# US 2021/0240553 A1 · Inline categorizing of events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240553 A1 - Document ID: US20210240553A1 - Status: Published application - Kind: A1 - Application number: 17/113,506 - Filed: 2020-12-07 - Published: 2021-08-05 - Earliest claimed: 2020-01-30 - Assignees: PagerDuty, Inc. - Applicants: PagerDuty, Inc. - Inventors: Christopher Phillip Bonnell - Web page: https://patentgrep.com/patent/US20210240553A1 ## CPC - G06F 16/35: Clustering; Classification - G06N 20/00: Machine learning - G06F 16/2237: {Vectors, bitmaps or matrices} - G06F 16/2255: {Hash tables} - G06F 40/284: Lexical analysis, e.g. tokenisation or collocates - G06F 40/30: Semantic analysis - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Embodiments are directed to managing operations over a network. An event associated with network operations may be provided. A hash function may generate key values that correspond to words included in message information associated with the event. A message vector may be generated based on the key values such that each component in the message vector that corresponds to a key value is set to one. Group vectors may be determined such that each group vector is associated with an event group. Similarity scores may be generated for the group vectors based on the message vector and the group vectors such that each group vector corresponds to a separate similarity score. If the similarity scores exceed a threshold, the event may be associated with event groups associated with a group vector that correspond similarity score that exceeds the threshold. ## Claims ### Claim 1 (canceled) ### Claim 2 A method for managing networked computer systems, comprising: generating a message vector by adding, to the message vector, each of one or more key values obtained by executing a hash function, using a processor, on one or more words extracted from message information associated with an event associated with an operation in the network; generating one or more similarity scores between the message vector and one or more group vectors associated with respective event groups; associating the event with at least one of the event groups based on the one or more similarity scores; and generating a user interface configured to visually display and obtain feedback regarding the association. ### Claim 3 (depends on 2) The method of claim 2, wherein generating the similarity score includes calculating a cosine similarity between the message vector and the group vector. ### Claim 4 (depends on 2) The method of claim 2, further comprising: generating an agreement score between the message vector and one or more group vectors associated with respective event groups based on previously obtained feedback; and wherein associating the event with at least one of the event groups based on the one or more similarity scores includes determining whether to override an association based on the agreement score. ### Claim 5 (depends on 4) The method of claim 4, wherein determining whether to override an association based on the agreement score includes: adding the event to the event group if the agreement score is a positive value and the similarity score is less than a threshold; and not adding the event to the event group if the agreement score is a negative value and the similarity score is greater than the threshold. ### Claim 6 (depends on 2) The method of claim 2, wherein associating the event with at least one of the event groups based on the one or more similarity scores includes adding the message vector to the group vector in a component-wise fashion. ### Claim 7 (depends on 2) The method of claim 2, further comprising: identifying a new event group by: generating respective similarity scores between the message vector associated with the event and at least one of a plurality of comparison message vectors associated with respective comparison events; and responsive to a determination, based on the respective similarity scores, that the event and a respective one of the comparison events belong to the new event group, generating a new group vector by adding the message vector and the message vector associated with the respective one of the comparison events in a component-wise fashion. ### Claim 8 (depends on 2) The method of claim 2, further comprising: responsive to receipt of negative feedback regarding the association between the event and a respective one of the event groups, removing the association between the event and the respective one of the event groups by subtracting the message vector of the event from the respective one of the event groups. ### Claim 9 (depends on 2) The method of claim 2, further comprising: responsive to receipt of negative feedback regarding the association between the event and a respective one of the event groups, subtracting, component-wise, an outer product of the message vector and the group vector for the respective one of the event groups from a matrix included in a learner object. ### Claim 10 (depends on 9) The method of claim 9, further comprising: generating an agreement score between a new message vector and the respective one of the event groups by: generating, component-wise, an outer product of the new message vector and the group vector for the respective one of the event groups from a matrix included in a learner object; generating a Kronecker product between the outer product of the new message vector and the group vector for the respective one of the event groups and the matrix included in the learner object; and summing the values of the Kronecker product as the agreement score. ### Claim 11 (depends on 9) The method of claim 9, further comprising: responsive to receipt of positive feedback regarding the association between the event and a respective one of the event groups, adding, component-wise, an outer product of the message vector and the group vector for the respective one of the event groups to a matrix included in a learner object. ### Claim 12 A system for managing networked computer systems, comprising: an ingestion engine configured to receive an event; and a clustering engine configured to: associate the event with a service based on a similarity score generated between a message vector associated with the event and a group vector associated with the service, wherein the message vector includes key values obtained by executing a hash function against one or more words associated with the event; and generate a user interface configured to visually display and obtain feedback regarding the association. ### Claim 13 (depends on 12) The system of claim 12, wherein the ingestion engine is further configured to normalize the event into a common event format. ### Claim 14 (depends on 12) The system of claim 12, wherein the clustering engine is configured to determine the similarity score by generating a cosine similarity between the message vector and the group vector. ### Claim 15 (depends on 12) The system of claim 12, wherein the clustering engine is further configured to: generate an agreement score between the message vector and the group vector, the agreement score indicating whether a learner object agrees with the similarity score; and wherein the configuration to associate the event with a service is subject to being overridden by the agreement score. ### Claim 16 (depends on 15) The system of claim 15, wherein the configuration to associate the event with a service is subject to being overridden by the agreement score when: the agreement score is a positive value and the similarity score is less than a threshold; or the agreement score is a negative value and the similarity score is greater than the threshold. ### Claim 17 A system for managing networked computer systems, comprising: a server device, including: a transceiver operative to communicate over a network; and a processor device operative to execute instructions to: receive an event having associated message information; generate a message vector by adding key values obtained by executing a hash function against one or more words associated with the event; associate the event with an event group based on an agreement score generated using the message vector and a learner object reflecting feedback from a user regarding a prior association between a prior event and the event group; and generate a user interface configured to visually display and obtain feedback regarding the association. ### Claim 18 (depends on 17) The system of claim 17, wherein the instructions to associate the event with the event group further comprises instructions to generate a similarity score between the message vector and a group vector and determining whether to associate the event with the event group based on the similarity score and the agreement score. ### Claim 19 (depends on 18) The system of claim 18, wherein determining whether to associate the event with the event group based on the similarity score and the agreement score is based on a relative difference between the similarity score and the agreement score and a magnitude of the agreement score. ### Claim 20 (depends on 18) The system of claim 18, wherein the instructions to associate the event with the event group further comprises instructions to add the message vector to the group vector. ### Claim 21 (depends on 17) The system of claim 17, wherein the learner object includes a matrix, the matrix values reflecting an addition or subtraction, component-wise, of an outer product of a prior message vector associated with the prior event and a group vector associated with the event group at a time the feedback was received from the user.