# US 2021/0243069 A1 · Alert correlating using sequence model with topology reinforcement systems and methods

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0243069 A1
- Document ID: US20210243069A1
- Status: Published application
- Kind: A1
- Application number: 16/876,723
- Filed: 2020-05-18
- Published: 2021-08-05
- Earliest claimed: 2020-01-31
- Assignees: Opsramp, Inc.
- Applicants: Opsramp, Inc.
- Inventors: Jiayi Gu HOFFMAN; Mahesh RAMACHANDRAN; Bhanu Pratap SINGH
- Web page: https://patentgrep.com/patent/US20210243069A1

## CPC

- H04L 41/16: using machine learning or artificial intelligence
- G06F 9/5072: {Grid computing}
- G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications}
- G06F 9/544: {Buffers; Shared memory; Pipes}
- G06F 18/22: Matching criteria, e.g. proximity measures
- G06F 18/23: Clustering techniques
- G06N 3/044: Recurrent networks, e.g. Hopfield networks
- G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
- G06N 3/08: Learning methods
- G06N 3/09: Supervised learning
- H04L 41/0618: {based on the physical or logical position}
- H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Alert correlation plays an important role in IT event management. It helps reduce the number of alerts that IT staff have to act upon. The disclosure describes a method, a computer program product that applies a machine driven deep learning model to effectively correlate alerts caused by a common root cause. In addition, this method of correlation provides the user the context of the root cause. Therefore, it helps the user to quickly identify, understand and resolve the problem thereby reducing the mean time to identification and resolution. Alerts that are caused by the same root cause therefor come together. In the machine learning world, language sequence models are doing very well on learning the sequence patterns between words. For example, the machine can learn the subtle difference between choice of words and the order of words in order to fake a person's writing. The disclosed embodiments use similar technology but apply it on IT resource and application monitoring alerts across private and public clouds to learn the alert's sequence pattern. Once the sequence model is trained with alert sequences, the model is fed with a stream of new alerts, the model then identifies the two or more alerts that are together or clustered. Clustered alerts are often caused by the same root cause and should be correlated as one unit of work to understand cause, impact and resolution.

## Claims

### Claim 1

A method of correlating a plurality of alerts in a network environment including multiple computing devices coupled through one or more networks comprising:
receiving a plurality of alerts from one or more applications operating in the network environment;
analyzing the plurality of alerts in a time sequence;
correlating the plurality of alerts via an alert correlation module comprising one or more of a sequence model, a topology reinforcement module, and a similarity reinforcement module;
clustering the plurality of alerts attributable to a common triggering event.

### Claim 2 (depends on 1)

The method of claim 1 further comprising: converting one or more raw alerts into one or more normalized alerts for analysis.

### Claim 3 (depends on 2)

The method of claim 2 wherein the raw alerts are normalized for analysis and provided to a data pipeline.

### Claim 4 (depends on 1)

The method of claim 1 wherein the sequence model is trainable using historical alert sequences on a neural network.

### Claim 5 (depends on 1)

The method of claim 1 wherein the topology reinforcement is created through a network discovery.

### Claim 6 (depends on 1)

The method of claim 1 wherein the similarity reinforcement is based on a natural language process.

### Claim 7 (depends on 1)

The method of claim 1 wherein a first alert in an alert sequence is used to invoke a sequence model.

### Claim 8 (depends on 1)

The method of claim 1 further comprising alert sequence training of a neural network.

### Claim 9 (depends on 8)

The method of claim 8 further comprising:
taking information from an input alert at a first timestep;
calculating an alert sequence; and
predicting a time interval for which a simulation will progress.

### Claim 10 (depends on 8)

The method of claim 8 further comprising alert embedding.

### Claim 11 (depends on 8)

The method of claim 8 further comprising running a training workload as a scheduled batch job on a training node.

### Claim 12 (depends on 1)

The method of claim 1 wherein the plurality of alerts are not analyzed individually or in alert pairs.

### Claim 13

One or more computer-readable storage media storing computer-executable instructions for causing a computer to perform a method, the method comprising:
receiving a plurality of alerts from one or more applications operating in a network environment;
analyzing the plurality of alerts in a time sequence;
correlating the plurality of alerts via an alert correlation module comprising one or more of a sequence model, a topology reinforcement module, and a similarity reinforcement module;
clustering the plurality of alerts attributable to a common triggering event.

### Claim 14 (depends on 13)

The computer-readable storage media of claim 13 further comprising:
converting one or more raw alerts into one or more normalized alerts for analysis.

### Claim 15 (depends on 14)

The computer-readable storage media of claim 14 wherein the raw alerts are normalized for analysis and provided to a data pipeline.

### Claim 16 (depends on 13)

The computer-readable storage media of claim 13 wherein the sequence model is trainable using historical alert sequences on a neural network.

### Claim 17 (depends on 13)

The computer-readable storage media of claim 13 wherein the topology reinforcement is created through a network discovery.

### Claim 18 (depends on 13)

The computer-readable storage media of claim 13 wherein the similarity reinforcement is based on a natural language process.

### Claim 19 (depends on 13)

The computer-readable storage media of claim 13 wherein a first alert in an alert sequence is used to invoke a sequence model.

### Claim 20 (depends on 13)

The computer-readable storage media of claim 13 further comprising alert sequence training of a neural network.

### Claim 21 (depends on 20)

The computer-readable storage media of claim 20 further comprising:
taking information from an input alert at a first timestep;
calculating an alert sequence; and
predicting a time interval for which a simulation will progress.

### Claim 22 (depends on 20)

The computer-readable storage media of claim 20 further comprising alert embedding.

### Claim 23 (depends on 20)

The computer-readable storage media of claim 20 further comprising running a training workload as a scheduled batch job on a training node.

### Claim 24 (depends on 13)

The method of claim 13 wherein the plurality of alerts are not analyzed individually or in alert pairs.

### Claim 25

A system for correlating alerts in a computing environment including multiple computing devices coupled through one or more networks comprising:
an alert processing service comprising an alert correlation module having one or more of a sequence model, topology reinforcement module, and similarity reinforcement module; and
an alert normalization engine.

### Claim 26 (depends on 25)

The system of claim 25 wherein the system is configurable to convert one or more raw alerts received by the alert processing service into one or more normalized alerts for analysis.

### Claim 27 (depends on 25)

The system of claim 25 wherein the sequence model is trainable using historical alert sequences on a neural network.

### Claim 28 (depends on 25)

The system of claim 25 wherein the topology reinforcement is created through a network discovery.