Abstract: A method, computer program product, and computer system are described for providing decision instructions for problem incidents in information technology (IT) systems. The method includes categorizing incident instances as incident types, where an incident instance includes one or more events having resources identifying one or more hosts specific to the incident instance and wherein an incident type categorizes incident instances having a common underlying problem with the incident type having generalized resources. The method includes generating decision instructions for an incident type wherein the decision instructions provide generalized command steps for interacting with hosts for the resolution of incident instances of the incident type.

Abstract: Method and system are provided for user authentication using original and modified images. The method includes receiving an original image for a user, where the original image is a private image that meets certain configured criteria. The method uses a pre-trained Convolutional Neural Network (CNN) model to extract one or more image features of the original image and feeds the extracted image feature into a Generative Adversarial Network (GAN) image generator to realistically modify the extracted image feature to generate a modified image. The method authenticates a user based on recognition of a presented original image or a presented modified image.

Abstract: A computer-implemented method for generation of dashboard templates for operations management is disclosed. The computer-implemented method includes monitoring a user interactions with an editable dashboard user interface when handling issue instances to gather chart selections, wherein a chart is a graphical visualization of one or more parameters of a data source. The computer-implemented method further includes identifying an issue type to chart pairs from the gathered chart selections and, for each pair, generalizing the one or more data source parameters. The computer-implemented method further includes identifying from the gathered chart selections common associations between the issue type and a chart visualization type.

Abstract: Computer hardware and/or software that performs the following operations: (i) identifying rules for relating events in an event monitoring system; (ii) determining an event window having a set of related events within a particular time window, based, at least in part, on the rules; (iii) classifying the event window as actionable by applying a machine learning based classification model to information pertaining to the event window, the information originating from a plurality of data sources; and (iv) creating an event ticket for the event window in the event monitoring system.

Abstract: Scalable mining method, computer system and computer program product for temporally correlated events that works with input data that is non-transactional in nature and detects high correlation relationships between events with low support thresholds. The scalable mining method manages a large scale of input data by executing the mining process in a distributed manner in a clustered cloud environment via nodes.

Abstract: Embodiments are disclosed for a method. The method includes, for each of multiple vertices, generating a vertex weighting representative of a relative importance of a vertex within the network topology. The method also includes, for each of the one or more edges, generating an edge weighting representative of a relative importance of an edge within the network topology. Further, the method includes generating the abstract graph of the network topology based on a plurality of vertex weightings and one or more edge weightings.

Abstract: A method, a computer program product, and a computer system co-assign operators to service an incident with a first operator educating a second operator of skills used in servicing the incident. The method includes determining a type of incident and determining a command group used for the type of incident according to a first mapping based on historical resolutions of historical incidents. The method includes determining the first operator for co-assignment according to a second mapping based on successful historical resolutions of historical incidents by the first operator. The method includes determining the second operator for the co-assignment according to the second mapping that further maps the command group and the second operator based on a lack of experience in using the command group. The method includes co-assigning the incident to the first operator and the second operator.

Abstract: A method for dynamically generating an optimized processing pipeline for tasks is provided. The method identifies one or more tasks to be executed from defined tasks that are defined declaratively as a number of stages of input data, data transformations, and output data. The method processes the identified tasks to determine dependencies between the tasks based on their defined stages and creates one or more optimized data processing pipelines by performing a dependency resolution procedure on stages of all tasks in parallel using the task dependencies to determine the order of the stages and removing duplication of stages between tasks.

Abstract: Runbook deployment based on confidence evaluation. Obtaining a runbook based on commands, where the commands relate to resolving an incident and determining an aggregated skill level of operators for the runbook based on historical resolutions of incidents by the operators. A confidence measure of the runbook is determined according to the aggregated skill level for the runbook. Deployment of the runbook is performed in accordance with the confidence measure.

Abstract: Method and system are provided for user authentication using original and modified images. The method includes receiving an original image for a user, where the original image is a private image that meets certain configured criteria. The method uses a pre-trained Convolutional Neural Network (CNN) model to extract one or more image features of the original image and feeds the extracted image feature into a Generative Adversarial Network (GAN) image generator to realistically modify the extracted image feature to generate a modified image. The method authenticates a user based on recognition of a presented original image or a presented modified image.

Abstract: Method and system are provided for identifying problem graphs in an information technology infrastructure network. The method includes: selecting a set of nodes in a topology, wherein the nodes of the topology represent resources in an information technology infrastructure network; querying historical timeseries data for the selected nodes, wherein the timeseries data records changes in state of the resources represented by the nodes; and analyzing the timeseries data for the selected nodes across problem time periods to produce a set of historical directional rules defining one or more historic problem graph. The method may search the historic problem graphs for current problem state nodes to determine likely causing nodes and affected nodes of a current problem.

Abstract: A computer-implemented method for generation of dashboard templates for operations management is disclosed. The computer-implemented method includes monitoring a user interactions with an editable dashboard user interface when handling issue instances to gather chart selections, wherein a chart is a graphical visualization of one or more parameters of a data source. The computer-implemented method further includes identifying an issue type to chart pairs from the gathered chart selections and, for each pair, generalizing the one or more data source parameters. The computer-implemented method further includes identifying from the gathered chart selections common associations between the issue type and a chart visualization type.

Abstract: A method for dynamically generating an optimized processing pipeline for tasks is provided. The method identifies one or more tasks to be executed from defined tasks that are defined declaratively as a number of stages of input data, data transformations, and output data. The method processes the identified tasks to determine dependencies between the tasks based on their defined stages and creates one or more optimized data processing pipelines by performing a dependency resolution procedure on stages of all tasks in parallel using the task dependencies to determine the order of the stages and removing duplication of stages between tasks.

Abstract: Runbook deployment based on confidence evaluation. Obtaining a runbook based on commands, where the commands relate to resolving an incident and determining an aggregated skill level of operators for the runbook based on historical resolutions of incidents by the operators. A confidence measure of the runbook is determined according to the aggregated skill level for the runbook. Deployment of the runbook is performed in accordance with the confidence measure.

Abstract: An approach for training a recurrent neural network to create a model for anomaly detection in the topology of a network is disclosed. The approach comprises, creating an embedding vector for each resource in the network based on applying an embedding algorithm to each resource of the network. A feature vector is then created for each change to a resource in the network based on one or more properties of the change. A recurrent neural network can thus be trained with the embedding vectors and the feature vectors to create a model for anomaly detection in the topology of the network.

Abstract: Topology information including a plurality of snapshots of a network topology associated with respective points in time for a network can be received by an apparatus. Each snapshot is represented as a graph of nodes each corresponding to a network resource and having a node identifier. The graph for each snapshot is modified by replacing nodes representing network resources having the same role in the network with a single aggregated node. Feature learning is performed based on the modified graphs representing the plurality of snapshots, and determines a feature representation for each node in the modified graphs. An identifier for each node in the plurality of snapshots is associated with the corresponding feature representation for use in the correlation of network resources. Node identifiers for nodes in the same aggregated node in a modified graph are associated with the same feature representation.

Abstract: Scalable mining method, computer system and computer program product for temporally correlated events that works with input data that is non-transactional in nature and detects high correlation relationships between events with low support thresholds. The scalable mining method manages a large scale of input data by executing the mining process in a distributed manner in a clustered cloud environment via nodes.

Abstract: A method, a computer program product, and a computer system co-assign operators to service an incident with a first operator educating a second operator of skills used in servicing the incident. The method includes determining a type of incident and determining a command group used for the type of incident according to a first mapping based on historical resolutions of historical incidents. The method includes determining the first operator for co-assignment according to a second mapping based on successful historical resolutions of historical incidents by the first operator. The method includes determining the second operator for the co-assignment according to the second mapping that further maps the command group and the second operator based on a lack of experience in using the command group. The method includes co-assigning the incident to the first operator and the second operator.

Abstract: Generation, by machine logic, of runbooks for problem events. Generation of runbooks including the following operations: receiving operator commands in a command line interface for an event group relating to an issue, wherein the operator commands resolve the issue; and storing the operator commands as related artifacts of the event group with mapping to affected resources. The method may match arguments of the operator commands to event metadata fields of events in the event group to generalize the arguments to the event metadata and to generate a runbook of generalized operator commands for future instances of an event group of a similar type.

Abstract: Topology information including a plurality of snapshots of a network topology associated with respective points in time for a network can be received by an apparatus. Each snapshot is represented as a graph of nodes each corresponding to a network resource and having a node identifier. The graph for each snapshot is modified by replacing nodes representing network resources having the same role in the network with a single aggregated node. Feature learning is performed based on the modified graphs representing the plurality of snapshots, and determines a feature representation for each node in the modified graphs. An identifier for each node in the plurality of snapshots is associated with the corresponding feature representation for use in the correlation of network resources. Node identifiers for nodes in the same aggregated node in a modified graph are associated with the same feature representation.