# US 12,113,686 B2 · Predicting network anomaly events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,686 B2 - Document ID: US12113686B2 - Status: Granted - Kind: B2 - Application number: 18/076,138 - Filed: 2022-12-06 - Published: 2024-06-06 - Granted: 2024-10-08 - Earliest claimed: 2022-12-06 - Assignees: JPMorgan Chase Bank, N.A. - Applicants: JPMorgan Chase Bank, N.A. - Inventors: Garima Juneja; Wanpeng Liu; David D. Lin; Harsh Bhattachar; Bing Zhang - Web page: https://patentgrep.com/patent/US12113686B2 ## CPC - H04L 43/067: using time frame reporting - H04L 41/147: for predicting network behaviour - H04L 41/16: using machine learning or artificial intelligence - H04L 43/16: Threshold monitoring - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one example, a method for prediction future network anomaly events is disclosed. The method includes generating a machine learning model for a computer communication network. Generation of the machine learning model can be by applying a historical set of time series data metrics of the computer communication network to train the machine learning model. The method may determine a data metric threshold that indicates a limit for future data metrics associated with the computer communication network. The method may analyze current data metrics associated with the computer communication network, and predict a future time when the data metrics associated with the computer communication network will meet or exceed the data metric threshold value. The method may flag the prediction of the future time to avoid a network anomaly. ## Claims ### Claim 1 A method of predicting network anomaly events in a computer communication network, the method comprising: generating a machine learning model for the computer communication network by applying a set of time series data metrics that is a sequence of hardware resource metrics collected over a constant time interval of the computer communication network to train the machine learning model, wherein the set of time series data metrics includes at least one of a CPU utilization metric, a disk utilization metric and a memory utilization metric, wherein the machine learning model is trained by generating at least one training prediction using the set of time series data metrics and adjusting the machine learning model based on a comparison between the at least one training prediction and a known network event result; determining a data metric threshold for the computer communication network, wherein the data metric threshold is to indicate a limit for future data metrics associated with the computer communication network; analyzing the data metrics associated with the computer communication network; predicting, by using the machine learning model, a future time when the data metrics associated with the computer communication network will meet or exceed the data metric threshold value set for the computer communication network; and flagging the prediction of the future time to avoid a network anomaly. ### Claim 2 (depends on 1) The method of claim 1 further comprising applying network anomaly event data that includes a detection of a system failure or abnormal incident in the computer communication network to train the machine learning model; and predicting a future time when a network anomaly event will occur based on the network anomaly event data. ### Claim 3 (depends on 2) The method of claim 2 wherein the network anomaly event includes a stopped database service. ### Claim 4 (depends on 2) The method of claim 2 wherein the network anomaly event includes an application URL not working. ### Claim 5 (depends on 1) The method of claim 1 wherein the data metric threshold is set for CPU utilization. ### Claim 6 (depends on 1) The method of claim 1 wherein the data metric threshold is set for disk utilization. ### Claim 7 (depends on 1) The method of claim 1 wherein the computer communication network is within a cloud service having a microservice architecture. ### Claim 8 A non-transitory computer-readable storage medium with program instructions stored thereon, the program instructions when executed by one or more processors are operable to cause the one or more processors to perform operations comprising: analyzing data metrics associated with a computer communication network, wherein the data metrics relate to at least one or a CPU utilization metric, a disk utilization metric and a memory utilization metric; and predicting, based on a machine learning model, a time and an occurrence of a network anomaly event, wherein the machine learning model is based on a set of data metrics associated with the computer communication network and network anomaly event data associated with the computer communication network, wherein the network anomaly event data includes a detection of a system failure or abnormal incident in the computer communication network, and wherein the machine learning model is trained by generating at least one training prediction using the set of data metrics and adjusting the machine learning model based on a comparison between the at least one training prediction and a known network event result. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8 wherein the operations further comprise determining a data metric threshold for the computer communication network, wherein the data metric threshold is to indicate a limit for future data metrics associated with the computer communication network. ### Claim 10 (depends on 9) The non-transitory computer-readable storage medium of claim 9 wherein the data metric threshold is determined for memory utilization. ### Claim 11 (depends on 9) The non-transitory computer-readable storage medium of claim 9 wherein the data metric threshold is set for memory utilization, CPU utilization and disk utilization. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8 wherein the network anomaly event includes a stalled job process. ### Claim 13 A system comprising: one or more processors; and logic encoded in one or more non-transitory computer-readable storage media for execution by the one or more processors and when executed operable to cause the one or more processors to perform operations comprising: generating a machine learning model for a computer communication network by: applying a set of time series data metrics that is a sequence of hardware resource metrics collected over a constant time interval of the computer communication network to train the machine learning model, and applying network anomaly event data that includes a detection of a system failure or abnormal incident in the computer communication network, to train the machine learning model; determining a data metric threshold for the computer communication network, wherein the data metric threshold is to indicate a limit for future data metrics associated with the computer communication network; analyzing the data metrics associated with the computer communication network; predicting, by using the machine learning model, a first future time when the data metrics associated with the computer communication network will meet or exceed the data metric threshold value determined for the computer communication network, wherein the machine learning model is trained by generating at least one training prediction using the set of time series data metrics and adjusting the machine learning model based on a comparison between the at least one training prediction and a known network event result; and predicting a second future time when a network anomaly event will occur based on the network anomaly event data. ### Claim 14 (depends on 13) The system of claim 13 wherein the first future time and the second future time are proximate to each other.