System and methods for IT resource event situation classification and semantics

• US 20070005535A1
• Filed: 04/27/2005
• Published: 01/04/2007
• Est. Priority Date: 04/27/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Salahshour, Abdolreza, Sheng, Ma, Loewenstern, David, Minerley, Kevin
• Granted Patent: US 7,461,044 B2
• Time in Patent Office: Days
• US Class Current: 706/20
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

An off-line knowledge acquisition process takes IT resource messages, in CBE format generated natively or using generic log adapter, and use a variety of mining techniques and technologies to automatically generate a set of rules used to provide situation categories for the resource messages/events. The off-line knowledge acquisition process also generates an event-to-situation mapping file for efficiently mapping situation to events in runtime. Rules are fed back into a knowledge repository and process for reuse. The off-line knowledge acquisition process also provides methods to reiterate the process of mining (autonomically and/or by human interaction) to improve the rules and confidence level assigning the situation categories. A runtime categorizer component uses the event-to-situation mapping file, when available from the off-line knowledge acquisition process, to add situation categories to the IT resource events. In addition, the runtime categorizer uses a plurality of annotator components each capable of adding a situation annotation to incoming messages based on rules generated by the off-line knowledge acquisition process. An assessment component chooses the best situation category from those annotated by the annotator components.

Claims

1. A method of classifying a message, the method comprising:

receiving a message;

parsing the message;

determining if a classification category maps to the message;

identifying a plurality of features from the parsed message;

matching at least one classification rule to at least one of the plurality of features;

rating the match between the at least one of the plurality of features and the at least one classification rule;

identifying a classification category; and

labeling the message with the identified classification category.

2. The method of claim 1, wherein identifying a classification category further comprising:

obtaining an identity for a classification category that maps to the message.

3. The method of claim 1, wherein identifying a classification category further comprising:

obtaining an identity for a classification category from the at least one classification rule that matches the at least one of the plurality of features.

4. The method of claim 1, further comprising:

matching a second classification rule to at least one other of the plurality of features;

rating the match between the at least one other of the plurality of features and the second classification rule; and

assessing ratings of all matches between features and classification rules.

5. The method of claim 4, wherein identifying a classification category further comprising:

obtaining an identity for a classification category from the assessment of ratings of all matches between features and classification rules.

6. The method of claim 1, further comprising:

receiving a plurality of messages;

parsing the plurality of messages;

identifying features from the plurality of messages;

selecting a common classification category semantic;

matching at least some of the identified features with the common classification category semantic; and

generating a classification rule.

7. The method of claim 1, further comprising:

receiving a plurality of messages;

parsing the plurality of messages;

identifying features from the plurality of messages;

selecting a plurality of common classification category semantics;

matching at least some of the identified features with the respective plurality of common classification category semantics;

identifying messages corresponding to the at least some of the identified features; and

generating a classification category to message map.

8. The method of claim 6, further comprising:

selecting a plurality common classification category semantics;

identifying at least some of the plurality of messages having features matching the plurality of common classification category semantics;

dividing the identifying at least some of the plurality of messages into respective clusters of messages each having a unique common classification category semantic;

reviewing features from messages in the respective clusters; and

revising the classification rule.

10. The computer program product of claim 8, wherein the computer readable program code configured to identify a classification category further comprising:

computer readable program code configured to obtain an identity for a classification category that maps to the message.

9. A computer program product classifying a message, the computer program product comprising:

a computer readable medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to receive a message;

computer readable program code configured to parse the message;

computer readable program code configured to determine if a classification category maps to the message;

computer readable program code configured to identify a plurality of features from the parsed message;

computer readable program code configured to match at least one classification rule to at least one of the plurality of features;

computer readable program code configured to rate the match between the at least one of the plurality of features and the at least one classification rule;

computer readable program code configured to identify a classification category; and

computer readable program code configured to label the message with the identified classification category.

11. The computer program product of claim 9, wherein the computer readable program code configured to identify a classification category further comprising:

computer readable program code to obtain an identity for a classification category from the at least one classification rule that matches the at least one of the plurality of features.

12. The computer program product of claim 9, further comprising:

computer readable program code configured to match a second classification rule to at least one other of the plurality of features;

computer readable program code configured to rate the match between the at least one other of the plurality of features and the second classification rule; and

computer readable program code configured to assess ratings of all matches between features and classification rules.

13. The computer program product of claim 12, wherein the computer readable program code configured to identify a classification category further comprising:

computer readable program code configured to derive an identity for a classification category from the assessment of ratings of all matches between features and classification rules.

14. The computer program product of claim 9, further comprising:

computer readable program code configured to receive a plurality of messages;

computer readable program code configured to parse the plurality of messages;

computer readable program code configured to identify features from the plurality of messages;

computer readable program code configured to select a common classification category semantic;

computer readable program code configured to match at least some of the identified features with the common classification category semantic; and

computer readable program code configured to generate a classification rule.

15. The computer program product of claim 9, further comprising:

computer readable program code configured to receive a plurality of messages;

computer readable program code configured to parse the plurality of messages;

computer readable program code configured to identify features from the plurality of messages;

computer readable program code configured to select a plurality of common classification category semantics;

computer readable program code configured to match at least some of the identified features with the respective plurality of common classification category semantics;

computer readable program code configured to identify messages corresponding to the at least some of the identified features; and

computer readable program code configured to generate a classification category to message map.

16. A system of classifying a message, the system comprising:

a module configured to receive a message;

a module configured to parse the message;

a module configured to determine if a classification category maps to the message;

a module configured to identify a plurality of features from the parsed message;

a module configured to match at least one classification rule to at least one of the plurality of features;

a module configured to rate the match between the at least one of the plurality of features and the at least one classification rule;

a module configured to identify a classification category; and

label the message with the identified classification category.

17. The system of claim 16, wherein the module configured to identify a classification category further comprising:

a module configured to obtain an identity for a classification category that maps to the message.

18. The system of claim 16, wherein the module configured to identify a classification category further comprising:

a module configured to derive an identity for a classification category from the at least one classification rule that matches the at least one of the plurality of features.

19. The system of claim 16, further comprising:

a module configured to match a second classification rule to at least one other of the plurality of features;

a module configures to rate the match between the at least one other of the plurality of features and the second classification rule; and

a module configured to assess ratings of all matches between features and classification rules.

20. The system of claim 19, wherein identifying a classification category further comprising:

a module configured to obtain an identity for a classification category from the assessment of ratings of all matches between features and classification rules.