# US 12,182,169 B1 · Systems and methods for machine-learning based alert grouping including temporal constraints > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,169 B1 - Document ID: US12182169B1 - Status: Granted - Kind: B1 - Application number: 17/589,600 - Filed: 2022-01-31 - Granted: 2024-12-31 - Earliest claimed: 2022-01-31 - Assignees: Splunk Inc. - Applicants: Splunk, Inc. - Inventors: William Deaderick; William Stanton; Thomas Camp Vieth - Web page: https://patentgrep.com/patent/US12182169B1 ## CPC - G06F 11/3075: {the data filtering being achieved in order to maintain consistency among the monitored data, e.g. ensuring that the monitored data belong to the same timeframe, to the same system or component} - G06F 11/0781: {Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/3409: {for performance assessment} - G06F 11/3447: {Performance evaluation by modeling} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 16/244: {Grouping and aggregation} - G06F 16/2477: {Temporal data queries} - G06F 16/285: {Clustering or classification} - G06F 18/2178: {based on feedback of a supervisor} - G06F 11/3082: {the data filtering being achieved by aggregating or compressing the monitored data} - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A computerized method is disclosed for grouping alerts through machine learning while implementing certain time constraints. The method includes receiving an alert to be assigned to any of a plurality of existing issues or to a newly created issue, the alert including a temporal field that includes a timestamp of an arrival time of the alert, wherein an issue is a grouping of one or more alerts, determining a subset of existing issues from the plurality of existing issues that each satisfy time constraints, wherein the time constraints correspond to (i) a time elapsed between a most recent alert of a first existing issue and a timestamp of the alert, or (ii) a maximum issue time length of the first existing issue, and deploying a trained machine learning model to assign the alert to either an existing issue of the subset of existing issues or a newly created issue. ## Claims ### Claim 1 A computerized method comprising: receiving, by a processor, an alert to be assigned to one of a plurality of existing alert groupings or to a newly created alert grouping, the received alert including a temporal field that includes a timestamp of an arrival time of the received alert, wherein an alert grouping is a grouping of one or more alerts; determining, by the processor, a subset of existing alert groupings from the plurality of existing alert groupings that each satisfy time constraints, wherein the time constraints correspond to (i) a time elapsed between a most recent alert of a first existing alert grouping and a timestamp of the received alert, or (ii) a maximum time length of the first existing alert grouping; deploying, by the processor, a trained machine learning model to assign the received alert to either the first existing alert grouping of the subset of existing alert groupings or the newly created alert grouping, wherein the trained machine learning model analyzes a temporal distance between the received alert and the subset of existing alert groupings and at least one of: (a) a numeric distance between a value of a field of the received alert and values of corresponding fields of alerts comprising the subset of existing alert groupings, or (b) a categorical distance between the received alert and the subset of existing alert groupings based on a portion of the alerts comprising the subset of existing alert groupings that include an equivalent value as the received alert in a corresponding field; generating, by the processor, a graphical user interface (GUI) that illustrates a plurality of alerts visually arranged into a set of alert groupings including at least the plurality of existing alert groupings that are positioned so that each alert grouping of the set of alert groupings is positioned at different regions of a dashboard produced by the GUI, wherein the received alert is displayed within either the first existing alert grouping or the newly created alert grouping; and receiving, by the processor, user feedback provided to the GUI that causes automated retraining of the trained machine learning model. ### Claim 2 (depends on 1) The computerized method of claim 1, wherein a first time constraint includes determining whether the time elapsed between the most recent alert of the first existing alert grouping and the timestamp of the received alert exceeds a maximum allowable time, and wherein when the time elapsed does not exceed the maximum allowable time, adding the first existing alert grouping to the subset of existing alert groupings. ### Claim 3 (depends on 1) The computerized method of claim 1, wherein a second time constraint includes determining whether the maximum alert grouping time length of the first existing alert grouping has elapsed, and wherein when the maximum alert grouping time length of the first existing alert grouping has not elapsed, adding the first existing alert grouping to the subset of existing alert groupings. ### Claim 4 (depends on 1) The computerized method of claim 1, wherein in assigning the received alert, processing by the trained machine learning model includes determining a distance between the received alert and each of the plurality of existing alert groupings based on a weighted sum of a plurality of features. ### Claim 5 (depends on 4) The computerized method of claim 4, wherein the plurality of features for an alert includes the timestamp included in the temporal field, and at least either of (i) a numerical field or (ii) a categorical field. ### Claim 6 (depends on 4) The computerized method of claim 4, wherein the plurality of features for each of the plurality of alert groupings are the same as the plurality of features of the received alert. ### Claim 7 (depends on 4) The computerized method of claim 4, wherein the received alert is assigned to either (i) an existing alert grouping subset of existing alert groupings having a shortest distance, or (ii) the newly created alert grouping. ### Claim 8 A computing device, comprising: one or more processors; and a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including: receiving an alert to be assigned to one of a plurality of existing alert groupings or to a newly created alert grouping, the received alert including a temporal field that includes a timestamp of an arrival time of the received alert, wherein an alert grouping is a grouping of one or more alerts; determining a subset of existing alert groupings from the plurality of existing alert groupings that each satisfy time constraints, wherein the time constraints correspond to (i) a time elapsed between a most recent alert of a first existing alert grouping and a timestamp of the received alert, or (ii) a maximum time length of the first existing alert grouping; deploying a trained machine learning model to assign the received alert to either the first existing alert grouping of the subset of existing alert groupings or the newly created alert grouping, wherein the trained machine learning model analyzes a temporal distance between the received alert and the subset of existing alert groupings and at least one of: (a) a numeric distance between a value of a field of the received alert and values of corresponding fields of alerts comprising the subset of existing alert groupings, or (b) a categorical distance between the received alert and the subset of existing alert groupings based on a portion of the alerts comprising the subset of existing alert groupings that include an equivalent value as the received alert in a corresponding field; generating a graphical user interface (GUI) that illustrates a plurality of alerts visually arranged into a set of alert groupings including at least the plurality of existing alert groupings that are positioned so that each alert grouping of the set of alert groupings is positioned at different regions of a dashboard produced by the GUI, wherein the received alert is displayed within either the first existing alert grouping or the newly created alert grouping; and receiving user feedback provided to the GUI that causes automated retraining of the trained machine learning model. ### Claim 9 (depends on 8) The computing device of claim 8, wherein a first time constraint includes determining whether the time elapsed between the most recent alert of the first existing alert grouping and the timestamp of the alert exceeds a maximum allowable time, and wherein when the time elapsed does not exceed the maximum allowable time, adding the first existing issue alert grouping to the subset of existing alert groupings. ### Claim 10 (depends on 8) The computing device of claim 8, wherein a second time constraint includes determining whether the maximum alert grouping time length of the first existing alert grouping has elapsed, and wherein when the maximum issue alert grouping time length of the first existing issue alert grouping has not elapsed, adding the first existing issue alert grouping to the subset of existing alert groupings. ### Claim 11 (depends on 8) The computing device of claim 8, wherein in assigning the alert, processing by the trained machine learning model includes determining a distance between the alert and each of the plurality of existing alert groupings based on a weighted sum of a plurality of features. ### Claim 12 (depends on 11) The computing device of claim 11, wherein the plurality of features for an alert includes the timestamp included in the temporal, and at least either of (i) a numerical field or (ii) a categorical field. ### Claim 13 (depends on 11) The computing device of claim 11, wherein the plurality of features for each of the plurality of alert groupings are the same as the plurality of features of the received alert. ### Claim 14 (depends on 11) The computing device of claim 11, wherein the received alert is assigned to either (i) an existing alert grouping subset of existing alert groupings having a shortest distance, or (ii) the newly created alert grouping. ### Claim 15 A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including: receiving an alert to be assigned to one of a plurality of existing alert groupings or to a newly created alert grouping, the received alert including a temporal field that includes a timestamp of an arrival time of the received alert, wherein an alert grouping is a grouping of one or more alerts; determining a subset of existing alert groupings from the plurality of existing alert groupings that each satisfy time constraints, wherein the time constraints correspond to (i) a time elapsed between a most recent alert of a first existing alert grouping and a timestamp of the received alert, or (ii) a maximum time length of the first existing alert grouping; deploying, by the processor, a trained machine learning model to assign the received alert to either the first existing alert grouping of the subset of existing alert groupings or the newly created alert grouping, wherein the trained machine learning model analyzes a temporal distance between the received alert and the subset of existing alert groupings and at least one of: (a) a numeric distance between a value of a field of the received alert and values of corresponding fields of alerts comprising the subset of existing alert groupings, or (b) a categorical distance between the received alert and the subset of existing alert groupings based on a portion of the alerts comprising the subset of existing alert groupings that include an equivalent value as the received alert in a corresponding field; generating a graphical user interface (GUI) that illustrates a plurality of alerts visually arranged into a set of alert groupings including at least the plurality of existing alert groupings that are positioned so that each alert grouping of the set of alert groupings is positioned at different regions of a dashboard produced by the GUI, wherein the received alert is displayed within either the first existing alert grouping or the newly created alert grouping; and receiving user feedback provided to the GUI that causes automated retraining of the trained machine learning model. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein a first time constraint includes determining whether the time elapsed between the most recent alert of the first existing alert grouping and the timestamp of the alert exceeds a maximum allowable time, and wherein when the time elapsed does not exceed the maximum allowable time, adding the first existing alert grouping to the subset of existing alert groupings. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein a second time constraint includes determining whether the maximum alert grouping time length of the first existing alert grouping has elapsed, and wherein when the maximum alert grouping time length of the first existing alert grouping has not elapsed, adding the first existing alert grouping to the subset of existing alert groupings. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein in assigning the alert, processing by the trained machine learning model includes determining a distance between the alert and each of the plurality of existing alert groupings based on a weighted sum of a plurality of features. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the plurality of features for an alert includes the timestamp included in the temporal, and at least either of (i) a numerical field or (ii) a categorical field. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the received alert is assigned to either (i) an existing alert grouping subset of existing issues having a shortest distance, or (ii) the newly created alert grouping.