Abstract: A computer-implemented method, a computer program product, and a computer system for log anomaly detection. A computer receives a windowed log of incoming raw log messages. A computer compares statistical distribution metrics of entities in the windowed log with a statistical distribution extracted from a real-time statistical model for the entities. In response to the statistical distribution metrics being statistically different from the statistical distribution extracted from the real-time statistical model for the entities, a computer tags the windowed log as an entity anomaly. A computer computes a distance between an average word embedding vector in the windowed log and a statistical distribution extracted form a real-time statistical model for word embeddings. In response to the distance being greater than a predetermined threshold, a computer tags the windowed log as a word embedding anomaly. A computer sends to a user an alert with an anomaly severity level.

Abstract: A method and system is provided for utilizing a causal dependence graph of events in a large enterprise-related system to determine a most frequently utilized corrective action for a set of actions that the enterprise requires. Typically, with large sets of data related to actions that an enterprise system performs, it is non-trivial to correlate a set of actions (or workflows) with a set of corrective actions.

Abstract: A tool for automatically generating incident management process efficiency metrics utilizing real-time communication analysis. The tool retrieves real-time conversation data from one or more communication sources, wherein the real-time conversation data includes one or more messages having data related to an information technology (IT) incident. The tool performs conversation analysis on the one or more messages. The tool determines one or more timestamps of interest for the IT incident from the one or more messages. The tool generates one or more incident management process efficiency metrics for the IT incident utilizing the one or more timestamps of interest. The tool predicts based, at least in part, on historical conversation data, an outcome for the IT incident. The tool sends the one or more incident management process efficiency metrics and the outcome for the IT incident to a user in a notification.

Abstract: A system includes a memory having instructions therein and at least one processor in communication with the memory. The at least one processor is configured to execute the instructions to determine a global-level importance magnitude value for a global-level importance of an explainable feature of a machine learning base model based on a first prediction of the machine learning base model. The at least one processor is also configured to execute the instructions to determine a global-level importance direction label for the global-level importance of the explainable feature based on the first prediction. The at least one processor is also configured to execute the instructions to generate a communication for presentation to a user based on a second prediction of the machine learning base model, based on the global-level importance magnitude value, and based on the global-level importance direction label.

Abstract: Methods, systems, and computer program products for automatically detecting periods of normal activity by analyzing observability data in IT operations environments are provided herein. A computer-implemented method includes obtaining multiple types of data related to one or more artificial intelligence-related information technology operations; modelling at least a portion of the obtained data as time series data; automatically identifying, from the time series data, one or more time periods associated with one or more given levels of data activity; and performing one or more automated actions, in at least one artificial intelligence-related information technology operations environment, based at least in part on the data corresponding to the one or more identified time periods.

Abstract: A system includes a memory having instructions therein and at least one processor in communication with the memory. The at least one processor is configured to execute the instructions to determine a global-level importance magnitude value for a global-level importance of an explainable feature of a machine learning base model based on a first prediction of the machine learning base model. The at least one processor is also configured to execute the instructions to determine a global-level importance direction label for the global-level importance of the explainable feature based on the first prediction. The at least one processor is also configured to execute the instructions to generate a communication for presentation to a user based on a second prediction of the machine learning base model, based on the global-level importance magnitude value, and based on the global-level importance direction label.

Abstract: A computer-implemented method according to one embodiment includes receiving, utilizing a processor, textual data associated with a conversation between a first participant and a second participant; receiving, utilizing the processor, an objective of the first participant for the conversation between the first participant and the second participant, where the objective is separate from the conversation; determining, utilizing the processor, a dialog act to be entered by the first participant that meets the objective, utilizing a model, including scoring a plurality of proposed dialog acts based on an amount that each proposed dialog act will change a probability of the objective being achieved during the conversation, and determining the dialog act to be entered, based on the scoring; and returning, utilizing the processor, the dialog act to the first participant.

Abstract: An approach for generating actionable explanations of change request classifications may be presented. A model may generate features associated with a change request may be disclosed. The model may be trained with historical change requests that have been labeled risky or not risky. The change request may be classified as risky or not risky. Candidate historical change requests with the same classification as the change request and occupying similar feature space as the change request may be identified from a historical change request repository. One or more features which had the most significant impact on the classification may be identified. A candidate historical change request with at least one significant feature impacting classification may be identified.

Abstract: An approach is disclosed that retrieves a set of current system data corresponding to a computer system and a set of current outputs from an anomaly detection model that is monitoring the computer system. The current system data and the anomaly detection model outputs are input to a trained anomaly detection supervisor model. The trained anomaly detection supervisor model processes the inputs and provides a set of performance data corresponding to the anomaly detection model. The anomaly detection model is then adjusted when the set of performance data indicates that the anomaly detection model is performing below a threshold.

Abstract: Embodiments provide a computer implemented method of evaluating one or more IR systems, the method including: providing, by a processor, a pre-indexed knowledge-based document to a pre-trained sentence identification model; identifying, by the sentence identification model, a predetermined number of query-worthy sentences from the pre-indexed knowledge-based document, wherein the query-worthy sentences are ranked based on a prediction probability value of each query-worthy sentence; providing, by the sentence identification model, the query-worthy sentences to a pre-trained query generation model; generating, by the query generation model, a query for each query-worthy sentence; and evaluating, by the processor, the one or more IR systems using the generated queries, wherein one or more searches are performed via the one or more IR systems, and the one or more searches are performed in a set of knowledge-based documents including the pre-indexed knowledge-based document.

Abstract: A tool for automatically generating incident management process efficiency metrics utilizing real-time communication analysis. The tool retrieves real-time conversation data from one or more communication sources, wherein the real-time conversation data includes one or more messages having data related to an information technology (IT) incident. The tool performs conversation analysis on the one or more messages. The tool determines one or more timestamps of interest for the IT incident from the one or more messages. The tool generates one or more incident management process efficiency metrics for the IT incident utilizing the one or more timestamps of interest. The tool predicts based, at least in part, on historical conversation data, an outcome for the IT incident. The tool sends the one or more incident management process efficiency metrics and the outcome for the IT incident to a user in a notification.

Abstract: One embodiment provides a method, including: monitoring a first chat channel within a distributed collaboration environment; identifying an outage affecting a service associated with the first chat channel; providing, to at least a second chat channel associated with at least a second service, a notification of the outage affecting the service, wherein the at least a second service is identified as having a dependency on the service; determining, at the at least a second chat channel, the outage is causing an incident with the at least a second service, wherein the determining comprises monitoring the at least a second chat channel for messages related to the incident; and interjecting, within the at least a second chat channel, a message regarding the outage affecting the service.

Abstract: A method, system, and a computer program product automatically select training data for updating a model by applying human-annotated training data to a model to generate results that are evaluated to identify correct case results and false case results that are categorized into error type categories for use in building error models corresponding to the error type categories, where each error model is built from at least failed case results belonging to a corresponding error type, and where unlabeled data samples are applied to each error model to compute an error likelihood for each unlabeled data sample with respect to each error type category, thereby enabling the selection and display of unlabeled data samples for annotation by a subject matter expert based on a computed error likelihood for the one or more unlabeled data samples in a specified error type category meeting or exceeding an error threshold requirement.

Abstract: An enhanced information retrieval system takes a customer utterance and constructs a contextually-enriched content-based query allowing the system to retrieve the most relevant documents to assist an agent in a real-time conversation with the customer. Phrases in the utterance are classified as informational or non-informational using a machine learning system trained with phrases from prior conversations of multiple users. Content phrases are extracted from the informational phrases using keyword extraction (ranking noun phrases), intent/action extraction (semantic role labeling), and topic label extraction (clustering of historical logs). Emotional content is identified using a sequence tagging model and removed. Contextual information from prior conversations with this user is combined with the updated content phrases to create the contextually-enhanced content-based query, which can then be submitted to the information retrieval system.

Abstract: A method, system and a computer program product are provided for aligning embeddings of multiple languages and domains into a shared embedding space by transforming monolingual embeddings into a multilingual embeddings in a first shared embedding space using a cross-lingual learning process, and then transforming the multilingual embeddings into cross-domain, multilingual embeddings in a second shared embedding space using a cross-domain learning process.

Abstract: In an approach for training customer service agents using persona-based chatbots, a processor retrieves customer service interaction information. A processor analyzes, using natural language processing, the customer service interaction information, wherein the analyzing includes preprocessing and aggregating the customer service interaction information. A processor interacts with a user. A processor provides feedback to the user, based on the user's style and performance during training.

Abstract: A method, computer program product and computer system is provided. A processor identifies a cloud service offered by a service provider. A processor determines at least one feature of the cloud service. A processor determines a first categorization of the cloud service based, at least in part, on the at least one feature. A processor generates a publication of the cloud service for a cloud marketplace based, at least in part, on the first categorization and a second categorization of the cloud marketplace.

Abstract: A method for log data sampling is disclosed. The method includes receiving logs of a computer system. A log comprises information regarding an operation of the computer system. The method also includes determining a sample of the logs by applying a set of sampling methods to the logs. The method further includes providing the sample of the logs as an input to an anomaly detection model for the computer system. The anomaly detection model identifies a fault in the operation of the computer system based on the input.

Abstract: Mechanisms are provided to implement a brand personality inference engine. The mechanisms receive crowdsource information and extract features associated with a brand from the crowdsource information. The crowdsource information comprises natural language content submitted by a plurality of providers to a crowdsource information source. The mechanisms analyze features associated with the brand in accordance with a brand personality model configured to predict a brand personality for the brand based on the features associated with the brand. The mechanisms generate an inferred brand personality data structure, representing a perceived brand personality of providers providing the crowdsource information, and output an output indicating aspects of the perceived brand personality based on the inferred brand personality data structure.

Abstract: A method for log data sampling is disclosed. The method includes receiving logs of a computer system. A log comprises information regarding an operation of the computer system. The method also includes determining a sample of the logs by applying a set of sampling methods to the logs. The method further includes providing the sample of the logs as an input to an anomaly detection model for the computer system. The anomaly detection model identifies a fault in the operation of the computer system based on the input.