Embodiments of the present invention may include predicting incident events. Embodiments of the present invention may include receiving labeled patterns to the embedding engine for an active learning cycle.