US 12,380,342 B2
Alert management in data processing systems
Michael Elton Nidd, Zürich (CH); Hagen Völzer, Zürich (CH); Ioana Giurgiu, Zürich (CH); Jinho Hwang, Ossining, NY (US); and Larisa Shwartz, Greenwich, CT (US)
Assigned to International Business Machines Corporation, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Aug. 6, 2020, as Appl. No. 16/986,342.
Prior Publication US 2022/0044129 A1, Feb. 10, 2022
Int. Cl. G06N 5/04 (2023.01); G06F 16/23 (2019.01); G06N 5/01 (2023.01); G06N 20/00 (2019.01); G06N 20/20 (2019.01)
CPC G06N 5/04 (2013.01) [G06F 16/2379 (2019.01); G06N 5/01 (2023.01); G06N 20/20 (2019.01)] 18 Claims
OG exemplary drawing
 
1. A computer-implemented method for dynamically updating a master ruleset used by an alert management system that matches alerts in a data processing system with automated processes (“automata”) for handling the alerts, the method comprising:
training, by one or more processors, a machine learning model to correlate the alerts with the automata using a training dataset comprising matched alerts successfully handled by the automata, wherein the automata includes archiving logs in response to capacity alerts and removing zombie processes, wherein the machine learning model comprises a tree-ensemble model;
applying, by the one or more processors, the machine learning model to correlate unmatched alerts with the automata, wherein the unmatched alerts were not matched to the automata by the master ruleset;
responsive to exceeding a number of unmatched alerts, analyzing, by the one or more processors, an operation of the machine learning model in relation to correlation of the unmatched alerts, further comprising:
generating, by the one or more processors, a new tree based on features of paths through trees in the tree-ensemble model via which the unmatched alerts were correlated with the automata, wherein the new tree defines the new ruleset; and
pruning, by the one or more processors, the paths in dependance on a number on unmatched alerts correlated with automata via respective paths while retaining the paths with a higher number of unmatched alerts;
based on the analyzing, defining, by the one or more processors, a new ruleset for matching the unmatched alerts with the automata;
outputting, by the one or more processors, the new ruleset in a graphical user interface for auditing of each rule in the new ruleset;
responsive to approval of an audited rule of the new ruleset, adding, by the one or more processors, the audited rule to the master ruleset; and
responsive to matching the automata, deploying, by one or more processors, the automata.