Abstract: In some implementations, a computing device may receive a set of loglines and a problem description associated with the set of loglines. The computing device may identify clusters of loglines, from the set of loglines, based at least in part on structures of the set of loglines. The computing device may identify key indicators associated with a subset of loglines of respective clusters of loglines. The computing device may apply the key indicators to the respective clusters. The computing device may perform error analysis on the set of loglines based at least in part on the key indicators.

Abstract: Systems, methods, and techniques that facilitate application fingerprint generation are provided. One or more embodiments described herein can comprise a computer-implemented method comprising determining, by a device operatively coupled to a processor, fault proneness of one or more microservices regarding one or more fault categories, generating, by the device, an ordered seed set of the one or more microservices based on the determined fault proneness, generating, by the device, an augmented ordered seed set of the one or more microservices based on topological relationships of the one or more microservices and based on the ordered seed set, and building, by the device, a set of one or more patterns of resource constraint faults and a set of one or more patterns of entity experience faults based on the augmented ordered seed set of the one or more microservices.

Abstract: Methods, systems, and computer program products for automatically classifying heterogeneous documents using machine learning techniques are provided herein. A computer-implemented method includes extracting multiple features from one or more sets of heterogeneous documents; arranging at least a portion of the extracted features into multiple hierarchically-defined classes; selecting one or more of the documents associated with each of the multiple hierarchically-defined classes; training at least one machine learning model using at least a portion of the selected documents; and automatically classifying at least one input document into one or more of the multiple hierarchically-defined classes by processing one or more portions of the at least one input document using the at least one trained machine learning model.

Abstract: An approach is provided for controlling an alert suppression policy. Using historical training data and for a time period, an expected alert reduction for an alert suppression policy (ASP) is computed. The ASP is recommended for an information technology (IT) environment. During runtime and for the time period, an observed alert reduction for the ASP is computed. A visualization of a benefit of the ASP is generated by generating a visualization of a comparison of the observed alert reduction and the expected alert reduction. An explanation of why the ASP is recommended for the IT environment is generated by determining persistent regions for respective event time series from the historical training data and generating a visualization of the persistent regions on a time graph that includes a duration and a number of events for a given persistent region. Each event time series corresponds to a given resource for the ASP.

Abstract: A technique for classifying and handling threat data in a rules-based security system. For each rule in the set, a set of one or more first tags are generated. The tags categorize the rule according to a hierarchical scheme. In response to receipt of a new threat, the system automatically determines whether the existing set of rules provide an acceptable coverage for the new threat. This determination is made by generating a set of one or more second tags that categorize the new threat, and then comparing the set of one or more second tags with the set of one or more first tags according to given match criteria. Upon a determination that the set of rules do not provide an adequate coverage for the new threat, a recommendation is output from the system. The rules-based security system is then adjusted according to the recommendation for subsequent handling of the new threat.

Abstract: Systems, methods, and techniques that facilitate application fingerprint generation are provided. One or more embodiments described herein can comprise a computer-implemented method comprising determining, by a device operatively coupled to a processor, fault proneness of one or more microservices regarding one or more fault categories, generating, by the device, an ordered seed set of the one or more microservices based on the determined fault proneness, generating, by the device, an augmented ordered seed set of the one or more microservices based on topological relationships of the one or more microservices and based on the ordered seed set, and building, by the device, a set of one or more patterns of resource constraint faults and a set of one or more patterns of entity experience faults based on the augmented ordered seed set of the one or more microservices.

Abstract: A data performance measurement of a computer system is measured. A future value of the data performance measurement is forecasted by executing a forecasting model. A set of throughput model input parameters is configured. A throughput requirement for the computer system is computed by executing a throughput model using the set of throughput model input parameters and the future value of the data performance measurement. A capacity requirement corresponding to the throughput requirement is determined. A resource within the computer system is deployed according to the capacity requirement.

Abstract: A method includes receiving, by a computing device, concepts of a domain; determining, by the computing device, objects relevant to the concepts; generating, by the computing device, a new image by stitching the relevant objects together; determining, by the computing device, whether the new image is accurate or inaccurate; and in response to determining the new image is inaccurate, propagating, by the computing device, the inaccurate new image back to a convolutional neural network (CNN).

Abstract: A system, method, and computer program product for implementing artificial intelligence module communication is provided. The method includes generating models associated with communications between real-time artificial intelligence modules. Classifiers associated with the models are generated and a master real-time artificial intelligence module associated with the modules and classifiers is detected. Real-time artificial intelligence modules are detected and communications between the master real-time artificial intelligence module and the real-time artificial intelligence modules are initiated. Updated classifiers, updated models, and updated self learning software are generated. The updated self learning software is executed and a resulting query associated with a Web search is executed.

Abstract: Techniques are provided for dynamic alert suppression policy management. In one embodiment, the techniques involve receiving an event stream, wherein the event stream includes metric values comprising at least one of: log anomaly data and metric anomaly data, determining an anomalous event based on the event stream, determining a persistent region of the anomalous event, determining a quantum representation of the persistent region, determining X-Y values of the persistent region based on the quantum representation, and generating a policy based on a set of the X-Y values.

Abstract: Localizing a faulty microservice in a microservice architecture is achieved by developing healthy execution sequence data for comparison to execution sequences during system failures. Oftentimes the faulty microservice does not emit a failure signal. Frequent sub-sequences arising from log template time series data during healthy execution facilitates localization of faulty services when there is no failure signal from the faulty service.

Abstract: Techniques are provided for dynamic alert suppression policy management. In one embodiment, the techniques involve receiving an event stream, wherein the event stream includes metric values comprising at least one of: log anomaly data and metric anomaly data, determining an anomalous event based on the event stream, determining a persistent region of the anomalous event, determining a quantum representation of the persistent region, determining X-Y values of the persistent region based on the quantum representation, and generating a policy based on a set of the X-Y values.

Abstract: An approach is provided for determining a carbon footprint-based consumption of cloud resources. Cloud resource requirements and a carbon footprint cap of a workload of a cloud consumer are received. The requirements and cap are based on a sustainability target, published by the cloud consumer, and subscribed by cloud service providers. A list of cloud resources that satisfy the requirements are sent. Carbon emission values of the cloud resources at different load levels of the workload are sent. Based on a service level agreement requirement, a criticality level, and a peak load duration of the workload, and previous success rates of satisfying cloud resource requirements by cloud service providers, an optimized configuration of cloud resource(s) and cloud service provider(s) is selected. The cloud resource(s) are selected from the list and have a carbon footprint that does not exceed the cap at a given load level.

Abstract: A computer-implemented method and a computer system for identifying persistent anomalies for failure prediction. The computer system receives a time series data stream. The computer system received a predetermined number N and a predetermined number M which is a fraction of N. The computer system segments the time series data stream into N consecutive sliding windows. The computer system performs supervised persistent anomaly detection to determine whether anomalies across the N consecutive sliding windows are persistent, by using a binary classification model. The computer system performs unsupervised persistent anomaly detection to determine whether the anomalies across the N consecutive sliding windows are persistent. The computer system combines results of the supervised persistent anomaly detection and results of the unsupervised persistent anomaly detection to determine persistent anomalies.

Abstract: Systems, methods and/or computer program products maximizing answer coherence of virtual agents responding to multi-part user queries, using relationships among extracted chunks corresponding to support document(s). Relationships are extracted by mining entities from text and images of support document(s) and mapping entities to an otology. Induced subgraphs for chunks, based on extracted entities are created and compared. Depending on amounts of overlap and/or relationships between subgraphs, relationships among chunks are identified. Chunks relationships can be complementary, contained within one another, instances of one another, or not related at all. For a given multi-part query, a query answer graph is created comprising answer nodes corresponding to potential answer candidates associated with each chunk.

Abstract: A method of sensor enabled vehicle repair validation is provided including obtaining pre-repair sensor data from at least some pre-repair components of a vehicle. Post-repair sensor data is obtained from at least some post-repair components of the vehicle. The vehicle repair validation is performed by comparing the obtained post-repair sensor data to the obtained pre-repair sensor data using a difference model.

Abstract: A method, system, and computer program product for diagnosing IT logs based on events are configured to: receive a notification of an incident associated with an application; obtain data defining a set of events related to the application for a predefined range of time; create a timeseries of each type of event in the set of events; compute an event change score for each respective type of event for windows of the range of time based the timeseries of the respective type of event; compute an overall score for each of the windows based on the respective event change scores of the respective event types for each of the windows; and identify respective ones of the windows as a region of interest based on the overall score of the respective ones of the windows exceeding a threshold.

Abstract: Techniques are described regarding log data comprehension in a computing environment. An associated computer-implemented method includes inducting data into a knowledge base associated with a log comprehension machine learning knowledge model in order to configure a common log schema. The method further includes extracting at least one key-value pair from a log file including input data associated with at least one downstream application and deriving at least one value feature and any key signal associated with the at least one key-value pair. The method further includes applying the log comprehension machine learning knowledge model in order to compare data associated with the at least one key-value pair extracted from the log file with knowledge base node key-value pair data. The method further includes creating mapping results formatted according to the common log schema and compatible with the at least one downstream application based upon the model application.

Abstract: A technique for classifying and handling threat data in a rules-based security system. For each rule in the set, a set of one or more first tags are generated. The tags categorize the rule according to a hierarchical scheme. In response to receipt of a new threat, the system automatically determines whether the existing set of rules provide an acceptable coverage for the new threat. This determination is made by generating a set of one or more second tags that categorize the new threat, and then comparing the set of one or more second tags with the set of one or more first tags according to given match criteria. Upon a determination that the set of rules do not provide an adequate coverage for the new threat, a recommendation is output from the system. The rules-based security system is then adjusted according to the recommendation for subsequent handling of the new threat.

Abstract: An unmanned vehicle includes a body, a propulsion system connected to the body, a computing system connected to the body, and a display connected to an exterior of the body and electrically connected to the computing system. In addition, the computing system is configured to dynamically change the appearance of the display during operation of the unmanned vehicle.