Abstract: A method, a computer system, and a computer program product for security risk analysis is provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.

Abstract: A method, computer system, and a computer program for data selection is provided. The present invention may include generating a first model associated with a dataset. The present invention may further include determining a first model performance level associated with the first model based on a plurality of dataset metric values of the dataset. The present invention may further include a plurality of data subsets of a dataset based on the first model performance level failing to exceed a performance threshold and calculating a plurality of subset metric values associated with the plurality of data subsets. The present invention may further include generating a second model associated with at least one data subset based on the plurality of subset metric values and determining an optimization associated with the first model based on a second model performance level associated with the second model exceeding the performance threshold.

Abstract: Techniques that facilitate feedback loop learning between artificial intelligence systems are provided. In one example, a system includes a monitoring component and a machine learning component. The monitoring component identifies a data pattern associated with data for an artificial intelligence system. The machine learning component compares the data pattern to historical data patterns for the artificial intelligence system to facilitate modification of at least a component of the artificial intelligence system and/or one or more dependent systems of the artificial intelligence system.

Abstract: In an approach to risk prediction for bug-introducing changes, a computer retrieves one or more historic pull requests. A computer determines a unique file linking for each file included in the historic pull requests. A computer generates a file risk dataset. A computer performs chronological partitioning on the file risk dataset. A computer determines bug-introducing changes in the file risk dataset. A computer computes a collaborative file association between two or more of the files in the file risk dataset. A computer labels each of the files in the file risk dataset with an associated risk of introducing a bug. A computer generates a labelled file risk inducing ground truth dataset. A computer inputs the labelled file risk inducing ground truth dataset to a file risk prediction model. A computer extracts pull request features from the historic pull requests. A computer generates a pull request risk prediction model.

Abstract: A method, a computer system, and a computer program product for mapping operational records to a topology graph. Embodiments of the present invention may include generating an event frequent pattern using operational records. Embodiments of the present invention may include integrating topology-based event frequent patterns. Embodiments of the present invention may include mapping the operational records with an embedding engine. Embodiments of the present invention may include predicting incident events. Embodiments of the present invention may include receiving labeled patterns to the embedding engine for an active learning cycle.

Abstract: In an approach to risk prediction for bug-introducing changes, a computer retrieves one or more historic pull requests. A computer determines a unique file linking for each file included in the historic pull requests. A computer generates a file risk dataset. A computer performs chronological partitioning on the file risk dataset. A computer determines bug-introducing changes in the file risk dataset. A computer computes a collaborative file association between two or more of the files in the file risk dataset. A computer labels each of the files in the file risk dataset with an associated risk of introducing a bug. A computer generates a labelled file risk inducing ground truth dataset. A computer inputs the labelled file risk inducing ground truth dataset to a file risk prediction model. A computer extracts pull request features from the historic pull requests. A computer generates a pull request risk prediction model.

Abstract: An approach for generating actionable explanations of change request classifications may be presented. A model may generate features associated with a change request may be disclosed. The model may be trained with historical change requests that have been labeled risky or not risky. The change request may be classified as risky or not risky. Candidate historical change requests with the same classification as the change request and occupying similar feature space as the change request may be identified from a historical change request repository. One or more features which had the most significant impact on the classification may be identified. A candidate historical change request with at least one significant feature impacting classification may be identified.

Abstract: In an approach to linking operational data with issues, a new event is received. The new event is associated to a story, where the story is related to an identified problem within the system, and further where the new event is associated with the story using machine learning techniques. The story is associated to related change requests based on a similarity between the story and related change requests, where the similarity between the story and the related change requests is associated using the machine learning techniques. A cost is calculated for the story. Responsive to associating the new event with a specific change request, the priority of the specific change request is updated based on the cost for the story.

Abstract: A method, a computer system, and a computer program product for security risk analysis is provided. Embodiments of the present invention may include collecting operational data. Embodiments of the present invention may include building pipelines. Embodiments of the present invention may include localizing security issues using the operational data on an unsupervised model. Embodiments of the present invention may include constructing a semantic graph using shift-left data. Embodiments of the present invention may include constructing a mapping between the operational data and the shift-left data. Embodiments of the present invention may include clustering collected datasets. Embodiments of the present invention may include creating an active learning cycle using ground truth.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate proactive operational risk assessment of a proposed change in a computing environment are provided. According to an embodiment, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components can comprise an extraction component that identifies change events in historic operational data that induced one or more incidents in a computing environment. The computer executable components further comprise an assessment component that employs a model to assign a change risk assessment score to a defined change in the computing environment based on the change events.

Abstract: In an approach to linking operational data with issues, a new event is received. The new event is associated to a story, where the story is related to an identified problem within the system, and further where the new event is associated with the story using machine learning techniques. The story is associated to related change requests based on a similarity between the story and related change requests, where the similarity between the story and the related change requests is associated using the machine learning techniques. A cost is calculated for the story. Responsive to associating the new event with a specific change request, the priority of the specific change request is updated based on the cost for the story.

Abstract: An approach to recommending corrective action to computing system event errors. The approach may include generating a textual description of an event error. The approach may include transforming the textual description into feature vectors with a domain-specific word embedding module. The approach may also include generating a recommendation to correct the event error based on an analysis of the feature vectors. Additionally, the recommendation may be presented for verification.

Abstract: Embodiments of the present invention provide methods, computer program products, and systems. Embodiments of the present invention can dynamically determine one or more endpoints to fulfill a user request. Embodiments of the present invention can select the dynamically determined one or more endpoints as the one or more endpoints that fulfill the user request. Embodiments of the present invention can execute the selected one or more endpoints to fulfill the user request.

Abstract: A method, a computer system, and a computer program product for a shiftleft topology construction is provided. Embodiments of the present invention may include collecting datasets. Embodiments of the present invention may include extracting topological entities from the datasets. Embodiments of the present invention may include correlating a plurality of data from the topological entities. Embodiments of the present invention may include mapping the topological entities. Embodiments of the present invention may include marking entry points for a plurality of subgraphs of the topological entities. Embodiments of the present invention may include constructing a topology graph.

Abstract: Various embodiments manage the migration of servers. In one embodiment, a set of server-level dependency information is obtained for servers to be migrated from a source computing environment to a target computing environment. A set of network configuration data is obtained for a plurality of network devices associated with the servers. The set of server-level dependency information is updated to include one or more additional dependencies of at least one of the servers based on the set of network configuration data. Updating the set of server-level dependency information generates an updated set of dependency information. The servers are assigned to multiple migration groups based on the updated set of dependency information. The migration groups optimize cross-group dependencies among the migration groups.

Abstract: A computer implemented method for identifying an application topology includes identifying a sandbox environment corresponding to an application of interest, analyzing the sandbox environment to identify a set of communication links between services within the sandbox environment indicating a first topology, identifying a production system corresponding to the application of interest, querying the production system to identify a set of structural dependencies indicating a second topology, and creating a complete topology of the cloud application by combining the first topology and the second topology. A computer program product and computer system for identifying an application topology are additionally disclosed herein.

Abstract: Several aspects are provided for dynamically updating an alert-management system that uses a master ruleset to match alerts in a data processing system with automata for handling the alerts. A method comprises training a machine learning model to correlate the alerts with the automata using a training dataset comprising alerts which were successfully handled by the automata. The machine learning model is then applied to correlate unmatched alerts with the automata, wherein the unmatched alerts were not matched to the automata by the master ruleset. The method further comprises analyzing operation of the machine learning model in relation to correlation of the unmatched alerts to define a new ruleset for matching the unmatched alerts with the automata and outputting the new ruleset for auditing of each rule in the new ruleset. In response to approval of an audited rule, the audited rule is added to the master ruleset.

Abstract: An approach to recommending corrective action to computing system event errors. The approach may include generating a textual description of an event error. The approach may include transforming the textual description into feature vectors with a domain-specific word embedding module. The approach may also include generating a recommendation to correct the event error based on an analysis of the feature vectors. Additionally, the recommendation may be presented for verification.

Abstract: A computer-implemented method of cross-environment event correlation includes determining one or more correlated events about an issue across a plurality of domains. A knowledge data is extracted from the issue determined from the one or more correlated events is performed. A correlation graph is generated from the extracted knowledge to trace the issue and group the correlated events into one or more event groups to represent their relationship with the issue. A logical reasoning description is constructed based on the generated correlation graph for a domain-space exploration related to how the issue in one domain affects another domain of the plurality of domains. The one or more event groups of correlated events is provided with an explanation about a cause of the issue based on the logical reasoning description.

Abstract: Systems, computer-implemented methods, and computer program products to facilitate discovery of an inexplicit link between a change and an incident in a computing environment are provided. According to an embodiment, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components can comprise an analysis component that determines a defined link strength corresponding to links between change data and incident data in a computing environment. The computer executable components further comprise an extraction component that employs a model to identify an inexplicit link between the change data and the incident data based on the defined link strength.