# US 12,602,419 B1 · Machine learning-based processing of logs containing unstructured text data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,419 B1 - Document ID: US12602419B1 - Status: Granted - Kind: B1 - Application number: 19/198,882 - Filed: 2025-05-05 - Granted: 2026-04-14 - Earliest claimed: 2025-05-05 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Praveen Prabha Ravindran; John Hickie - Web page: https://patentgrep.com/patent/US12602419B1 ## CPC - G06F 16/345: {Summarisation for human users} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 16/35: Clustering; Classification - G06F 30/27: using machine learning, e.g. artificial intelligence, neural networks, support vector machines [SVM] or training a model - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] - G06N 3/045: Combinations of networks - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/084: Backpropagation, e.g. using gradient descent - G06N 3/088: Non-supervised learning, e.g. competitive learning - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06F 11/3409: {for performance assessment} - G06F 11/3447: {Performance evaluation by modeling} - G06F 30/20: Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30) - G06N 3/02: Neural networks - G06N 3/0475: Generative networks - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract An apparatus comprises at least one processing device configured to obtain logs comprising unstructured text data characterizing issues encountered on information technology assets, to generate, utilizing a transformer-based machine learning model, embeddings for the logs, to select, based on cluster validation metrics determined by processing the embeddings, a target number of clusters, and to determine, utilizing a machine learning-based clustering model that takes as input the target number of clusters, a set of clusters. The at least one processing device is also configured to determine a prioritization of the encountered issues based on identifying associations between respective ones of the clusters and at least one of applications executing on the information technology assets and users of the applications. The at least one processing device is further configured to remediate the encountered issues based on the determined prioritization. ## Claims ### Claim 1 An apparatus comprising: at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured: to obtain a plurality of logs associated with operation of one or more information technology assets in an information technology infrastructure environment, the plurality of logs comprising unstructured text data characterizing one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment; to generate, utilizing a transformer-based machine learning model, embeddings for the plurality of logs; to select, based at least in part on one or more cluster validation metrics determined by processing the embeddings for the plurality of logs, a target number of clusters; to determine, utilizing a machine learning-based clustering model that takes as input the target number of clusters, a set of clusters for the plurality of logs; to determine a prioritization of the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment based at least in part on identifying associations between respective ones of the clusters in the determined set of clusters and at least one of (i) applications executing on the one or more information technology assets in the information technology infrastructure environment and (ii) users of the applications executing on the one or more information technology assets in the information technology infrastructure environment; and to remediate the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment based at least in part on the determined prioritization. ### Claim 2 (depends on 1) The apparatus of claim 1 wherein the at least one processing device is further configured, prior to generating the embeddings for the plurality of logs, to apply data preprocessing to the unstructured text data of the plurality logs. ### Claim 3 (depends on 2) The apparatus of claim 2 wherein the data preprocessing comprises at least one of removing noise from the unstructured text data, tokenizing the unstructured text data, and standardizing a data format of the unstructured text data. ### Claim 4 (depends on 1) The apparatus of claim 1 wherein the transformer-based machine learning model comprises a large language model that generates, for each log in the plurality of logs, fixed-length vector representations for each of one or more portions of the unstructured text data in that log. ### Claim 5 (depends on 1) The apparatus of claim 1 wherein generating the embeddings for the plurality of logs further comprises utilizing an autoencoder-based machine learning model to reduce a dimensionality of the embeddings output by the transformer-based machine learning model. ### Claim 6 (depends on 5) The apparatus of claim 5 wherein the autoencoder-based machine learning model comprises a multilayer stacked autoencoder comprising an encoder configured to compress input data to a lower-dimensional representation and a decoder configured to reconstruct the input data. ### Claim 7 (depends on 1) The apparatus of claim 1 wherein the one or more cluster validation metrics comprise silhouette scores, and wherein selecting the target number of clusters comprises selecting a number of clusters with a maximum silhouette score. ### Claim 8 (depends on 1) The apparatus of claim 1 wherein the machine learning-based clustering model comprises a K-means clustering model, where K is the selected target number of clusters. ### Claim 9 (depends on 1) The apparatus of claim 1 wherein the machine learning-based clustering model comprises at least one of an agglomerative clustering model and a mean-shift clustering model. ### Claim 10 (depends on 1) The apparatus of claim 1 wherein the at least one processing device is further configured to generate natural language text summaries for each of at least a subset of the determined set of clusters by processing unstructured text data of the subset of the determined set of clusters utilizing a large language model. ### Claim 11 (depends on 10) The apparatus of claim 10 wherein remediating the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment based at least in part on the determined prioritization comprises utilizing the generated natural language text summaries to identify one or more root causes of at least one of the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment. ### Claim 12 (depends on 1) The apparatus of claim 1 wherein determining the prioritization of the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment comprises generating a heatmap visualization characterizing the identified associations between respective ones of the clusters in the determined set of clusters and said at least one of (i) the applications executing on the one or more information technology assets in the information technology infrastructure environment and (ii) the users of the applications executing on the one or more information technology assets in the information technology infrastructure environment. ### Claim 13 (depends on 1) The apparatus of claim 1 wherein the plurality of logs comprise authentication logs, and the determined set of clusters are associated with input texts for different types of potentially malicious login attempts for the information technology assets in the information technology infrastructure environment. ### Claim 14 (depends on 1) The apparatus of claim 1 wherein the plurality of logs comprise user interaction data with an online platform operated by an organization, and the determined set of clusters are associated with different types of fraud in user interactions with the online platform operated by the organization. ### Claim 15 A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device: to obtain a plurality of logs associated with operation of one or more information technology assets in an information technology infrastructure environment, the plurality of logs comprising unstructured text data characterizing one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment; to generate, utilizing a transformer-based machine learning model, embeddings for the plurality of logs; to select, based at least in part on one or more cluster validation metrics determined by processing the embeddings for the plurality of logs, a target number of clusters; to determine, utilizing a machine learning-based clustering model that takes as input the target number of clusters, a set of clusters for the plurality of logs; to determine a prioritization of the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment based at least in part on identifying associations between respective ones of the clusters in the determined set of clusters and at least one of (i) applications executing on the one or more information technology assets in the information technology infrastructure environment and (ii) users of the applications executing on the one or more information technology assets in the information technology infrastructure environment; and to remediate the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment based at least in part on the determined prioritization. ### Claim 16 (depends on 15) The computer program product of claim 15 wherein generating the embeddings for the plurality of logs further comprises utilizing an autoencoder-based machine learning model to reduce a dimensionality of the embeddings output by the transformer-based machine learning model. ### Claim 17 (depends on 15) The computer program product of claim 15 wherein the program code when executed by the at least one processing device further causes the at least one processing device to generate natural language text summaries for each of at least a subset of the determined set of clusters by processing unstructured text data of the subset of the determined set of clusters utilizing a large language model. ### Claim 18 A method comprising: obtaining a plurality of logs associated with operation of one or more information technology assets in an information technology infrastructure environment, the plurality of logs comprising unstructured text data characterizing one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment; generating, utilizing a transformer-based machine learning model, embeddings for the plurality of logs; selecting, based at least in part on one or more cluster validation metrics determined by processing the embeddings for the plurality of logs, a target number of clusters; determining, utilizing a machine learning-based clustering model that takes as input the target number of clusters, a set of clusters for the plurality of logs; determining a prioritization of the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment based at least in part on identifying associations between respective ones of the clusters in the determined set of clusters and at least one of (i) applications executing on the one or more information technology assets in the information technology infrastructure environment and (ii) users of the applications executing on the one or more information technology assets in the information technology infrastructure environment; and remediating the one or more issues encountered on the one or more information technology assets in the information technology infrastructure environment based at least in part on the determined prioritization; wherein the method is performed by at least one processing device comprising a processor coupled to a memory. ### Claim 19 (depends on 18) The method of claim 18 wherein generating the embeddings for the plurality of logs further comprises utilizing an autoencoder-based machine learning model to reduce a dimensionality of the embeddings output by the transformer-based machine learning model. ### Claim 20 (depends on 18) The method of claim 18 further comprising generating natural language text summaries for each of at least a subset of the determined set of clusters by processing unstructured text data of the subset of the determined set of clusters utilizing a large language model.