# US 2022/0019935 A1 · Utilizing machine learning models with a centralized repository of log data to predict events and generate alerts and recommendations

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2022/0019935 A1
- Document ID: US20220019935A1
- Status: Published application
- Kind: A1
- Application number: 16/929,866
- Filed: 2020-07-15
- Published: 2022-01-20
- Earliest claimed: 2020-07-15
- Assignees: Accenture Global Solutions Limited
- Applicants: Accenture Global Solutions Limited
- Inventors: Prakash GHATAGE; Nirav Jagdish SAMPAT; Kumar VISWANATHAN; Naveen Kumar THANGARAJ; Sattish SUNDARAKRISHNAN; Kaustubh KURHEKAR; Richard Stephen Vincent PRICE
- Web page: https://patentgrep.com/patent/US20220019935A1

## CPC

- G06N 20/00: Machine learning
- G06Q 10/0639: Performance analysis of employees; Performance analysis of enterprise or organisation operations
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/302: {where the computing system component is a software system}
- G06F 11/3065: {Monitoring arrangements determined by the means or processing involved in reporting the monitored data (error or fault reporting or logging G06F11/0766)}
- G06F 11/3072: {where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting}
- G06F 11/327: {Alarm or error message display}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F 18/24323: {Tree-organised classifiers}
- G06F 40/30: Semantic analysis
- G06N 5/04: Inference or reasoning models
- G06N 20/20: Ensemble learning
- G06F 2201/81: Threshold
- G06F 2201/86: Event-based monitoring
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A device may receive log data from application logs associated with applications, service logs associated with services, and server logs associated with server devices. The device may store the log data. The device may perform natural language processing on the log data to convert the log data into event data identifying events associated with categories. The device may process the event data, with a first machine learning model, to identify patterns in the event data and to generate an alert based on the patterns. The device may process the event data, with a second machine learning model, to generate a correlation matrix for the event data and to predict an event based on the correlation matrix. The device may process the event data, with a third machine learning model, to classify the event data based on the categories and to generate a recommendation based on classifying the event data.

## Claims

### Claim 1

A method, comprising:
receiving, by a device, log data from application logs associated with applications, service logs associated with services, and server logs associated with server devices;
storing, by the device, the log data in a centralized log repository;
performing, by the device, natural language processing on the log data, stored in the centralized log repository, to convert the log data into event data identifying events associated with categories;
processing, by the device, the event data, with one or more first machine learning models, to identify patterns in the event data and to generate an alert based on the patterns;
processing, by the device, the event data, with one or more second machine learning models, to generate a correlation matrix for the event data and to predict an event based on the correlation matrix;
processing, by the device, the event data, with one or more third machine learning models, to classify the event data based on the categories and to generate a recommendation based on classifying the event data; and
performing, by the device, one or more actions based on one or more of the alert, the event, or the recommendation.

### Claim 2 (depends on 1)

The method of claim 1, wherein performing the one or more actions comprises one or more of:
providing data identifying the one or more of the alert, the event, or the recommendation for display;
causing an application to be reprogrammed based on the one or more of the alert, the event, or the recommendation;
causing one of the server devices to restart based on the one or more of the alert, the event, or the recommendation; or
causing a new server device to be implemented based on the one or more of the alert, the event, or the recommendation.

### Claim 3 (depends on 1)

The method of claim 1, wherein performing the one or more actions comprises one or more of:
causing a robot to be dispatched to service one of the server devices based on the one or more of the alert, the event, or the recommendation;
causing a technician to be dispatched to service one of the server devices based on the one or more of the alert, the event, or the recommendation; or
retraining one or more of the one or more first machine learning models, the one or more second machine learning models, or the one or more third machine learning models based on the one or more of the alert, the event, or the recommendation.

### Claim 4 (depends on 1)

The method of claim 1, wherein the one or more first machine learning models include one or more of:
a support vector machine model,
a random forest model,
a Monte Carlo tree search model, or
a temporal difference learning model.

### Claim 5 (depends on 1)

The method of claim 1, wherein the one or more second machine learning models include one or more of:
a support vector machine model,
a random forest model,
an auto regressive integrated moving average (ARIMA) model,
a seasonal ARIMA model, or
a vector autoregressive moving average with exogenous regressors model.

### Claim 6 (depends on 1)

The method of claim 1, wherein the one or more third machine learning models include one or more of:
a support vector machine model,
a random forest model,
a Monte Carlo tree search model,
a temporal difference learning model, or
a dynamic sentence generation model.

### Claim 7 (depends on 1)

The method of claim 1, wherein processing the event data, with the one or more first machine learning models, to identify the patterns in the event data and to generate the alert based on the patterns comprises:
identifying application behavior patterns based on the event data;
identifying historical critical issue data from user ticket data of the event data;
classifying the event data based on the application behavior patterns and the history critical issue data; and
generate the alert for a critical event identified based on classifying the event data.

### Claim 8

A device, comprising:
one or more memories; and
one or more processors, communicatively coupled to the one or more memories, configured to:
receive log data from application logs associated with applications, service logs associated with services, and server logs associated with server devices;
store the log data in a centralized log repository for a predetermined retention time period;
perform natural language processing on the log data, stored in the centralized log repository, to convert the log data into event data identifying events associated with categories;
selectively:
process the event data, with one or more first machine learning models, to identify patterns in the event data and to generate an alert based on the patterns;
process the event data, with one or more second machine learning models, to generate a correlation matrix for the event data and to predict an event based on the correlation matrix; or
process the event data, with one or more third machine learning models, to classify the event data based on the categories and to generate a recommendation based on classifying the event data; and
perform one or more actions based on one or more of the alert, the event, or the recommendation.

### Claim 9 (depends on 8)

The device of claim 8, wherein the one or more processors, when processing the event data, with the one or more second machine learning models, to generate the correlation matrix for the event data and to predict the event based on the correlation matrix, are configured to:
separate critical events from the event data;
insert impact data in the event data without the critical events;
identify correlations and seasonal variations in the event data and the impact data;
generate the correlation matrix based on the correlations and the seasonal variations in the event data and the impact data; and
predict the event based on the correlation matrix.

### Claim 10 (depends on 8)

The device of claim 8, wherein the one or more processors, when processing the event data, with the one or more third machine learning models, to classify the event data based on the categories and to generate the recommendation based on classifying the event data, are configured to:
classify the event data into the categories;
identify, based on classifying the event data into the categories, correlations between application response times and hardware metrics of the server devices; and
generate the recommendation based on the correlations between the application response times and the hardware metrics of the server devices.

### Claim 11 (depends on 8)

The device of claim 8, wherein the log data includes data identifying one or more of:
authentication, authorization, and access data associated with the applications, the services, and the server devices,
threats associated with the applications, the services, and the server devices,
changes associated with the applications, the services, and the server devices,
resource usage associated with the applications, the services, and the server devices, or
availability data associated with the applications, the services, and the server devices.

### Claim 12 (depends on 8)

The device of claim 8, wherein the event data includes data identifying one or more of:
a debug event associated with debugging one of the applications, the services, or the server devices,
a warning event associated with one of the applications, the services, or the server devices,
a critical event associated with one of the applications, the services, or the server devices,
an information event associated with one of the applications, the services, or the server devices, or
an error event associated with one of the applications, the services, or the server devices.

### Claim 13 (depends on 8)

The device of claim 8, wherein the one or more processors, when performing the one or more actions, are configured to:
generate a user interface that includes a dashboard displaying the event data, the alert, the event, and the recommendation; and
provide the user interface for display.

### Claim 14 (depends on 8)

The device of claim 8, wherein the correlation matrix identifies relationships between the log data from the application logs, the log data from the service logs, and the log data from the server logs.

### Claim 15

A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
receive log data from application logs associated with applications, service logs associated with services, and server logs associated with server devices;
store the log data in a centralized log repository;
process the log data, with one or more first machine learning models, to identify patterns in the log data and to generate an alert based on the patterns;
process the log data, with one or more second machine learning models, to generate a correlation matrix for the log data and to predict an event based on the correlation matrix;
process the log data, with one or more third machine learning models, to classify the log data based on categories and to generate a recommendation based on classifying the log data; and
perform one or more actions based on one or more of the alert, the event, or the recommendation.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to perform the one or more actions, cause the one or more processors to one or more of:
provide data identifying the one or more of the alert, the event, or the recommendation for display;
cause an application to be reprogrammed based on the one or more of the alert, the event, or the recommendation;
cause one of the server devices to restart based on the one or more of the alert, the event, or the recommendation; or
cause a new server device to be implemented based on the one or more of the alert, the event, or the recommendation.
cause a robot to be dispatched to service one of the server devices based on the one or more of the alert, the event, or the recommendation;
cause a technician to be dispatched to service one of the server devices based on the one or more of the alert, the event, or the recommendation; or
retrain one or more of the one or more first machine learning models, the one or more second machine learning models, or the one or more third machine learning models based on the one or more of the alert, the event, or the recommendation.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to process the log data, with the one or more first machine learning models, to identify the patterns in the log data and to generate the alert based on the patterns, cause the one or more processors to:
identify application behavior patterns based on the log data;
identify historical critical issue data from user ticket data of the log data;
classify the log data based on the application behavior patterns and the history critical issue data; and
generate the alert for a critical event identified based on classifying the log data.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to process the log data, with the one or more second machine learning models, to generate the correlation matrix for the log data and to predict the event based on the correlation matrix, cause the one or more processors to:
separate critical events from the log data;
insert impact data in the log data without the critical events;
identify correlations and seasonal variations in the log data and the impact data;
generate the correlation matrix based on the correlations and the seasonal variations in the log data and the impact data; and
predict the event based on the correlation matrix.

### Claim 19 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to process the log data, with the one or more third machine learning models, to classify the log data based on categories and to generate the recommendation based on classifying the log data, cause the one or more processors to:
classify the log data into the categories;
identify, based on classifying the log data into the categories, correlations between application response times and hardware metrics of the server devices; and
generate the recommendation based on the correlations between the application response times and the hardware metrics of the server devices.

### Claim 20 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the log data includes data identifying one or more of:
authentication, authorization, and access data associated with the applications, the services, and the server devices,
threats associated with the applications, the services, and the server devices,
changes associated with the applications, the services, and the server devices,
resource usage associated with the applications, the services, and the server devices, or
availability data associated with the applications, the services, and the server devices.