Learned response for alerts

• US 10,389,578 B2
• Filed: 03/06/2017
• Issued: 08/20/2019
• Est. Priority Date: 03/06/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Achtermann, Jeffrey M., Bender, Michael, Hahn, Timothy J., Madduri, Hari H., Marin, Jr., Leucir
• Primary Examiner(s): Ndiaye, Cheikh T
• Application Number:
  US15/450,867
• Publication Number:
  US 20180254961A1
• Time in Patent Office: 897 Days
• CPC Class Codes: G06N 5/043 Distributed expert systems; Blackboards
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications

Abstract

In a method for providing an automatic learned response in a network, a collection system observes user responses to the incoming system indicators and to parameter types and associated parameter values used in the user responses. The collection system creates alert event entries to includes the incoming system indicators, confidence thresholds, the user responses, and the parameter types and associated parameter values used in the user responses. When the collection system receives new system indicators, the collection system determines whether the new system indicators match the system indicators in one or more alert event entries. When the new system indicators match the system indicators in one or more alert event entries and the confidence level exceeds the confidence threshold, the collection system automatically creates a new response based on the user response, the parameter types, and the associated parameter values in the matching alert event entries.

Claims

1. A method for providing an automatic learned response in a network by a collection system, comprising:

observing, by the collection system, a plurality of system indicators from activities between a plurality of client devices or host systems;

observing, by the collection system, a plurality of user responses executed to address the plurality of system indictors, each user response comprising one or more parameter types and associated parameter values;

creating, by the collection system, a plurality of alert event entries for the plurality of user responses, wherein a given alert event entry of the plurality of alert event entries comprises a given user response of the plurality of user responses executed to address one or more system indicators of the plurality of system indicators, the one or more system indicators, and given one or more parameter types and given associated parameter values used in the given user response;

receiving one or more new system indicators by the collection system;

determining, by the collection system, whether the one or more new system indicators match the one or more system indicators in the given alert event entry;

when the one or more new system indicators match the one or more system indicators in the given alert event entry, automatically creating, by the collection system, a new response based on the given user response, the given one or more parameter types, and the given associated parameter values in the given alert event entry; and

executing, by the collection system, the new response.

2. The method of claim 1, wherein the creating of the given alert event entry further comprises:

requesting user verification of the one or more incoming system indicators, the given user response, the given one or more parameter types, or the given associated parameter values used in the given user response; and

modifying the given alert event entry according to the user verification.

3. The method of claim 1, wherein the automatically creating the new response comprises:

retrieving the user response in the given alert event entry;

retrieving the given one or more parameter types and the given associated parameter values in the given alert event entry;

determining a parameter value of each of the given one or more parameter types in the given alert event entry for the new response; and

automatically creating the new response based on the given user response and the given one or more parameter values of the given one or more parameter types in the given alert event entry.

4. The method of claim 3, wherein the automatically creating of the new response comprises:

identifying parametric parts of the one or more new system indicators using the given one or more parameter types in the given alert event entry;

formulating a new parameter value for each of the parametric parts; and

automatically creating the new response to comprise the new parameter values for each of the parametric parts.

5. The method of claim 1, wherein the given alert event entry is configured with a confidence threshold, wherein the automatically creating the new response further comprises:

determining a confidence level for an association of the new user response with the system indicators in the given alert event entry;

determining whether the confidence level is below the confidence threshold;

when the new confidence level is below the confidence threshold, requesting user verification of the new response; and

modifying the new response according to the user verification.

6. The method of claim 5, wherein the automatically creating the new response further comprises:

updating the confidence threshold configured with the given alert event entry according to the user verification.

7. A computer program product for providing an automatic learned response in a network, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to:

observe a plurality of system indicators from activities between a plurality of client devices or host systems;

observe a plurality of user responses executed to address the plurality of system indictors, each user response comprising one or more parameter types and associated parameter values;

create a plurality of alert event entries for the plurality of user responses, wherein a given alert event entry of the plurality of alert event entries comprises, a given user response of the plurality of user responses executed to address one or more system indicators of the plurality of system indicators, the one or more system indicators, and given one or more parameter types and given associated parameter values used in the given user response;

receive one or more new system indicators;

determine whether the one or more new system indicators match the one or more system indicators in the given more alert event entry;

when the one or more new system indicators match the one or more system indicators in the given alert event entry, automatically create a new response based on the given user response, the given one or more parameter types, and the given associated parameter values in the given one or more alert event entry; and

execute the new response.

8. The computer program product of claim 7, wherein the creating of the given alert event entry further comprises:

request user verification of the one or more incoming system indicators, the given user response, the given one or more parameter types, or the given associated parameter values used in the given user response; and

modify the given alert event entry according to the user verification.

9. The computer program product of claim 7, wherein the automatically creating the new response comprises:

retrieve the user response in the given alert event entry;

retrieve the given one or more parameter types and the given associated parameter values in the given alert event entry;

determine a parameter value of each of the given one or more parameter types in the given alert event entry for the new response; and

automatically create the new response based on the given user response and the given one or more parameter values of the given one or more parameter types in the given alert event entry.

10. The computer program product of claim 7, wherein the given alert event entry is configured with a confidence threshold, wherein the automatically creating the new response further comprises:

determine a confidence level for an association of the new user response with the system indicators in the given alert event entry;

determine whether the confidence level is below the confidence threshold;

when the confidence level is below the confidence threshold, request user verification of the new response; and

modify the new response according to the user verification.

11. The computer program product of claim 10, wherein the automatically creating the new response further comprises:

update the confidence threshold configured with the given alert event entry according to the user verification.

12. The computer program product of claim 7, wherein the automatically creating of the new response comprises:

identify parametric parts of the one or more new system indicators using the given one or more parameter types in the given alert event entry;

formulate a new parameter value for each of the parametric parts; and

automatically create the new response to comprise the new parameter values for each of the parametric parts.

13. A system, comprising:

one or more processors; and

a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to;

observe a plurality of system indicators from activities between a plurality of client devices or host systems;

observe a plurality of user responses executed to address the plurality of system indictors, each user response comprising one or more parameter types and associated parameter values;

create a plurality of alert event entries for the plurality of user responses, wherein a given alert event entry of the plurality of alert event entries comprises a given user response of the plurality of user responses executed to address one or more system indicators of the plurality of system indicators, the one or more system indicators, and given one or more parameter types and given associated parameter values used in the given user response;

receive one or more new system indicators;

determine whether the one or more new system indicators match the one or more system indicators in the given alert event entry;

when the one or more new system indicators match the one or more system indicators in the given alert event entry, automatically create a new response based on the given user response, the given one or more parameter types, and the given associated parameter values in the given alert event entry; and

execute the new response.

14. The system of claim 13, wherein the creating of the given alert event entry further comprises:

request user verification of the one or more incoming system indicators, the given user response, the given one or more parameter types, or the given associated parameter values used in the given user response; and

modify the given alert event entry according to the user verification.

15. The system of claim 13, wherein the automatically creating the new response comprises:

retrieve the user response in the given alert event entry;

retrieve the given one or more parameter types and the given associated parameter values in the given alert event entry;

determine a parameter value of each of the given one or more parameter types in the given alert event entry for the new response; and

automatically create the new response based on the given user response and the given one or more parameter values of the given one or more parameter types in the given alert event entry.

16. The system of claim 15, wherein the automatically creating of the new response comprises:

identify parametric parts of the one or more new system indicators using the given one or more parameter types in the given alert event entry;

formulate a new parameter value for each of the parametric parts; and

automatically create the new response to comprise the new parameter values for each of the parametric parts.

17. The system of claim 13, wherein the given alert event entry is configured with a confidence threshold, wherein the automatically creating the new response further comprises:

determine a confidence level for an association of the new user response with the system indicators in the given alert event entry;

determine whether the confidence level is below the confidence threshold;

when the confidence level is below the confidence threshold, request user verification of the new response; and

modify the new response according to the user verification.