INCIDENT PREDICTION AND PREVENTION

• US 20190034760A1
• Filed: 09/07/2017
• Published: 01/31/2019
• Est. Priority Date: 07/27/2017
• Status: Active Grant

• Current Assignee: Accenture Global Solutions Limited (Accenture PLC)
• Original Assignee: Accenture Global Solutions Limited (Accenture PLC)
• Inventors: NARAYANASWAMY CHANDRASEKARAN, Shrikanth, Subramanian, Venkatesh, Maitra, Anutosh, Dwarakanath, Anurag, Duraisamy, Pradeepkumar, Bhola, Aditya
• Granted Patent: US 10,643,102 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 18/23213 with fixed number of clusters, e.g. K-means clustering
• CPC Class Codes: H04L 41/5074 Handling of user complaints or trouble tickets

Abstract

In some examples, incident prediction and prevention may include ascertaining a plurality of past incidents, clustering the plurality of past incidents to generate a plurality of incidents clusters, and identifying, for each past incident of the plurality of past incidents that is in a respective incidents cluster of the plurality of incidents clusters, a time of occurrence. Incident prediction and prevention may include ascertaining a new incident, assigning the new incident to an incidents cluster of the plurality of incidents clusters, and determining, for the assigned incidents cluster, at least one further predicted incident associated with at least one further corresponding incidents cluster. Further, incident prediction and prevention may include determining a resolution to the at least one further predicted incident, and preventing occurrence of the at least one further predicted incident by executing the determined resolution to the at least one further predicted incident.

Claims

1. An incident prediction and prevention apparatus comprising:

an incident analyzer, executed by at least one hardware processor, to

ascertain a plurality of past incidents,

cluster the plurality of past incidents to generate a plurality of incidents clusters, and

identify, for each past incident of the plurality of past incidents that is in a respective incidents cluster of the plurality of incidents clusters, a time of occurrence;

an incident predictor, executed by the at least one hardware processor, to

ascertain a new incident,

assign the new incident to an incidents cluster of the plurality of incidents clusters, and

determine, for the assigned incidents cluster, at least one further predicted incident associated with at least one further corresponding incidents cluster; and

an incident preventer, executed by the at least one hardware processor, to

determine a resolution to the at least one further predicted incident, and

prevent occurrence of the at least one further predicted incident by executing the determined resolution to the at least one further predicted incident.

2. The incident prediction and prevention apparatus according to claim 1, wherein the incident analyzer is executed by the at least one hardware processor to cluster the plurality of past incidents to generate the plurality of incidents clusters by

performing unsupervised clustering of the past incidents to generate the plurality of incidents clusters.

3. The incident prediction and prevention apparatus according to claim 1, wherein the incident analyzer is executed by the at least one hardware processor to

generate, based on the identification of the time of occurrence of each past incident of the plurality of past incidents that is in the respective incidents cluster of the plurality of incidents clusters, a time-based cluster relationship between each incidents cluster of the plurality of incidents clusters.

4. The incident prediction and prevention apparatus according to claim 3, wherein the incident analyzer is executed by the at least one hardware processor to

determine, based on a number of time-based connections between each incidents cluster of the plurality of incidents clusters, a strength of the time-based cluster relationship between each incidents cluster of the plurality of incidents clusters.

5. The incident prediction and prevention apparatus according to claim 4, wherein the incident predictor is executed by the at least one hardware processor to determine, for the assigned incidents cluster, at least one further predicted incident associated with at least one further corresponding incidents cluster by

analyzing the strength of the time-based cluster relationship between the assigned incidents cluster and each downstream incidents cluster relative to the assigned incidents cluster, and

identifying, based on the analysis of the strength of the time-based cluster relationship between the assigned incidents cluster and each downstream incidents cluster relative to the assigned incidents cluster, a strongest time-based cluster relationship between the assigned incidents cluster and a downstream incidents cluster.

6. The incident prediction and prevention apparatus according to claim 1, wherein the incident predictor is executed by the at least one hardware processor to assign the new incident to the incidents cluster of the plurality of incidents clusters by

determining, with respect to the new incident, a score for each incidents cluster of the plurality of incidents clusters, and

assigning the new incident to the incidents cluster of the plurality of incidents clusters that includes a highest determined score.

7. The incident prediction and prevention apparatus according to claim 1, wherein the incident predictor is executed by the at least one hardware processor to

determine, based on analysis of the time of occurrence of selected past incidents from the assigned incidents cluster and the at least one further corresponding incidents cluster, an estimated time of occurrence of the at least one further predicted incident.

8. The incident prediction and prevention apparatus according to claim 7, wherein the incident preventer is executed by the at least one hardware processor to

execute the determined resolution to the at least one further predicted incident prior to expiration of the estimated time of occurrence of the at least one further predicted incident.

9. The incident prediction and prevention apparatus according to claim 1, wherein the incident predictor is executed by the at least one hardware processor to

determine, by averaging a difference between an earliest time of occurrence and a difference between a latest time of occurrence of selected past incidents from the assigned incidents cluster and the at least one further corresponding incidents cluster, an estimated time of occurrence of the at least one further predicted incident.

10. The incident prediction and prevention apparatus according to claim 1, wherein the incident predictor is executed by the at least one hardware processor to

determine, by dividing

a difference between an earliest time of occurrence and a difference between a latest time of occurrence of selected past incidents from the assigned incidents cluster and the at least one further corresponding incidents cluster by

a size of a strongest outgoing edge between the assigned incidents cluster and the at least one further corresponding incidents cluster,

an estimated time of occurrence of the at least one further predicted incident.

11. A method for incident prediction and prevention comprising:

ascertaining, by an incident analyzer that is executed by at least one hardware processor, a plurality of past incidents;

clustering, by the incident analyzer that is executed by at least one hardware processor, the plurality of past incidents to generate a plurality of incidents clusters;

identifying, by the incident analyzer that is executed by at least one hardware processor, for each past incident of the plurality of past incidents that is in a respective incidents cluster of the plurality of incidents clusters, a time of occurrence;

generating, by the incident analyzer that is executed by at least one hardware processor, based on the identification of the time of occurrence of each past incident of the plurality of past incidents that is in the respective incidents cluster of the plurality of incidents clusters, a time-based cluster relationship between each incidents cluster of the plurality of incidents clusters;

ascertaining, by an incident predictor that is executed by the at least one hardware processor, a new incident;

assigning, by the incident predictor that is executed by the at least one hardware processor, the new incident to an incidents cluster of the plurality of incidents clusters;

determining, by the incident predictor that is executed by the at least one hardware processor, for the assigned incidents cluster, at least one further predicted incident associated with at least one further corresponding incidents cluster;

determining, by an incident preventer that is executed by the at least one hardware processor, a resolution to the at least one further predicted incident; and

preventing, by the incident preventer that is executed by the at least one hardware processor, occurrence of the at least one further predicted incident by executing the determined resolution to the at least one further predicted incident.

12. The method according to claim 11, further comprising:

determining, by the incident analyzer that is executed by the at least one hardware processor, based on a number of time-based connections between each incidents cluster of the plurality of incidents clusters, a strength of the time-based cluster relationship between each incidents cluster of the plurality of incidents clusters.

13. The method according to claim 12, further comprising:

analyzing, by the incident predictor that is executed by the at least one hardware processor, the strength of the time-based cluster relationship between the assigned incidents cluster and each downstream incidents cluster relative to the assigned incidents cluster; and

identifying, by the incident predictor that is executed by the at least one hardware processor, based on the analysis of the strength of the time-based cluster relationship between the assigned incidents cluster and each downstream incidents cluster relative to the assigned incidents cluster, a strongest time-based cluster relationship between the assigned incidents cluster and a downstream incidents cluster.

14. The method according to claim 11, further comprising:

determining, by the incident predictor that is executed by the at least one hardware processor, with respect to the new incident, a score for each incidents cluster of the plurality of incidents clusters; and

assigning, by the incident predictor that is executed by the at least one hardware processor, the new incident to the incidents cluster of the plurality of incidents clusters that includes a highest determined score.

15. The method according to claim 11, further comprising:

determining, by the incident predictor that is executed by the at least one hardware processor, based on analysis of the time of occurrence of selected past incidents from the assigned incidents cluster and the at least one further corresponding incidents cluster, an estimated time of occurrence of the at least one further predicted incident.

16. A non-transitory computer readable medium having stored thereon machine readable instructions, the machine readable instructions, when executed by at least one hardware processor, cause the at least one hardware processor to:

ascertain a plurality of past incidents;

cluster the plurality of past incidents to generate a plurality of incidents clusters;

identify, for each past incident of the plurality of past incidents that is in a respective incidents cluster of the plurality of incidents clusters, a time of occurrence;

ascertain a new incident;

determine, with respect to the new incident, a score for each incidents cluster of the plurality of incidents clusters;

assign the new incident to an incidents cluster of the plurality of incidents clusters that includes a highest determined score;

determine, for the assigned incidents cluster, at least one further predicted incident associated with at least one further corresponding incidents cluster;

determine a resolution to the at least one further predicted incident; and

prevent occurrence of the at least one further predicted incident by executing the determined resolution to the at least one further predicted incident.

17. The non-transitory computer readable medium according to claim 16, wherein the instructions are further to cause the at least one hardware processor to:

determine, by averaging a difference between an earliest time of occurrence and a difference between a latest time of occurrence of selected past incidents from the assigned incidents cluster and the at least one further corresponding incidents cluster, an estimated time of occurrence of the at least one further predicted incident.

18. The non-transitory computer readable medium according to claim 16, wherein the instructions are further to cause the at least one hardware processor to:

determine, by dividing

a difference between an earliest time of occurrence and a difference between a latest time of occurrence of selected past incidents from the assigned incidents cluster and the at least one further corresponding incidents cluster by

a size of a strongest outgoing edge between the assigned incidents cluster and the at least one further corresponding incidents cluster,

an estimated time of occurrence of the at least one further predicted incident.

19. The non-transitory computer readable medium according to claim 16, wherein the instructions are further to cause the at least one hardware processor to:

determine, based on analysis of the time of occurrence of selected past incidents from the assigned incidents cluster and the at least one further corresponding incidents cluster, an estimated time of occurrence of the at least one further predicted incident.

20. The non-transitory computer readable medium according to claim 19, wherein the instructions are further to cause the at least one hardware processor to:

execute the determined resolution to the at least one further predicted incident prior to expiration of the estimated time of occurrence of the at least one further predicted incident.