Abstract: An embodiment includes detecting a set of anomalies recorded during a first predefined window of time in log entries for a computer environment. The embodiment also includes generating cluster data representative of a cluster of anomalies from among the set of anomalies, where the cluster is formed using a lattice clustering algorithm that spatially distinguishes the cluster of anomalies from other anomalies in the set of anomalies. The embodiment also includes composing an explanation using log templates generated from log entries associated with the cluster of anomalies.

Abstract: Detecting system log anomalies by receiving multivariate time-series system log data an multivariate metric data, inferring system metrics from the system log data and metric data, receiving a metric causal graph including causal relationships between system metrics, determining a univariate variation score for the system metrics, determining a causal variation score for the multivariate time series system metric data, according to the causal graph, determining an overall activity score according to the univariate variation score, and causal variation score, and altering a review window duration according to the activity score.

Abstract: A method and system is provided for utilizing a causal dependence graph of events in a large enterprise-related system to determine a most frequently utilized corrective action for a set of actions that the enterprise requires. Typically, with large sets of data related to actions that an enterprise system performs, it is non-trivial to correlate a set of actions (or workflows) with a set of corrective actions.

Abstract: Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.

Abstract: Localizing a faulty microservice in a microservice architecture is achieved by developing healthy execution sequence data for comparison to execution sequences during system failures. Oftentimes the faulty microservice does not emit a failure signal. Frequent sub-sequences arising from log template time series data during healthy execution facilitates localization of faulty services when there is no failure signal from the faulty service.

Abstract: Responsive to determining that a step in an interaction sequence has below a threshold similarity to any step in a set of log sequences, a first log entry is caused to be generated. The first log entry is emitted responsive to execution of the step in the interaction sequence by the software application. Responsive to determining that a starting key action lacks a corresponding ending key action, a second log entry is caused to be generated. The second log entry is emitted responsive to execution of code related to the corresponding ending key action by the software application. Responsive to determining, using a trained anomaly detection model, that a keyword related to an injected fault is not present in resulting fault log data, a third log entry is generated. The third log entry is emitted responsive to execution of code related to the keyword by the software application.

Abstract: Methods, systems, and computer program products for automatically detecting periods of normal activity by analyzing observability data in IT operations environments are provided herein. A computer-implemented method includes obtaining multiple types of data related to one or more artificial intelligence-related information technology operations; modelling at least a portion of the obtained data as time series data; automatically identifying, from the time series data, one or more time periods associated with one or more given levels of data activity; and performing one or more automated actions, in at least one artificial intelligence-related information technology operations environment, based at least in part on the data corresponding to the one or more identified time periods.

Abstract: Embodiments relate to a computer platform to support processing of informational logs and corresponding performance data to detect and mitigate occurrence of anomalous behavior. Metrics are extracted from the informational logs and correlated with performance data, and in an exemplary embodiment golden signal metrics. A window or block of the logs is classified as potential candidates or indicators of anomalous behavior, which in an embodiment is indicative of potential failure or service outage. A control signal is dynamically issued to an operatively coupled device associated with the window or block of logs. The control signal is configured to selectively control a state of a physical device or process controlled by software, with the control directed at mitigating or eliminating the effect(s) of the anomalous behavior.

Abstract: One embodiment provides a method, including: receiving an indication of an addition of a new participant in a textual communication between at least two existing participants; identifying at least one confidential topic contained within the textual communication by (i) parsing the textual communication and (ii) identifying at least one topic contained within the textual communication; the identifying comprising (i) accessing a confidentiality graph comprising (a) nodes representing participants and (b) edges representing confidential concepts that are acceptable discussion topics between participants connected by a corresponding edge and (ii) determining that an edge corresponding to the at least one confidential topic does not connect the new participant with both of the existing participants; and alerting one of the existing participants that the at least one confidential topic is included in the textual communication to be sent to the new participant.

Abstract: One embodiment provides a method, including: identifying, utilizing one or more sensors operatively coupled to the smart device, a user operating a smart device; inferring, based upon the identifying the user, a knowledge level of the user with respect to the smart device; determining, based in part on the knowledge level of the user, at least one input within a plurality of inputs provided by the user is anomalous with respect to a pattern of inputs utilized to execute a command; transforming, based upon the anomalous at least one input and the pattern, the plurality of inputs to a plurality of inputs matching the pattern of inputs; and executing an action based upon the transformed plurality of inputs.

Abstract: One or more systems, computer-implemented methods and/or computer program products to facilitate a process to transform original operational data into updated operational data. A system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise a transformation component that can transform original operational data of a first architecture into updated operational data employable at a second architectures, wherein the second architectures is an updated architectures relative to the first architecture. In one or more embodiments, the transformation component further can employ machine learning to match one or more data elements of the original operational data to one or more aspects of the second architecture.

Abstract: Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.

Abstract: Methods, systems, and computer program products for automatically generating datasets by processing collaboration forums using artificial intelligence techniques are provided herein.

Abstract: Methods, systems, and computer program products for automatically generating datasets by processing collaboration forums using artificial intelligence techniques are provided herein.

Abstract: Methods, computer program products, and/or systems are provided that perform the following operations: in an information technology (IT) management system, grouping one or more ongoing service failure events into a service failure record; identifying a representative event for the service failure record; identifying one or more conversations that relate to the one or more ongoing service events; computing, using a similarity algorithm, feature similarity scores for respective conversations of the one or more conversations based, at least in part, on the features associated with the representative event and features associated with the respective conversations; linking a subset of the one or more conversations to the one or more ongoing service events in the service failure record based, at least in part, on the computed feature similarity scores; and providing the service failure record to a collaboration platform utilized in addressing the one or more ongoing service events.

Abstract: Methods, systems, and computer program products for fault localization for cloud-native applications are provided herein. A computer-implemented method includes classifying an event-related alert directed to at least one system by processing one or more characteristics of the event-related alert; obtaining and processing multiple application logs based at least in part on the classification of the event-related alert; identifying error logs among the multiple application logs based at least in part on the processing of the multiple application logs; ordering the error logs using one or more prioritization techniques; and performing at least one automated action based at least in part on the ordering of the error logs.

Abstract: One embodiment provides a method, including: identifying, utilizing one or more sensors operatively coupled to the smart device, a user operating a smart device; inferring, based upon the identifying the user, a knowledge level of the user with respect to the smart device; determining, based in part on the knowledge level of the user, at least one input within a plurality of inputs provided by the user is anomalous with respect to a pattern of inputs utilized to execute a command; transforming, based upon the anomalous at least one input and the pattern, the plurality of inputs to a plurality of inputs matching the pattern of inputs; and executing an action based upon the transformed plurality of inputs

Abstract: Systems, devices, computer-implemented methods, and/or computer program products that facilitate fault localization for distributed applications. In one example, a system can comprise a process that executes computer executable components stored in memory. The computer executable components can comprise a graph compiler and a partitioning component. The graph compiler can generate a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors. The distributed application can comprise the services. The partitioning component can cluster the services into a plurality of groups using the hypernode graph and an objective function.

Abstract: Methods, systems, and computer program products for fault localization for cloud-native applications are provided herein. A computer-implemented method includes classifying an event-related alert directed to at least one system by processing one or more characteristics of the event-related alert; obtaining and processing multiple application logs based at least in part on the classification of the event-related alert; identifying error logs among the multiple application logs based at least in part on the processing of the multiple application logs; ordering the error logs using one or more prioritization techniques; and performing at least one automated action based at least in part on the ordering of the error logs.

Abstract: One embodiment provides a method, including: receiving an indication of an addition of a new participant in a textual communication between at least two existing participants; identifying at least one confidential topic contained within the textual communication by (i) parsing the textual communication and (ii) identifying at least one topic contained within the textual communication; the identifying comprising (i) accessing a confidentiality graph comprising (a) nodes representing participants and (b) edges representing confidential concepts that are acceptable discussion topics between participants connected by a corresponding edge and (ii) determining that an edge corresponding to the at least one confidential topic does not connect the new participant with both of the existing participants; and alerting one of the existing participants that the at least one confidential topic is included in the textual communication to be sent to the new participant.