# US 12,762,007 B2 · Machine learning methods and systems for discovering problem incidents in a distributed computer system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,762,007 B2
- Document ID: US12762007B2
- Status: Granted
- Kind: B2
- Application number: 17/342,423
- Filed: 2021-06-08
- Published: 2022-12-08
- Granted: 2026-10-13
- Earliest claimed: 2021-06-08
- Assignees: VMware, Inc.
- Applicants: VMware LLC
- Inventors: Naira Movses Grigoryan; Ashot Nshan Harutyunyan; Arnak Poghosyan; Nicholas Kushmerick; Janislav Jankov
- Web page: https://patentgrep.com/patent/US12762007B2

## CPC

- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/0757: {by exceeding a time limit, i.e. time-out, e.g. watchdogs}
- G06F 11/076: {by exceeding a count or rate limit, e.g. word- or bit count limit}
- G06F 16/285: {Clustering or classification}
- G06N 5/04: Inference or reasoning models
- G06N 20/00: Machine learning
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Methods and systems are directed to discovering problem incidents in a distributed computing system. Events corresponding to historical problems incidents for the distributed computing system are retrieved from a data base. Sets of representative events of the various historical problem incidents for the distributed computing system are determined. A runtime problem incident in the distributed computing system is characterized by runtime events. The runtime problem incident is classified as corresponding to a historical problem incident of the historical problem incidents based on the runtime events and the sets of representative events. Remedial measures used to correct the historical problem incident may be used to correct the runtime problem.

## Claims

### Claim 1

A method stored in one or more data-storage devices and executed using one or more processors of a computer system for discovering problem incidents in a distributed computing system, the method comprising:
determining sets of representative events of historical problem incidents for the distributed computing system;
determining a representative feature vector for each set of representative events;
determining a runtime feature vector for runtime events of a runtime problem incident;
classifying the runtime problem incident as corresponding to a historical problem incident with a representative feature vector that is closest to the runtime feature vector; and
applying remedial measures to correct the runtime problem incident based on remedial measures used to correct the historical problem incident.

### Claim 2 (depends on 1)

The method of claim 1 wherein determining representative events of the historical problem incidents for the distributed computing system comprises:
retrieving historically detected events that occurred in the distributed computing system and in a historical time period from a database;
determining sets of historical events that correspond to problem incidents in the distributed computing system;
determining a feature vector for each set of historical events;
forming clusters of feature vectors based on distances between the feature vectors;
determining a score for each cluster;
discarding clusters with scores below a cluster threshold; and
determining a set of representative events for each cluster above the cluster threshold.

### Claim 3 (depends on 2)

The method of claim 2 wherein determining the sets of historical events comprise:
identifying the oldest historical event of historically detected events in the historical time period;
marking a beginning of a time interval with a start time of the oldest historical event; and
for each historical event in the historical time period from the oldest to the most recent historical event,
when the start time of the historical event is in the time interval adding the historical event to the set of historical events associated with the current time interval, and
when the start time of the historical event is not in the time interval,
marking a beginning of a next time interval with the start time of the historical event, and
adding the historical event to a next set of historical events.

### Claim 4 (depends on 2)

The method of claim 2 wherein determining the feature vector for each set of historical events comprises:
for each set of historical events,
for each alert definition name in a set of alert definitions,
when an alert definition name is contained in one or more historical events assigning a value 1 to a corresponding element of a feature vector, and
when an alert definition name is contained in one or more historical events assigning a value 0 to a corresponding element of a feature vector.

### Claim 5 (depends on 2)

The method of claim 2 wherein forming clusters of feature vectors based on distances between the feature vectors comprises:
identifying the smallest distance in a distance matrix between the feature vectors;
creating a corresponding branch point in a dendrogram;
removing a row and column of the distance matrix that correspond to the smallest distance;
distances of linked feature vectors are calculated according to a minimum linkage criterion;
applying a distance threshold to form clusters of feature vectors in the dendrogram; and
discarding clusters of feature vectors with fewer feature vectors than an item count threshold.

### Claim 6 (depends on 2)

The method of claim 2 wherein determining the set of representative events for each cluster comprises:
for each cluster,
computing mutual information for each event in a set of events associated with the;
adding the event with largest mutual information to a set of representative events;
removing the event from the set of events;
computing a relevance measure for each event in the set of events;
adding the event with the largest relevance measure to the set of representative events; and
removing the event from the set of events.

### Claim 7 (depends on 1)

The method of claim 1 wherein classifying the runtime problem incident in the distributed computing system as corresponding to the historical problem incident comprises:
computing a distance between the runtime feature vector and each of the representative feature vectors;
determining the shortest distance of the distances between the runtime feature vector and the representative feature vectors; and
classifying the runtime problem incident as corresponding to the historical problem incident with a representative feature vector that corresponds to the shortest distance.

### Claim 8

A computer system for discovering problem incidents in a distributed computing system, the system comprising:
one or more processors;
one or more data-storage devices; and
machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors controls the system to execute operations comprising:
retrieving sets of historical problem incidents of the distributed computing system from the one or more data-storage devices;
determining representative feature vectors for representative events of the historical problem incidents;
determining a runtime feature vector for runtime events of a runtime problem incident in the distributed computing system;
classifying the runtime problem as corresponding to one of the historical problem incidents with a representative feature vector that is closest to the runtime feature vector; and
applying remedial measures to correct the runtime problem incident based on remedial measures used to correct the historical problem incident.

### Claim 9 (depends on 8)

The computer system of claim 8 wherein determining representative events of the historical problem incidents for the distributed computing system comprises:
retrieving historically detected events that occurred in the distributed computing system and in a historical time period from a database;
determining sets of historical events that correspond to problem incidents in the distributed computing system;
determining a feature vector for each set of historical events;
forming clusters of feature vectors based on distances between the feature vectors;
determining a score for each cluster;
discarding clusters with scores below a cluster threshold; and
determining a set of representative events for each cluster above the cluster threshold.

### Claim 10 (depends on 9)

The computer system of claim 9 wherein determining the sets of historical events comprise:
identifying the oldest historical event of historically detected events in the historical time period;
marking a beginning of a time interval with a start time of the oldest historical event; and
for each historical event in the historical time period from the oldest to the most recent historical event,
when the start time of the historical event is in the time interval adding the historical event to the set of historical events associated with the current time interval, and
when the start time of the historical event is not in the time interval,
marking a beginning of a next time interval with the start time of the historical event, and
adding the historical event to a next set of historical events.

### Claim 11 (depends on 9)

The computer system of claim 9 wherein determining the feature vector for each set of historical events comprises:
for each set of historical events,
for each alert definition name in a set of alert definitions,
when an alert definition name is contained in one or more historical events assigning a value 1 to a corresponding element of a feature vector, and
when an alert definition name is contained in one or more historical events assigning a value 0 to a corresponding element of a feature vector.

### Claim 12 (depends on 9)

The computer system of claim 9 wherein forming clusters of feature vectors based on distances between the feature vectors comprises:
identifying the smallest distance in a distance matrix between the feature vectors;
creating a corresponding branch point in a dendrogram;
removing a row and column of the distance matrix that correspond to the smallest distance;
distances of linked feature vectors are calculated according to a minimum linkage criterion;
applying a distance threshold to form clusters of feature vectors in the dendrogram; and
discarding clusters of feature vectors with fewer feature vectors than an item count threshold.

### Claim 13 (depends on 9)

The computer system of claim 9 wherein determining the set of representative events for each cluster comprises:
for each cluster,
computing mutual information for each event in a set of events associated with the;
adding the event with largest mutual information to a set of representative events;
removing the event from the set of events;
computing a relevance measure for each event in the set of events;
adding the event with the largest relevance measure to the set of representative events; and
removing the event from the set of events.

### Claim 14 (depends on 8)

The computer system of claim 8 wherein classifying the runtime problem incident in the distributed computing system as corresponding to one of the historical problem incidents comprises:
computing a distance between the runtime feature vector and each of the representative feature vectors;
determining the shortest distance of the distances between the runtime feature vector and the representative feature vectors; and
classifying the runtime problem incident as corresponding to the historical problem incident with a representative feature vector that corresponds to the shortest distance.

### Claim 15

A non-transitory computer-readable medium encoded with machine-readable instructions that when executed by one or more processors of a computer system perform operations comprising:
determining set of representative events of historical problem incidents for a distributed computing system;
determining a representative feature vector for each set of representative events;
determining a runtime feature vector for runtime events of a runtime problem incident;
classifying the runtime problem incident as corresponding to a historical problem incident with a representative feature vector that is closest to the runtime feature vector; and
applying remedial measures to correct the runtime problem incident based on remedial measures used to correct the historical problem incident.

### Claim 16 (depends on 15)

The medium of claim 15 wherein determining representative events of the historical problem incidents for the distributed computing system comprises:
retrieving historically detected events that occurred in the distributed computing system and in a historical time period from a database;
determining sets of historical events that correspond to problem incidents in the distributed computing system;
determining a feature vector for each set of historical events;
forming clusters of feature vectors based on distances between the feature vectors;
determining a score for each cluster;
discarding clusters with scores below a cluster threshold; and
determining a set of representative events for each cluster above the cluster threshold.

### Claim 17 (depends on 16)

The medium of claim 16 wherein determining the sets of historical events comprise:
identifying the oldest historical event of historically detected events in the historical time period;
marking a beginning of a time interval with a start time of the oldest historical event; and
for each historical event in the historical time period from the oldest to the most recent historical event,
when the start time of the historical event is in the time interval adding the historical event to the set of historical events associated with the current time interval, and
when the start time of the historical event is not in the time interval,
marking a beginning of a next time interval with the start time of the historical event, and
adding the historical event to a next set of historical events.

### Claim 18 (depends on 16)

The medium of claim 16 wherein determining the feature vector for each set of historical events comprises:
for each set of historical events,
for each alert definition name in a set of alert definitions,
when an alert definition name is contained in one or more historical events assigning a value 1 to a corresponding element of a feature vector, and
when an alert definition name is contained in one or more historical events assigning a value 0 to a corresponding element of a feature vector.

### Claim 19 (depends on 16)

The medium of claim 16 wherein forming clusters of feature vectors based on distances between the feature vectors comprises:
identifying the smallest distance in a distance matrix between the feature vectors;
creating a corresponding branch point in a dendrogram;
removing a row and column of the distance matrix that correspond to the smallest distance;
distances of linked feature vectors are calculated according to a minimum linkage criterion;
applying a distance threshold to form clusters of feature vectors in the dendrogram; and
discarding clusters of feature vectors with fewer feature vectors than an item count threshold.

### Claim 20 (depends on 16)

The medium of claim 16 wherein determining the set of representative events for each cluster comprises:
for each cluster,
computing mutual information for each event in a set of events associated with the;
adding the event with largest mutual information to a set of representative events;
removing the event from the set of events;
computing a relevance measure for each event in the set of events;
adding the event with the largest relevance measure to the set of representative events; and
removing the event from the set of events.

### Claim 21 (depends on 15)

The medium of claim 15 wherein classifying the runtime problem incident in the distributed computing system as corresponding to the historical problem incident comprises:
computing a distance between the runtime feature vector and each of the representative feature vectors;
determining the shortest distance of the distances between the runtime feature vector and the representative feature vectors; and
classifying the runtime problem incident as corresponding to the historical problem incident with a representative feature vector that corresponds to the shortest distance.