Abstract: Systems and methods for generative artificial intelligence-based incidents management are disclosed. A method may include: receiving a user query from a user interface computer program executed by a user electronic device; determining that the user query is ambiguous; providing the user query to a disambiguation agent, wherein the disambiguation agent returns a plurality of disambiguated user queries for the user query; presenting the plurality of disambiguated user queries to the user interface computer program; receiving a selection of one of the disambiguated user queries from the user interface computer program; generating Structured Query Language (SQL) for the selected disambiguated user query; executing the SQL for the selected disambiguated user query on a database; and returning results of the execution of the SQL for the selected disambiguated user query on the database to the user interface computer program.

Abstract: Systems and methods for anomaly detection in software-defined networks from observed host metrics are disclosed. A method may include: (1) training a random forest model comprising a plurality of trees with historical metrics from a software defined network, the software defined network comprising a plurality of hosts; (2) receiving metrics for a plurality of features from the hosts in the software defined network; (3) providing the metrics to the trained random forest model; (4) receiving, from the trained random forest model, a prediction of an anomalous hosts for one of the hosts; (5) identifying a subset of the plurality of trees that contributed to the prediction; (6) generating feature scores for the feature from the subset of trees; (7) generating an anomaly score for the feature based on the feature scores and an explanation; and (8) executing an automated action in response to the anomaly score.

Abstract: Disclosed are methods and techniques of detecting network anomalies and responding to the anomalies once detected. The methods, for example, include receiving, by a model executed by a processor, real-time log data of an operating network; parsing, by the model executed by the processor, the log data to identify one or more metrics; determining, by the model executed by the processor, a seasonality of the one or more metrics; determining whether the model should use an autoregressive model if seasonality is detected; and on determining that an autoregressive model should be used, training a model based on determining a grid search for a parameter based on an Akaike information criterion.

Abstract: A method may include: receiving an identification of a current incident involving an affected element; generating a first Structured Query Language (SQL) query for recently-implemented change records for the affected element; executing the first SQL query on a database; receiving the recently-implemented change records for the affected element; generating a second SQL query for past incidents that are similar to the current incident; executing the second SQL query on the database; receiving the past incidents that are similar to the current incident, together with associated change records that were identified to be a cause of the past incidents; calculating a relevance score of each recently-implemented change record to the current incident, based on a similarity of the past change records that caused similar incidents; and returning the past change record for the affected element that is similar to the past change record for any element with a highest score.

Abstract: Systems and methods for enhanced conversational performance of large language models using adaptive retrieval-augmented generation are disclosed. A method may include: (1) receiving a query from a user; (2) retrieving a plurality of summaries of historical conversations from a database of historical conversation summaries similar to the query; (3) generating a first prompt comprising the query and the plurality of summaries; (4) submitting the first prompt to a first large language model (LLM); (5) receiving, from the first LLM, a first response; (6) presenting the first response to the user; (7) generating a second prompt for a summary of the query and the first response; (8) submitting the second prompt to a second LLM; and (9) saving a second response to the second prompt from the second LLM to the database of historical conversation summaries, wherein the second response comprises the summary.

Abstract: Systems and methods for anomaly detection in network devices are disclosed. A method may include: receiving a plurality of log messages from a data source; creating an offline anomaly detection model by: performing statistical modelling on the log messages from each network device; creating a log template for each log message based on static and variables parts of the log message; creating a template dictionary of log templates for each network device; creating a log template distribution; and creating template variables; receiving streaming data comprising log files from a plurality of network devices; aggregating the streaming data for each network device for a period of time; identifying an anomaly in the aggregated streaming data using the offline anomaly detection model; classifying the anomaly as a rate anomaly, a time anomaly, or a variable anomaly; and executing a self-healing action based on the classification.

Abstract: In some aspects, the techniques described herein relate to a method including: receiving, at an alarm management service, a plurality of alarms, wherein each of the plurality of alarms includes respective alarm data; clustering the plurality of alarms into an alarm cluster group; generating a plurality of binary time sequences, wherein each of the plurality of binary time sequences corresponds to one of the plurality of alarms; generating an initial alarm graph based on the alarm cluster group and the plurality of binary time sequences; providing, as input to a causal inference process, the initial alarm graph and the plurality of binary time sequences; and generating, by the causal inference process, a causal alarm graph, wherein the causal alarm graph is a partially connected and directed graph.

Abstract: Systems and methods for anomaly detection in software-defined networks from observed host metrics are disclosed. A method may include: (1) training a random forest model comprising a plurality of trees with historical metrics from a software defined network, the software defined network comprising a plurality of hosts; (2) receiving metrics for a plurality of features from the hosts in the software defined network; (3) providing the metrics to the trained random forest model; (4) receiving, from the trained random forest model, a prediction of an anomalous hosts for one of the hosts; (5) identifying a subset of the plurality of trees that contributed to the prediction; (6) generating feature scores for the feature from the subset of trees; (7) generating an anomaly score for the feature based on the feature scores and an explanation; and (8) executing an automated action in response to the anomaly score.