# US 12,743,437 B2 · Method and system for implementing machine learning classifications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,743,437 B2
- Document ID: US12743437B2
- Status: Granted
- Kind: B2
- Application number: 18/648,107
- Filed: 2024-04-26
- Published: 2024-09-19
- Granted: 2026-09-22
- Earliest claimed: 2015-04-03
- Assignees: Oracle International Corporation
- Applicants: Oracle International Corporation
- Inventors: Anindya Chandra Patthak; Gregory Michael Ferrar
- Web page: https://patentgrep.com/patent/US12743437B2

## CPC

- G06F 16/248: Presentation of query results
- G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence)
- G06F 9/44505: {Configuring for program initiating, e.g. using registry, configuration files}
- G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications}
- G06F 11/00: Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00)
- G06F 11/0766: {Error or fault reporting or storing}
- G06F 11/0775: {Content or structure details of the error report, e.g. specific table structure, specific error fields}
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/3072: {where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting}
- G06F 11/3086: {where the reporting involves the use of self describing data formats, i.e. metadata, markup languages, human readable formats}
- G06F 16/21: Design, administration or maintenance of databases
- G06F 16/2228: {Indexing structures}
- G06F 16/2455: Query execution
- G06F 16/353: into predefined classes
- G06F 16/84: Mapping; Conversion
- G06F 40/16: Automatic learning of transformation rules, e.g. from examples
- G06F 40/205: Parsing
- G06N 5/025: Extracting rules from data
- G06N 20/00: Machine learning
- H04L 41/069: using logs of notifications; Post-processing of notifications
- H04L 41/142: using statistical or mathematical methods
- H04L 41/16: using machine learning or artificial intelligence
- H04L 41/5074: Handling of user complaints or trouble tickets
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Disclosed is a system, method, and computer program product for implementing a log analytics method and system that can configure, collect, and analyze log records in an efficient manner. Machine learning-based classification can be performed to classify logs. This approach is used to group logs automatically using a machine learning infrastructure.

## Claims

### Claim 1

One or more non-transitory computer readable media comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:
applying, by a log analytics system configured to analyze log data generated by a computer system, a first machine-learned classifier of a particular classifier type to a set of log data, to obtain a first score for classifying the set of log data as being of a first possible log type of a plurality of possible log types:
applying, by the log analytics system, a second machine-learned classifier of a different classifier type than the particular classifier type to the set of log data, to obtain a second score for classifying the set of log data as being of the first possible log type;
generating a graphical user interface (GUI) that presents the plurality of possible log types of the set of log data, the GUI comprising visual representations of:
the first possible log type of the set of log data, of the plurality of possible log types;
a second possible log type of the set of log data, of the plurality of possible log types;
wherein the first possible log type and the second possible log type are ordered in the GUI according to their respective probabilities;
wherein their respective probabilities comprise a probability of the set of log data being of the first possible log type, determined based at least in part on the first score and the second score;
responsive to receiving, via the GUI, user input selecting the first possible log type of the set of log data: applying, by the log analytics system, a log parser associated with the first possible log type to the set of log data.

### Claim 2 (depends on 1)

The one or more non-transitory computer-readable media of claim 1, the operations further comprising:
training the first machine-learned classifier and the second machine-learned classifier to classify logs of unknown log types, using a set of training data comprising a plurality of logs of known log types.

### Claim 3 (depends on 1)

The one or more non-transitory computer-readable media of claim 1, wherein the probability of the set of log data being of the first possible log type is determined based on the first score and the second score at least by:
multiplying the first score by a first weight, to obtain a weighted first score;
multiplying the second score by a second weight, to obtain a weighted second score; and
computing the probability of the set of log data being of the first possible log type as a function of at least the weighted first score and the weighted second score.

### Claim 4 (depends on 1)

The one or more non-transitory computer-readable media of claim 1, wherein the first machine-learned classifier is one of a distribution classifier, a token classifier, or a regular expression matching classifier.

### Claim 5

A system comprising:
one or more hardware processors;
one or more non-transitory computer-readable media; and
program instructions stored on the one or more non-transitory computer readable media which, when executed by the one or more hardware processors, cause the system to perform operations comprising:
applying, by a log analytics system configured to analyze log data generated by a computer system, a first machine-learned classifier of a particular classifier type to a set of log data, to obtain a first score for classifying the set of log data as being of a first possible log type of a plurality of possible log types;
applying, by the log analytics system, a second machine-learned classifier of a different classifier type than the particular classifier type to the set of log data, to obtain a second score for classifying the set of log data as being of the first possible type;
generating a graphical user interface (GUI) that presents the plurality of possible log types of the set of log data, the GUI comprising visual representations of:
the first possible log type of the set of log data, of the plurality of possible log types;
a second possible log type of the set of log data, of the plurality of possible log types;
wherein the first possible log type and the second possible log type are ordered in the GUI according to their respective probabilities;
wherein their respective probabilities comprise a probability of the set of log data being of the first possible log type, determined based at least in part on the first score and the second score;
responsive to receiving, via the GUI, user input selecting the first possible log type of the set of log data: applying, by the log analytics system, a log parser associated with the first possible log type to the set of log data.

### Claim 6 (depends on 5)

The system of claim 5, the operations further comprising:
training the first machine-learned classifier and the second machine-learned classifier to classify logs of unknown log types, using a set of training data comprising a plurality of logs of known log types.

### Claim 7 (depends on 5)

The system of claim 5, wherein the probability of the set of log data being of the first possible log type is determined based on the first score and the second score at least by:
multiplying the first score by a first weight, to obtain a weighted first score;
multiplying the second score by a second weight, to obtain a weighted second score; and
computing the probability of the set of log data being of the first possible log type as a function of at least the weighted first score and the weighted second score.

### Claim 8 (depends on 5)

The system of claim 5, wherein the first machine-learned classifier is one of a distribution classifier, a token classifier, or a regular expression matching classifier.

### Claim 9

A method comprising:
applying, by a log analytics system configured to analyze log data generated by a computer system, a first machine-learned classifier of a particular classifier type to a set of log data, to obtain a first score for classifying the set of log data as being of a first possible log type of a plurality of possible log types;
applying, by the log analytics system, a second machine-learned classifier of a different classifier type than the particular classifier type to the set of log data, to obtain a second score for classifying the set of log data as being of the first possible log type;
generating a graphical user interface (GUI) that presents the plurality of possible log types of the set of log data, the GUI comprising visual representations of:
the first possible log type of the set of log data, of the plurality of possible log types;
a second possible log type of the set of log data, of the plurality of possible log types;
wherein the first possible log type and the second possible log type are ordered in the GUI according to their respective probabilities;
wherein their respective probabilities comprise a probability of the set of log data being of the first possible log type, determined based at least in part on the first score and the second score;
responsive to receiving, via the GUI, user input selecting the first possible log type of the set of log data: applying, by the log analytics system, a log parser associated with the first possible log type to the set of log data;
wherein the method is performed by at least one device including a hardware processor.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
training the first machine-learned classifier and the second machine-learned classifier to classify logs of unknown log types, using a set of training data comprising a plurality of logs of known log types.

### Claim 11 (depends on 9)

The method of claim 9, wherein the probability of the set of log data being of the first possible log type is determined based on the first score and the second score at least by:
multiplying the first score by a first weight, to obtain a weighted first score;
multiplying the second score by a second weight, to obtain a weighted second score; and
computing the probability of the set of log data being of the first possible log type as a function of at least the weighted first score and the weighted second score.

### Claim 12 (depends on 9)

The method of claim 9, wherein the first machine-learned classifier is one of a distribution classifier, a token classifier, or a regular expression matching classifier.