Problem inference from support tickets

• US 9,229,800 B2
• Filed: 06/28/2012
• Issued: 01/05/2016
• Est. Priority Date: 06/28/2012
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Jain, Navendu, Potharaju, Rahul
• Primary Examiner(s): MASKULINSKI, MICHAEL C
• Application Number:
  US13/535,366
• Publication Number:
  US 20140006861A1
• Time in Patent Office: 1,286 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 40/289 Phrasal analysis, e.g. finite state techniques or chunking
• CPC Class Codes: G06F 40/30 Semantic analysis
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/022 Knowledge engineering; Knowledge acquisition
• CPC Class Codes: G06Q 30/01 Customer relationship services
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/5074 Handling of user complaints or trouble tickets
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data

Abstract

The described implementations relate to processing of electronic data. One implementation is manifested as a system that can include an inference engine and at least one processing device configured to execute the inference engine. The inference engine can be configured to perform automated detection of concepts expressed in failure logs that include unstructured data. For example, the inference engine can analyze text of support tickets or diary entries relating to troubleshooting of an electronic network to obtain concepts identifying problems, actions, or activities. The inference engine can also be configured to generate output that reflects the identified concepts, e.g., via a visualization or queryable programming interface.

Claims

1. A method performed by a computing device, the method comprising:

obtaining a plurality of documents, the plurality of documents having corresponding text;

performing phrase extraction on the text to obtain a plurality of phrases that appear in the text;

filtering out some phrases from the plurality of phrases based on one or more criteria to obtain a subset of the plurality of phrases;

obtaining an ontology model that maps individual phrases from the subset of the plurality of phrases to classes or subclasses of the ontology model;

obtaining a grammar pattern representing a concept, wherein the grammar pattern is defined by a first class or subclass of the ontology model preceding a second class or subclass of the ontology model;

determining whether other documents match the grammar pattern, wherein the other documents match the grammar pattern when the other documents include first phrases of the first class or subclass preceding second phrases of the second class or subclass; and

inferring that individual other documents that match the grammar pattern express the concept represented by the grammar pattern.

2. The method according to claim 1, wherein the plurality of documents comprise support tickets and associated diary entries reflecting troubleshooting of problems on an electronic network.

3. The method according to claim 2, wherein the concept represented by the grammar pattern indicates that a particular action was taken on a particular entity associated with the electronic network.

4. The method according to claim 1, wherein the performing phrase extraction comprises employing a compression algorithm to build a dictionary of phrases.

5. The method according to claim 4, wherein the performing phrase extraction comprises performing a frequency estimation of a number of times the plurality of phrases appear in the plurality of documents.

6. The method according to claim 1, wherein the filtering comprises part-of-speech filtering, length and frequency filtering, and information theoretic filtering using mutual information measures for the individual phrases.

7. The method according to claim 1, wherein the classes of the ontology model include an action class, a negation class, a sentiment class, a quantity class, an entity class, an incident class, and a condition class.

8. The method according to claim 1, further comprising:

obtaining another grammar pattern representing another concept, wherein the another grammar pattern is defined by the first class or subclass of the ontology model preceded by a third class or subclass of the ontology model;

determining whether the other documents match the another grammar pattern, wherein the other documents match the another grammar pattern when the other documents include first phrases of the first class or subclass preceding third phrases of the third class or subclass; and

inferring that further other documents that match the another grammar pattern express the another concept represented by the another grammar pattern.

9. The method according to claim 1, further comprising generating output indicating that the individual other documents express the concept represented by the grammar pattern.

10. The method according to claim 9, wherein the concept is an action concept and the output is a visualization that identifies actions taken for devices of a particular device type.

11. One or more computer-readable storage devices or memory devices comprising device-readable instructions which, when executed by one or more processing devices, cause the one or more processing devices to perform acts comprising:

identifying phrases in support tickets, wherein the support tickets include text describing troubleshooting steps taken by one or more network engineers to resolve one or more network problems;

mapping the phrases in the support tickets to specific phrase classes, the specific phrase classes including an entity phrase class for phrases identifying network devices and an action phrase class for phrases identifying actions taken on the network devices;

identifying sequences of the entity phrase class and the action phrase class in the text of the support tickets;

inferring that the actions were taken on the network devices based on the identified sequences of the entity phrase class and the action phrase class in the text of the support tickets; and

providing a user interface with representations of the actions that were taken on the network devices.

12. The one or more computer-readable storage devices or memory devices according to claim 11, wherein the user interface is a graphical user interface that includes a first representation of a first action taken with respect to certain network devices and a second representation of a second action taken with respect to the certain network devices.

13. The one or more computer-readable storage devices or memory devices according to claim 11, wherein the inferring comprises comparing sequences of various phrase classes in the text of the support tickets to an action grammar pattern that includes the entity phrase class and the action phrase class.

14. The one or more computer-readable storage devices or memory devices according to claim 11, wherein:

the specific phrase classes include a condition phrase class for phrases describing problem conditions of the network devices,

the identifying the sequences comprises identifying other sequences of the condition phrase class and the entity phrase class in the text of the support tickets, and

the inferring comprises inferring that the text of the support tickets indicates that the network devices experienced the problem conditions.

15. The one or more computer-readable storage devices or memory devices according to claim 11, the acts further comprising:

receiving, via the user interface, an input specifying a particular device model of the network devices and inferring that the actions were taken for the network devices of the particular device model.

16. A system comprising:

one or more computer-readable storage devices or memory devices comprising device-readable instructions configured to;

access failure logs comprising text;

map phrases in the text of the failure logs to phrase classes; and

perform automated detection of concepts expressed in the failure logs by identifying sequences of the phrase classes in the text of the failure logs, the sequences of the phrase classes indicating actions or activities performed on network entities; and

at least one processing device configured to execute the device-readable instructions.

17. The system according to claim 16, wherein the automated detection comprises comparing the sequences of the phrase classes to an action phrase class pattern representing the actions and an activity phrase class pattern representing the activities.

18. The system according to claim 16, wherein the detected concepts include a maintenance activity performed on an individual network device.

19. The system according to claim 16, wherein the detected concepts include a replacement activity performed on a defective network device.

20. The system according to claim 16, wherein at least some of the text in the failure logs was generated by a human.