# US 2026/0074948 A1 · Anomalous metrics mitigation proposal system in a cloud computing system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0074948 A1
- Document ID: US20260074948A1
- Status: Published application
- Kind: A1
- Application number: 19/364,730
- Filed: 2025-10-21
- Published: 2026-03-12
- Earliest claimed: 2023-08-31
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Myriam TITON; Rachel LEMBERG; Michael ALBURQUERQUE; Yaniv LAVI; Eliya HABBA; Jeremy SAMAMA; Hagit GRUSHKA
- Web page: https://patentgrep.com/patent/US20260074948A1

## CPC

- H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/0775: {Content or structure details of the error report, e.g. specific table structure, specific error fields}
- G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06N 3/044: Recurrent networks, e.g. Hopfield networks
- G06N 3/045: Combinations of networks
- G06N 3/047: Probabilistic or stochastic networks
- G06N 3/088: Non-supervised learning, e.g. competitive learning
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N 20/00: Machine learning
- H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- G06F 11/0757: {by exceeding a time limit, i.e. time-out, e.g. watchdogs}
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/3409: {for performance assessment}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

The disclosure relates to utilizing an anomaly mitigation proposal system to determine root causes, summarize anomalous metrics, and report mitigation actions for service incidents in cloud computing systems. Based on receiving an incident report request, the anomaly mitigation proposal system utilizes a two-layer approach that implements large generative language models to generate incident reports that include clear and concise text narratives summarizing metric anomalies, root causes, and corresponding mitigation actions. For example, the anomaly mitigation proposal system initially utilizes an online generative language model to provide these incident reports and, when unavailable within a time threshold, a fallback model that references root cause datastores.

## Claims

### Claim 1

A computer-implemented method for reporting anomalous metrics in a cloud computing system, the computer-implemented method comprising:
in response to receiving an incident report request, determining that an online model response threshold associated with an online generative language model has been satisfied;
providing a set of anomalous metrics and a set of queries to a fallback model, the fallback model utilizing a root cause datastore to determine a root cause for the set of anomalous metrics;
based on receiving text responses from the fallback model, generating an incident report that includes a summary text response, a root cause text response, and a mitigation text response; and
responding to the incident report request with the incident report.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the root cause datastore includes mappings between a root cause and metric anomalies that correspond to the root cause.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein the root cause datastore further maps the root cause to a mitigation action for mitigating the root cause.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, further comprising:
providing a first input including the set of anomalous metrics to the online generative language model, wherein the first input includes a first set of prompts, a summary prompt for the set of anomalous metrics, a root cause prompt for the set of anomalous metrics, and a mitigation prompt for the set of anomalous metrics.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising determining the root cause from a set of root causes within the root cause datastore utilizing a voting function.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, further comprising:
determining that an anomaly metric is not included in the root cause datastore;
determining a proxy anomaly metric to substitute for the anomaly metric utilizing a closeness score function; and
utilizing the proxy anomaly metric in the voting function to determine the root cause.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein the incident report request includes a metrics account and an incident time corresponding to a cloud computing system service.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, further comprising:
identifying a set of metrics corresponding to the incident report request based on the metrics account and the incident time; and
determining the set of anomalous metrics from the set of metrics.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, further comprising generating an additional root cause datastore by utilizing an offline generative language model and a second set of queries corresponding to the set of anomalous metrics to create mappings between anomalous metrics and root causes.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1, further comprising updating the root cause datastore by:
simulating an additional root cause condition;
determining an anomalous metric that result due to simulating the additional root cause condition; and
generating a mapping between the additional root cause condition and the anomalous metric.

### Claim 11 (depends on 1)

The computer-implemented method of claim 1, further comprising:
providing a first input including the set of anomalous metrics to the online generative language model, wherein the online model response threshold is satisfied when the online generative language model provides an inaccurate text response to the first input.

### Claim 12 (depends on 11)

The computer-implemented method of claim 11, further comprising:
in response to receiving an additional incident report request, providing an additional set of anomalous metrics and the first input to the online generative language model to receive text narrative responses;
receiving the text narrative responses from the online generative language model before the online model response threshold is satisfied; and
providing an additional incident report having the text narrative responses in response to the additional incident report request.

### Claim 13 (depends on 12)

The computer-implemented method of claim 12, further comprising determining that the online generative language model provides an inaccurate text response to the first input by validating the text responses with a follow-up prompt to the online generative language model that includes portions of the text responses before providing the additional incident report.

### Claim 14 (depends on 1)

The computer-implemented method of claim 1, wherein the online model response threshold is a timer-based threshold that is satisfied when the text responses are not received before a timer expires.

### Claim 15

A system for reporting anomalous metrics in a cloud computing system, the system comprising:
a processing system having a processor; and
a computer memory including:
a set of anomalous metrics;
a root cause datastore that maps root causes to anomalous metrics;
a fallback model that utilizes the root cause datastore to determine root causes for sets of anomalous metrics; and
instructions that, when executed by the processing system, cause the system to carry out operations comprising:
providing the set of anomalous metrics to the fallback model;
based on receiving text responses from the fallback model, generating an incident report that includes a summary text response, a root cause text response, and a mitigation text response; and
responding to an incident report request by providing the incident report to a computing device.

### Claim 16 (depends on 15)

The system of claim 15, wherein the operations further comprise:
providing the set of anomalous metrics and a first input to an online generative language model, wherein the first input includes a summary query, a root cause query, and a mitigation query; and
providing the online generative language model with additional context for the set of anomalous metrics, including metric names, anomaly directions, dimensions, resource types, sampling types, and anomaly types.

### Claim 17 (depends on 16)

The system of claim 16, wherein the first input includes a first set of prompts that is provided as part of an application programming interface (API).

### Claim 18 (depends on 15)

The system of claim 15, wherein the incident report includes:
time series graphs for metrics within the set of anomalous metrics; or
the summary text response of the set of anomalous metrics, the root cause text response indicating a root cause, and the mitigation text response indicating a mitigation action for the root cause.

### Claim 19

A computer-implemented method for reporting anomalous metrics in a cloud computing system, the computer-implemented method comprising:
determining that an online model response threshold associated with an online generative language model has been satisfied;
providing a set of anomalous metrics and a set of queries to a fallback model;
determining, utilizing the fallback model, a root cause for the set of anomalous metrics based on analyzing mappings within a root cause datastore;
based on receiving text responses from the fallback model, generating an incident report that includes a summary text response, a root cause text response, and a mitigation text response; and
responding to a incident report request by providing the incident report to a computing device.

### Claim 20 (depends on 19)

The computer-implemented method of claim 19, further comprising:
in response to receiving the incident report request, providing the set of anomalous metrics and a first set of prompts to the online generative language model to receive the text responses before providing the set of anomalous metrics to the fallback model; and
determining that the online model response threshold associated with the online generative language model has been satisfied without receiving the text responses from the online generative language model.