Systems and methods for remediating computer reliability issues

• US 10,339,308 B1
• Filed: 11/10/2016
• Issued: 07/02/2019
• Est. Priority Date: 11/10/2016
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hart, Michael, Spertus, Michael, Sobel, William E., Supekar, Nitin
• Primary Examiner(s): Song, Hee K
• Application Number:
  US15/347,933
• Time in Patent Office: 964 Days
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 10/20 Administration of product repair or maintenance

Abstract

The disclosed computer-implemented method for remediating computer reliability issues may include (1) obtaining a computer-generated log line that potentially includes information pertaining to a cause of a reliability issue experienced by a device, (2) determining that a product-specific schema has not been created for a product that generated the computer-generated log line, (3) in response to determining that a product-specific schema has not been created for the product, matching values of the computer-generated log line to fields within one or more established schemas that are not specific to the product, (4) identifying an entry, within the one or more established schemas, that corresponds to the computer-generated log line, and (5) remediating the device based on information associated with the entry within the one or more established schemas. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for remediating computer reliability issues, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

obtaining a computer-generated log line that potentially includes information pertaining to a cause of a reliability issue experienced by a device;

determining that a product-specific schema has not been created for a product that generated the computer-generated log line;

in response to determining that a product-specific schema has not been created for the product, matching values of the computer-generated log line to fields within one or more established schemas that are not specific to the product;

based at least in part on the fields that match the values of the computer-generated log line, identifying an entry, within the one or more established schemas, that corresponds to the computer-generated log line; and

remediating the device based on information associated with the entry within the one or more established schemas.

2. The computer-implemented method of claim 1, wherein matching the values of the computer-generated log line to the fields within the one or more established schemas comprises matching the values based on at least one of:

a size of the values;

a format of the values; and

lexical content of the values.

3. The computer-implemented method of claim 1, wherein matching a particular value of the computer-generated log line with a particular field within the one or more established schemas comprises matching the particular value based on at least one of:

a value that precedes the particular value in the computer-generated log line;

a value that succeeds the particular value in the computer-generated log line;

a determination that a certain field within the one or more established schemas corresponds to another value within the computer-generated log line; and

a determination that a certain field within the one or more established schemas does not correspond to any value within the computer-generated log line.

4. The computer-implemented method of claim 1, further comprising:

training a machine learning classifier to identify values within log lines that correspond to schema fields of established schemas; and

using the machine learning classifier to match the values of the computer-generated log line to the fields within the one or more established schemas.

5. The computer-implemented method of claim 1, further comprising:

identifying a database that includes a list of values that may correspond to certain fields included in the one or more established schemas; and

matching the values of the computer-generated log line to the fields within the one or more established schemas based at least in part on information obtained from the database.

6. The computer-implemented method of claim 1, wherein the computer-generated log line comprises a novel log line that has not previously been assigned to an entry within the one or more established schemas.

7. The computer-implemented method of claim 1, further comprising:

identifying an abstract field within the one or more established schemas whose value does not directly correspond to a log line component; and

inferring a value of the abstract field for the computer-generated log line based on information collected by analyzing unstructured data included within the computer-generated log line.

8. The computer-implemented method of claim 7, wherein the abstract field comprises at least one of:

a category; and

a severity.

9. The computer-implemented method of claim 7, wherein inferring the value of the abstract field comprises inferring the value of the abstract field based on the values of the computer-generated log line that match the fields within the one or more established schemas.

10. The computer-implemented method of claim 9, wherein inferring the value of the abstract field comprises inferring the value of the abstract field based additionally on at least one of:

a size of the computer-generated log line;

content included with text of the computer-generated log line;

punctuation included within the computer-generated log line; and

fields for which no corresponding values are identified in the computer-generated log line.

11. The computer-implemented method of claim 1, wherein the reliability issue comprises a security issue that impacts the security of the device.

12. The computer-implemented method of claim 1, wherein the reliability issue comprises a stability issue that impacts the stability of the device.

13. The computer-implemented method of claim 1, wherein the reliability issue comprises at least one of:

a performance issue affecting the performance of the device; and

a data integrity issue.

14. The computer-implemented method of claim 1, wherein the reliability issue comprises at least one of:

a decrease in the overall reliability of the device;

a decrease in the reliability of application software installed on the device; and

a decrease in the reliability of system software installed on the device.

15. The computer-implemented method of claim 1, wherein identifying the entry that corresponds to the computer-generated log line comprises:

converting the values of the computer-generated log line to a series of text tokens;

converting each text token into a normalized format;

presenting each normalized token to a field value mapper; and

receiving, from the field value mapper, information indicating the fields that match the values of the computer-generated log line.

16. The computer-implemented method of claim 1, wherein the product that generated the computer-generated log line comprises a security product running on the device.

17. The computer-implemented method of claim 1, wherein:

the method further comprises determining, based on the information associated with the entry, that the reliability issue was likely caused by a malicious event incited by a malicious program; and

remediating the device comprises performing a computer security action.

18. The computer-implemented method of claim 17, wherein the computer security action comprises at least one of:

removing the malicious program from the device;

quarantining the malicious program; and

transmitting a notification to the device that indicates that the device has been infected with malware.

19. A system for remediating computer reliability issues, the system comprising:

an obtaining module, stored in memory, that obtains a computer-generated log line that potentially includes information pertaining to a cause of a reliability issue experienced by a device;

a determination module, stored in memory, that determines that a product-specific schema has not been created for a product that generated the computer-generated log line;

a matching module, stored in memory, that, in response to the determination module determining that a product-specific schema has not been created for the product, matches values of the computer-generated log line to fields within one or more established schemas that are not specific to the product;

an identification module, stored in memory, that, based at least in part on the fields that match the values of the computer-generated log line, identifies an entry, within the one or more established schemas, that corresponds to the computer-generated log line;

a remediation module, stored in memory, that remediates the device based on information associated with the entry within the one or more established schemas; and

at least one physical processor configured to execute the obtaining module, the determination module, the matching module, the identification module, and the remediation module.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

obtain a computer-generated log line that potentially includes information pertaining to a cause of a reliability issue experienced by a device;

determine that a product-specific schema has not been created for a product that generated the computer-generated log line;

in response to the determination that a product-specific schema has not been created for the product, match values of the computer-generated log line to fields within one or more established schemas that are not specific to the product;

based at least in part on the fields that match the values of the computer-generated log line, identify an entry, within the one or more established schemas, that corresponds to the computer-generated log line; and

remediate the device based on information associated with the entry within the one or more established schemas.