# US 11,907,333 B2 · Systems and methods of grouping system logs using unsupervised machine learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,333 B2 - Document ID: US11907333B2 - Status: Granted - Kind: B2 - Application number: 17/858,135 - Filed: 2022-07-06 - Published: 2024-01-11 - Granted: 2024-02-20 - Earliest claimed: 2022-07-06 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: David Sydow - Web page: https://patentgrep.com/patent/US11907333B2 ## CPC - G06F 18/2135: based on approximation criteria, e.g. principal component analysis - G06F 16/35: Clustering; Classification - G06F 18/22: Matching criteria, e.g. proximity measures - G06F 18/2321: using statistics or function optimisation, e.g. modelling of probability density functions - G06F 40/216: using statistical methods - G06F 40/44: Statistical methods, e.g. probability models - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for grouping system logs using machine learning. The techniques include deriving an input matrix from the logs, in which rows represent the logs and columns represent unique words in the logs. The techniques include applying a TF-IDF algorithm to the input matrix and deriving a TF-IDF matrix from the TF-IDF algorithm output. The TF-IDF matrix reflects how important the unique words are to the respective logs. The techniques include applying a PCA algorithm to the TF-IDF matrix and deriving a PCA matrix having a reduced dimensionality from the PCA algorithm output. The techniques include applying a Cosine Similarity algorithm to the PCA matrix and deriving CS matrices from the CS algorithm output. Each CS matrix reflects the cosine similarity of a respective log relative to all the other logs. The techniques include applying a clustering algorithm to the CS matrices and deriving log groupings from the clustering algorithm output. ## Claims ### Claim 1 A method comprising: deriving an input matrix from a dataset of system log messages included in at least one system log file of a storage system, the input matrix including rows representing the system log messages, columns representing unique terms included in the system log messages, and counts of the unique terms in each of the system log messages; applying a Term Frequency—Inverse Document Frequency (TF-IDF) algorithm to the input matrix to derive a TF-IDF matrix, the TF-IDF matrix including importance values for the unique terms in each of the system log messages; applying a Cosine Similarity (CS) algorithm to the TF-IDF matrix to derive a plurality of CS vectors, each CS vector including similarity scores for a respective one of the system log messages relative to all the other system log messages included in the at least one system log file; applying a clustering algorithm to the plurality of CS vectors to obtain groupings of the system log messages; and having derived the groupings of the system log messages, storing and/or displaying the groupings to a user for triage and/or analysis. ### Claim 2 (depends on 1) The method of claim 1 further comprising: reducing a dimensionality of the TF-IDF matrix. ### Claim 3 (depends on 2) The method of claim 2 wherein reducing the dimensionality of the TF-IDF matrix includes applying a Principal Component Analysis (PCA) algorithm to the TF-IDF matrix. ### Claim 4 (depends on 3) The method of claim 3 wherein applying the CS algorithm to the TF-IDF matrix to derive the plurality of CS vectors includes applying an output of the PCA algorithm as input to the CS algorithm to derive the plurality of CS vectors. ### Claim 5 (depends on 4) The method of claim 4 wherein the output of the PCA algorithm includes a plurality of summary indices referred to as principal components, and wherein a total number of the principal components is approximately two times a number of groupings of the system log messages. ### Claim 6 (depends on 1) The method of claim 1 wherein the TF-IDF matrix is configured as a sparse TF-IDF matrix, and wherein the method further comprises: transforming the sparse TF-IDF matrix into a dense TF-IDF matrix, wherein applying the CS algorithm to the TF-IDF matrix to derive the plurality of CS vectors includes applying the CS algorithm to the dense TF-IDF matrix to derive the plurality of CS vectors. ### Claim 7 (depends on 1) The method of claim 1 further comprising: specifying a fixed number of groupings of the system log messages, wherein applying the clustering algorithm to the plurality of CS vectors to obtain the groupings of the system log messages includes applying the clustering algorithm to the plurality of CS vectors to obtain the fixed number of groupings of the system log messages. ### Claim 8 (depends on 1) The method of claim 1 further comprising: specifying a minimum number of groupings of the system log messages, wherein applying the clustering algorithm to the plurality of CS vectors to obtain the groupings of the system log messages includes applying the clustering algorithm to the plurality of CS vectors to obtain the minimum number of groupings of the system log messages. ### Claim 9 A system comprising: a memory; and processing circuitry configured to execute program instructions out of the memory to: derive an input matrix from a dataset of system log messages included in at least one system log file of a storage system, the input matrix including rows representing the system log messages, columns representing unique terms included in the system log messages, and counts of the unique terms in each of the system log messages; apply a Term Frequency—Inverse Document Frequency (TF-IDF) algorithm to the input matrix to derive a TF-IDF matrix, the TF-IDF matrix including importance values for the unique terms in each of the system log messages; apply a Cosine Similarity (CS) algorithm to the TF-IDF matrix to derive a plurality of CS vectors, each CS vector including similarity scores for a respective one of the system log messages relative to all the other system log messages included in the at least one system log file; apply a clustering algorithm to the plurality of CS vectors to obtain groupings of the system log messages; and having derived the groupings of the system log messages, store and/or display the groupings to a user for triage and/or analysis. ### Claim 10 (depends on 9) The system of claim 9 wherein the processing circuitry is further configured to execute the program instructions out of the memory to reduce a dimensionality of the TF-IDF matrix. ### Claim 11 (depends on 10) The system of claim 10 wherein the processing circuitry is further configured to execute the program instructions out of the memory to apply a Principal Component Analysis (PCA) algorithm to the TF-IDF matrix. ### Claim 12 (depends on 11) The system of claim 11 wherein the processing circuitry is further configured to execute the program instructions out of the memory to apply an output of the PCA algorithm as input to the CS algorithm to derive the plurality of CS vectors. ### Claim 13 (depends on 12) The system of claim 12 wherein the output of the PCA algorithm includes a plurality of summary indices referred to as principal components, and wherein a total number of the principal components is approximately two times a number of groupings of the system log messages. ### Claim 14 (depends on 9) The system of claim 9 wherein the TF-IDF matrix is configured as a sparse TF-IDF matrix, and wherein the processing circuitry is further configured to execute the program instructions out of the memory to: transform the sparse TF-IDF matrix into a dense TF-IDF matrix; and apply the CS algorithm to the dense TF-IDF matrix to derive the plurality of CS vectors. ### Claim 15 (depends on 9) The system of claim 9 wherein the processing circuitry is further configured to execute the program instructions out of the memory to: specify a fixed number of groupings of the system log messages; and apply the clustering algorithm to the plurality of CS vectors to obtain the fixed number of groupings of the system log messages. ### Claim 16 (depends on 9) The system of claim 9 wherein the processing circuitry is further configured to execute the program instructions out of the memory to: specify a minimum number of groupings of the system log messages; and apply the clustering algorithm to the plurality of CS vectors to obtain the minimum number of groupings of the system log messages. ### Claim 17 A computer program product including a set of non-transitory, computer-readable media having instructions that, when executed by processing circuitry, cause the processing circuitry to perform a method comprising: deriving an input matrix from a dataset of system log messages included in at least one system log file of a storage system, the input matrix including rows representing the system log messages, columns representing unique terms included in the system log messages, and counts of the unique terms in each of the system log messages; applying a Term Frequency—Inverse Document Frequency (TF-IDF) algorithm to the input matrix to derive a TF-IDF matrix, the TF-IDF matrix including importance values for the unique terms in each of the system log messages; applying a Cosine Similarity (CS) algorithm to the TF-IDF matrix to derive a plurality of CS vectors, each CS vector including similarity scores for a respective one of the system log messages relative to all the other system log messages included in the at least one system log file; applying a clustering algorithm to the plurality of CS vectors to obtain groupings of the system log messages; and having derived the groupings of the system log messages, storing and/or displaying the groupings to a user for triage and/or analysis. ### Claim 18 (depends on 17) The computer program product of claim 17 wherein the method further comprises: reducing a dimensionality of the TF-IDF matrix. ### Claim 19 (depends on 18) The computer program product of claim 18 wherein reducing the dimensionality of the TF-IDF matrix includes applying a Principal Component Analysis (PCA) algorithm to the TF-IDF matrix. ### Claim 20 (depends on 19) The computer program product of claim 19 wherein applying the CS algorithm to the TF-IDF matrix to derive the plurality of CS vectors includes applying an output of the PCA algorithm as input to the CS algorithm to derive the plurality of CS vectors.