# US 12,217,868 B2 · Differential diagnosis feature engineering for machine learning applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,217,868 B2 - Document ID: US12217868B2 - Status: Granted - Kind: B2 - Application number: 17/389,583 - Filed: 2021-07-30 - Published: 2023-02-02 - Granted: 2025-02-04 - Earliest claimed: 2021-07-30 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: Douglas Graeme Brown - Web page: https://patentgrep.com/patent/US12217868B2 ## CPC - G16H 50/20: for computer-aided diagnosis, e.g. based on medical expert systems - G06F 21/554: {involving event detection and direct action} - G06N 20/00: Machine learning - G16H 20/30: relating to physical therapies or activities, e.g. physiotherapy, acupressure or exercising - G16H 20/40: relating to mechanical, radiation or invasive therapies, e.g. surgery, laser therapy, dialysis or acupuncture - G16H 40/20: for the management or administration of healthcare resources or facilities, e.g. managing hospital staff or surgery rooms - G16H 50/70: for mining of medical data, e.g. analysing previous cases of other patients - G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Methods and systems for improved preparing of received data using differential diagnosis for analysis by machine learning models. In one embodiment, a method is provided that includes receiving an identifier of an event. A plurality of inquiries may be sequentially processed, and subsequent inquiries for processing may be selected based on the responses to earlier inquiries. A tensor may be used to store indications of which inquiries were processed and the responses received to the inquiries. A machine learning model may use the tensor to determine a diagnosis and whether the event is an emergency event requiring intervention. If the event is an emergency event, an intervention may be generated for the emergency event, which may include a computer system taking automatic action to respond to the emergency event. ## Claims ### Claim 1 A method comprising: receiving an identifier of a computer system security event; sequentially processing a plurality of inquiries, wherein subsequent inquiries in the plurality of inquiries are selected and processed based on responses to earlier inquiries in the plurality of inquiries; storing indications of (i) the plurality of inquiries processed and (ii) responses received to the plurality of inquiries into a tensor; determining, with a machine learning model, that the tensor identifies a potential computer system security breach; and generating an intervention for the potential computer system security breach. ### Claim 2 (depends on 1) The method of claim 1, wherein at least a first inquiry of the plurality of inquiries identifies subsequent inquiries based on the response received to the first inquiry. ### Claim 3 (depends on 1) The method of claim 1, wherein the inquiries are selected from a larger set of inquiries. ### Claim 4 (depends on 3) The method of claim 3, wherein the tensor has rows for each of the larger set of inquiries. ### Claim 5 (depends on 4) The method of claim 4, wherein the tensor contains null data values for rows corresponding to inquiries from the larger set of inquiries that are not contained in the plurality of inquiries. ### Claim 6 (depends on 1) The method of claim 1, wherein at least a subset of the plurality of inquiries are answered manually. ### Claim 7 (depends on 1) The method of claim 1, wherein at least a subset of the plurality of inquiries are answered automatically. ### Claim 8 (depends on 7) The method of claim 7, wherein at least one inquiry is answered based on information contained within the identifier of the computer system security event. ### Claim 9 (depends on 7) The method of claim 7, wherein at least one inquiry is answered based on a result of a computing process associated with the subset of the plurality of inquiries. ### Claim 10 (depends on 1) The method of claim 1, wherein the intervention includes at least one of: generating a security alert, presenting a two factor authentication challenge, and/or blocking network traffic. ### Claim 11 (depends on 1) The method of claim 1, wherein the computer system security event occurred on at least one of a single computing device, a plurality of computing devices, a distributed computing process, and/or a computing network. ### Claim 12 A system comprising: a processor; and a memory storing instructions which, when executed by the processor, cause the processor to: receive an identifier of a computer system security event; sequentially process a plurality of inquiries, wherein subsequent inquiries in the plurality of inquiries are selected and processed based on responses to earlier inquiries in the plurality of inquiries; store indications of (i) the plurality of inquiries processed and (ii) responses received to the plurality of inquiries into a tensor; determine, with a machine learning model, that the tensor identifies a potential computer system security breach; and generate an intervention for the potential computer system security breach. ### Claim 13 (depends on 12) The system of claim 12, wherein at least a first inquiry of the plurality of inquiries identifies subsequent inquiries based on the response received to the first inquiry. ### Claim 14 (depends on 12) The system of claim 12, wherein the inquiries are selected from a larger set of inquiries. ### Claim 15 (depends on 14) The system of claim 14, wherein the tensor has rows for each of the larger set of inquiries. ### Claim 16 (depends on 15) The system of claim 15, wherein the tensor contains null data values for rows corresponding to inquiries from the larger set of inquiries that are not contained in the plurality of inquiries. ### Claim 17 (depends on 12) The system of claim 12, wherein at least a subset of the plurality of inquiries are answered manually. ### Claim 18 (depends on 12) The system of claim 12, wherein at least a subset of the plurality of inquiries are answered automatically. ### Claim 19 (depends on 18) The system of claim 18, wherein at least one inquiry is answered based on information contained within the identifier of the computer system security event. ### Claim 20 A non-transitory, computer-readable medium storing instructions which, when executed by a processor, cause the processor to: receive an identifier of a computer system security event; sequentially process a plurality of inquiries, wherein subsequent inquiries in the plurality of inquiries are selected and processed based on responses to earlier inquiries in the plurality of inquiries; store indications of (i) the plurality of inquiries processed and (ii) responses received to the plurality of inquiries into a tensor; determine, with a machine learning model, that the tensor identifies a potential computer system security breach; and generate an intervention for the potential computer system security breach.