# US 2025/0094271 A1 · Log representation learning for automated system maintenance

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0094271 A1
- Document ID: US20250094271A1
- Status: Published application
- Kind: A1
- Application number: 18/829,545
- Filed: 2024-09-10
- Published: 2025-03-20
- Earliest claimed: 2023-09-20
- Assignees: NEC Laboratories America, Inc.
- Applicants: NEC Laboratories America, Inc.
- Inventors: Zhengzhang Chen; Lecheng Zheng; Haifeng Chen; Yanchi Liu; Xujiang Zhao; Yuncong Chen; LuAn Tang
- Web page: https://patentgrep.com/patent/US20250094271A1

## CPC

- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06N 3/044: Recurrent networks, e.g. Hopfield networks
- G06N 3/08: Learning methods
- G16H 10/60: for patient-specific data, e.g. for electronic patient records
- G06F 2201/81: Threshold
- G06F 2201/835: Timestamp
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA

## Abstract

Systems and methods for log representation learning for automated system maintenance. An optimized parser can transform collected system logs into log templates. A tokenizer can tokenize the log templates partitioned into time windows to obtain log template tokens. The log template tokens can train a language model (LM) with deep learning to obtain a trained LM. The trained LM can detect anomalies from system logs to obtain detected anomalies. A corrective action can be performed on a monitored entity based on the detected anomalies.

## Claims

### Claim 1

A computer-implemented method for log representation learning for automated system maintenance, comprising:
transforming collected system logs into log templates using an optimized parser;
tokenizing the log templates partitioned into time windows to obtain log template tokens;
training a language model (LM) with deep learning using the log template tokens to obtain a trained LM;
detecting anomalies from system logs using the trained LM to obtain detected anomalies; and
performing a corrective action to a monitored entity based on the detected anomalies.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein performing a corrective action further comprises updating a medical diagnosis of a patient based on the detected anomalies from system logs, that includes healthcare data of the patient, collected from a healthcare data system.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein transforming collected system logs further comprises optimizing a parser to eliminate noise and extraneous information from system logs.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein tokenizing the log templates further comprises partitioning system logs into multiple time windows with a fixed window size to capture unique log sequences within a specific time range.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein training a large language model further comprises fine-tuning the trained LM using incoming system logs to optimize performance and adaptability.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, wherein training a large language model further comprises computing a global loss function that maps log sequences to representation vectors that have an average minimum distances to a center in a latent space in an embedding layer using a recurrent neural network.

### Claim 7 (depends on 6)

The computer-implemented method of claim 6, wherein training a large language model further comprises computing a local loss function that obtains a sequence of hidden representations that encode sequential dependences in local regions in the latent space.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, wherein training a large language model further comprises fusing the global loss function and the local loss function to obtain a fused loss function to train the LM using the fused loss function.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, wherein training a large language model further comprises transforming system logs into an embedding layer to preserve relationships between system logs.

### Claim 10

A system, comprising:
a memory device; and
one or more processor devices operatively coupled with the memory device to:
transform collected system logs into log templates using an optimized parser;
tokenize the log templates partitioned into time windows to obtain log template tokens;
train a language model (LM) with deep learning using the log template tokens to obtain a trained LM;
detect anomalies from system logs using the trained LM to obtain detected anomalies; and
perform a corrective action to a monitored entity based on the detected anomalies.

### Claim 11 (depends on 10)

The system of claim 10, wherein to perform a corrective action further comprises to update a medical diagnosis of a patient based on the detected anomalies from system logs, that includes healthcare data of the patient, collected from a healthcare data system.

### Claim 12 (depends on 10)

The system of claim 10, wherein to transform collected system logs further comprises optimizing a parser to eliminate noise and extraneous information from system logs.

### Claim 13 (depends on 10)

The system of claim 10, wherein to tokenize the log templates further comprises to partition system logs into multiple time windows with a fixed window size to capture unique log sequences within a specific time range.

### Claim 14 (depends on 10)

The system of claim 10, wherein to train a large language model further comprises to fine-tune the trained LM using incoming system logs to optimize performance and adaptability.

### Claim 15 (depends on 10)

The system of claim 10, wherein training a large language model further comprises to compute a global loss function that maps log sequences to representation vectors that have an average minimum distances to a center in a latent space in an embedding layer using a recurrent neural network.

### Claim 16 (depends on 15)

The system of claim 15, wherein training a large language model further comprises computing a local loss function that obtains a sequence of hidden representations that encode sequential dependences in local regions in the latent space.

### Claim 17 (depends on 16)

The system of claim 16, wherein to train a large language model further comprises to fuse the global loss function and the local loss function to obtain a fused loss function to train the LM using the fused loss function.

### Claim 18 (depends on 1)

The computer-implemented method of claim 1, wherein training a large language model further comprises transforming system logs into an embedding layer to preserve relationships between system logs.

### Claim 19

A non-transitory computer program product comprising a computer-readable storage medium including program code for log representation learning for automated system maintenance, wherein the program code when executed on a computer causes the computer to:
transform collected system logs into log templates using an optimized parser;
tokenize the log templates partitioned into time windows to obtain log template tokens;
train a language model (LM) with deep learning using the log template tokens to obtain a trained LM;
detect anomalies from system logs using the trained LM to obtain detected anomalies; and
perform a corrective action to a monitored entity based on the detected anomalies.

### Claim 20 (depends on 19)

The non-transitory computer program product of claim 19, wherein to perform a corrective action further comprises updating a medical diagnosis of a patient based on the detected anomalies from system logs, that includes healthcare data of the patient, collected from a healthcare data system.