# US 10,310,933 B2 · Near real-time system or network incident detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,310,933 B2
- Document ID: US10310933B2
- Status: Granted
- Kind: B2
- Application number: 15/406,253
- Filed: 2017-01-13
- Published: 2018-07-19
- Granted: 2019-06-04
- Earliest claimed: 2017-01-13
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Charles C. Howie; DeAundra K. Glover; Jesse Price; Aaron Kephart
- Web page: https://patentgrep.com/patent/US10310933B2

## CPC

- G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)}
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/3452: {Performance evaluation by statistical analysis}
- G06F 11/3495: {for systems}
- G06F 16/951: Indexing; Web crawling techniques
- G06F 16/953: Querying, e.g. by the use of web search engines
- G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q 10/063: Operations research, analysis or management
- G06N 20/00: Machine learning
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Systems and arrangements for pre-processing data to detect and analyze system, application, or the like, incidents to identify incidents likely to cause a significant business impact are provided. Historical data related to incidents that previously occurred may be analyzed to quantify an impact of each incident. The quantified impact may be compared to a threshold and, if the impact above the threshold, the incident may be flagged as having a significant business impact. If the impact is below the threshold, the incident may be flagged as not having a significant business impact. Upon detecting an incident, data from the incident may be compared to the historical data of incidents having a significant business impact. If aspects of the incident are similar to one or more incidents having a significant business impact, the system may determine that the newly received incident is also likely to cause a significant business impact.

## Claims

### Claim 1

A system or network incident detection and analysis computing system, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
at least one memory storing computer-readable instructions that, when executed by the at least one processor, cause a pre-processing computing device of the system or network incident detection and analysis computing system to:
receive and analyze historical system or network incident data including a plurality of historical incidents;
quantify each historical incident of the plurality of historical incidents to determine a quantified magnitude of an impact of each historical incident;
compare the quantified magnitude of the impact of each historical incident to a predetermined threshold to generate a machine learning data set including historical incidents having a quantified magnitude above the predetermined threshold, the historical incidents having a quantified magnitude above the predetermined threshold being a portion of the plurality of historical incidents;
extract, from each incident of the plurality of historical incidents, keywords;
evaluate the keywords to identify inclusion and exclusion criteria, the inclusion criteria including identified sequences of keywords indicating an impact above the predetermining threshold and the exclusion criteria including identified sequences of keywords indicating an impact below the predetermined threshold;
receive an incoming incident associated with a system or network; and
pre-processing the incoming incident, including:
analyzing data associated with the incoming incident;
comparing the analyzed data with the machine learning data set including the one or more historical incidents having a quantified magnitude above the predetermined threshold;
compare the analyzed data from the incoming incident with the identified inclusion and exclusion criteria to determine a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold;
based on the comparison to the machine learning data set and the inclusion and exclusion criteria, determining a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold;
responsive to determining that the likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold, aggregating the analyzed data from the incoming incident and the data from the one or more historical incidents to generate a completed analysis data set; and
transmitting the completed analysis data set for further processing.

### Claim 2 (depends on 1)

The system or network incident detection and analysis computing system of claim 1, wherein determining a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold further includes:
identifying a system, network, or application impacted by the incoming incident from the data associated with the incoming incident; and
comparing the identified system, network or application to historical incidents impacting the system, network or application and having a magnitude of impact above the predetermined threshold.

### Claim 3 (depends on 2)

The system or network incident detection and analysis computing system of claim 2, further including instructions that, when executed, cause the pre-processing computing device of the system or network incident detection and analysis computing system to:
query a database using the identified system, network or application as input; and
retrieving, from the database, the historical incidents impacting the system, network or application and having a magnitude of impact above the predetermined threshold.

### Claim 4 (depends on 1)

The system or network incident detection and analysis computing system of claim 1, wherein quantifying each historical incident of the plurality of historical incidents to determine the quantified magnitude of an impact of each historical incident is based on an impact matrix.

### Claim 5 (depends on 1)

The system or network incident detection and analysis computing system of claim 1, wherein quantifying each historical incident of the plurality of historical incidents to determine the quantified magnitude of an impact of each historical incident is based on costs associated with lost person hours and lost customer interaction.

### Claim 6 (depends on 1)

The system and network incident detection and analysis computing system of claim 1, wherein pre-processing the incoming incident is performed in real-time.

### Claim 7 (depends on 1)

The system and network incident detection and analysis computing system of claim 1, further including instructions that, when executed, cause the pre-processing computing device of the system and network incident detection and analysis computing system to:
responsive to determining that the likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold, prioritize resources to address the incident.

### Claim 8 (depends on 1)

The system and network incident detection and analysis computing system of claim 1, further including instructions that, when executed, cause the pre-processing computing device of the system and network incident detection and analysis computing system to:
responsive to determining that the likelihood that the incoming incident will not have a magnitude of impact above the predetermined threshold, flagging the incoming incident as having a low priority for assigning resources to address the incident.

### Claim 9

A method, comprising:
receiving and analyzing, by a system or network incident detection and analysis computing system, historical system or network incident data including a plurality of historical incidents;
quantifying, by the system or network incident detection and analysis computing system, each historical incident of the plurality of historical incidents to determine a quantified magnitude of an impact of each historical incident;
comparing, by the system or network incident detection and analysis computing system, the quantified magnitude of the impact of each historical incident to a predetermined threshold to generate a machine learning data set including historical incidents having a quantified magnitude above the predetermined threshold, the historical incidents having a quantified magnitude above the predetermined threshold being a portion of the plurality of historical incidents;
extracting, from each incident of the plurality of historical incidents, keywords;
evaluating the keywords to identify inclusion and exclusion criteria, the inclusion criteria including identified sequences of keywords indicating an impact above the predetermining threshold and the exclusion criteria including identified sequences of keywords indicating an impact below the predetermined threshold;
receiving, by the system or network incident detection and analysis computing system, an incoming incident; and
pre-processing, by the system or network incident detection and analysis computing system, the incoming incident, including:
analyzing, by the system or network incident detection and analysis computing system, data associated with the incoming incident;
comparing, by the system or network incident detection and analysis computing system, the analyzed data with the machine learning data set including the one or more historical incidents having a quantified magnitude above the predetermined threshold;
comparing, by the system or network incident detection and analysis computing system, the analyzed data from the incoming incident with the identified inclusion and exclusion criteria to determine a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold;
based on the comparison to the machine learning data set and the inclusion and exclusion criteria, determining, by the system or network incident detection and analysis computing system a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold;
responsive to determining that the likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold, aggregating, by the system or network incident detection and analysis computing system the analyzed data from the incoming incident and the data from the one or more historical incidents to generate a completed analysis data set; and
transmitting, by the system or network incident detection and analysis computing system, the completed analysis data set for further processing.

### Claim 10 (depends on 9)

The method of claim 9, wherein determining a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold further includes:
identifying, by the system or network incident detection and analysis computing system, a system, network, or application impacted by the incoming incident from the data associated with the incoming incident; and
comparing, by the system or network incident detection and analysis computing system, the identified system, network or application to historical incidents impacting the system, network or application and having a magnitude of impact above the predetermined threshold.

### Claim 11 (depends on 10)

The method of claim 10, further including:
querying, by the system or network incident detection and analysis computing system a database using the identified system, network or application as input; and
receiving, by the system or network incident detection and analysis computing system and from the database, the historical incidents impacting the system, network or application and having a magnitude of impact above the predetermined threshold.

### Claim 12 (depends on 9)

The method of claim 9, wherein quantifying each historical incident of the plurality of historical incidents to determine the quantified magnitude of an impact of each historical incident is based on an impact matrix.

### Claim 13 (depends on 9)

The method of claim 9, wherein quantifying each historical incident of the plurality of historical incidents to determine the quantified magnitude of an impact of each historical incident is based on costs associated with lost person hours and lost customer interaction.

### Claim 14 (depends on 9)

The method of claim 9, wherein pre-processing the incoming incident is performed in real-time.

### Claim 15 (depends on 9)

The method of claim 9, further including:
responsive to determining that the likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold, prioritizing, by the system or network incident detection and analysis computing system, resources to address the incoming incident.

### Claim 16 (depends on 9)

The method of claim 9, further including:
responsive to determining that the likelihood that the incoming incident will not have a magnitude of impact above the predetermined threshold, flagging, by the system or network incident detection and analysis computing system, the incoming incident as having a low priority for assigning resources to address the incident.

### Claim 17

One or more non-transitory computer-readable media storing instructions that, when executed by at least one computer system comprising at least one processor, memory, and a communication interface, cause the at least one computer system to:
receive and analyze historical system or network incident data including a plurality of historical incidents;
quantify each historical incident of the plurality of historical incidents to determine a quantified magnitude of an impact of each historical incident;
compare the quantified magnitude of the impact of each historical incident to a predetermined threshold to generate a machine learning data set including historical incidents having a quantified magnitude above the predetermined threshold, the historical incidents having a quantified magnitude above the predetermined threshold being a portion of the plurality of historical incidents;
extract, from each incident of the plurality of historical incidents, keywords;
evaluate the keywords to identify inclusion and exclusion criteria, the inclusion criteria including identified sequences of keywords indicating an impact above the predetermining threshold and the exclusion criteria including identified sequences of keywords indicating an impact below the predetermined threshold;
receive an incoming incident; and
pre-processing the incoming incident, including:
analyzing data associated with the incoming incident;
comparing the analyzed data with the machine learning data set including the one or more historical incidents having a quantified magnitude above the predetermined threshold;
compare the analyzed data from the incoming incident with the identified inclusion and exclusion criteria to determine a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold;
based on the comparison to the machine learning data set and the inclusion and exclusion criteria, determining a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold;
responsive to determining that the likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold, aggregating the analyzed data from the incoming incident and data from the one or more historical incidents to generate a completed analysis data set; and
transmitting the completed analysis data set for further processing.

### Claim 18 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein determining a likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold further includes:
identifying a system, network, or application impacted by the incoming incident from the data associated with the incoming incident; and
comparing the identified system, network or application to the machine learning data set including historical incidents impacting the system, network or application and having a magnitude of impact above the predetermined threshold.

### Claim 19 (depends on 18)

The one or more non-transitory computer-readable media of claim 18, further including instructions that, when executed, cause the at least one computer system to:
query a database using the identified system, network or application as input; and
retrieving, from the database, the historical incidents impacting the system, network or application and having a magnitude of impact above the predetermined threshold.

### Claim 20 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein quantifying each historical incident of the plurality of historical incidents to determine the quantified magnitude of an impact of each historical incident is based on an impact matrix.

### Claim 21 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein quantifying each historical incident of the plurality of historical incidents to determine the quantified magnitude of an impact of each historical incident is based on costs associated with lost person hours and lost customer interaction.

### Claim 22 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein pre-processing the incoming incident is performed in real-time.

### Claim 23 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, further including instructions that, when executed, cause the at least one computing system to:
responsive to determining that the likelihood that the incoming incident will have a magnitude of impact above the predetermined threshold, prioritize resources to address the incident.

### Claim 24 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, further including instructions that, when executed, cause the at least one computing system to:
responsive to determining that the likelihood that the incoming incident will not have a magnitude of impact above the predetermined threshold, flagging the incoming incident as having a low priority for assigning resources to address the incident.