Systems and methods for machine-learning based alert grouping including temporal constraints

A computing device, comprising:

• one or more processors;
• and
• a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
• receiving an alert to be assigned to one of a plurality of existing alert groupings or to a newly created alert grouping, the received alert including a temporal field that includes a timestamp of an arrival time of the received alert, wherein an alert grouping is a grouping of one or more alerts;
• determining a subset of existing alert groupings from the plurality of existing alert groupings that each satisfy time constraints,
• wherein the time constraints correspond to (i) a time elapsed between a most recent alert of a first existing alert grouping and a timestamp of the received alert, or (ii) a maximum time length of the first existing alert grouping;
• deploying a trained machine learning model to assign the received alert to either the first existing alert grouping of the subset of existing alert groupings or the newly created alert grouping, wherein the trained machine learning model analyzes a temporal distance between the received alert and the subset of existing alert groupings and at least one of:
• (a) a numeric distance between a value of a field of the received alert and values of corresponding fields of alerts comprising the subset of existing alert groupings, or (b) a categorical distance between the received alert and the subset of existing alert groupings based on a portion of the alerts comprising the subset of existing alert groupings that include an equivalent value as the received alert in a corresponding field;
• generating a graphical user interface (GUI) that illustrates a plurality of alerts visually arranged into a set of alert groupings including at least the plurality of existing alert groupings that are positioned so that each alert grouping of the set of alert groupings is positioned at different regions of a dashboard produced by the GUI, wherein the received alert is displayed within either the first existing alert grouping or the newly created alert grouping;
• and
• receiving user feedback provided to the GUI that causes automated retraining of the trained machine learning model.

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

• receiving an alert to be assigned to one of a plurality of existing alert groupings or to a newly created alert grouping, the received alert including a temporal field that includes a timestamp of an arrival time of the received alert, wherein an alert grouping is a grouping of one or more alerts;
• determining a subset of existing alert groupings from the plurality of existing alert groupings that each satisfy time constraints,
• wherein the time constraints correspond to (i) a time elapsed between a most recent alert of a first existing alert grouping and a timestamp of the received alert, or (ii) a maximum time length of the first existing alert grouping;
• deploying, by the processor, a trained machine learning model to assign the received alert to either the first existing alert grouping of the subset of existing alert groupings or the newly created alert grouping, wherein the trained machine learning model analyzes a temporal distance between the received alert and the subset of existing alert groupings and at least one of:
• (a) a numeric distance between a value of a field of the received alert and values of corresponding fields of alerts comprising the subset of existing alert groupings, or (b) a categorical distance between the received alert and the subset of existing alert groupings based on a portion of the alerts comprising the subset of existing alert groupings that include an equivalent value as the received alert in a corresponding field;
• generating a graphical user interface (GUI) that illustrates a plurality of alerts visually arranged into a set of alert groupings including at least the plurality of existing alert groupings that are positioned so that each alert grouping of the set of alert groupings is positioned at different regions of a dashboard produced by the GUI, wherein the received alert is displayed within either the first existing alert grouping or the newly created alert grouping;
• and
• receiving user feedback provided to the GUI that causes automated retraining of the trained machine learning model.