Determining a cause of an incident based on text analytics of documents

• US 9,244,964 B2
• Filed: 05/02/2013
• Issued: 01/26/2016
• Est. Priority Date: 05/21/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bhatt, Dhruv A., McNeil, Kristin E., Patel, Nitaben A.
• Primary Examiner(s): Fleurantin, Jean B
• Application Number:
  US13/875,479
• Publication Number:
  US 20130311481A1
• Time in Patent Office: 999 Days
• Field of Search: 707741-746, 707/748, 707/758
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/31 Indexing; Data structures therefor; Storage structures

Abstract

A system for determining a cause of an incident analyzes one or more change records based on text analytics using a dictionary and rules for the analysis in order to generate an index of analyzed data that represents the one or more change records. The change records each include a change and corresponding time frame for occurrence of the change. Information from a request is applied to the index of analyzed data to determine one or more candidate causes for the incident and the corresponding time frame for occurrence of the change. A time associated with the request is correlated with the corresponding time frame for occurrence of the change to identify the one or more candidate causes in the one or more change records as causes for the incident. Embodiments of the present invention further include a method and computer program product for determining causes of an incident.

Claims

1. A computer-implemented method of determining a root cause of an incident, said method comprising:

analyzing, via a processor, one or more change records based on text analytics using a dictionary and rules for the analysis in order to generate an index of analyzed data that represents the one or more change records in an abbreviated representation for searching, wherein the indent pertains to a defect with a manufactured product provided by an entity, and wherein the change records each include a change implemented to operations that produce the manufactured product provided by the entity and a corresponding time frame for occurrence of the change;

searching, via a processor, the index of analyzed data by applying information from a request for the root cause of the incident to the index of analyzed data to determine one or more change records from the abbreviated representation listing changes serving as one or more candidate causes for the incident, wherein applying the information includes;

correlating the request with the changes listed by the one or more change records based on a time associated with the request being within a specified time interval of the corresponding time frame of occurrence of the changes listed by the one or more change records, and

identifying the one or more candidate causes in the one or more change records as causes for the incident based on the correlation.

2. The method of claim 1, wherein the text analytics include dictionaries based on one of an Unstructured Information Management Architecture (UIMA), an off-the-shelf text analytics suite, and a custom text analytics suite.

3. The method of claim 1, wherein the text analytics include rules based on one of an Unstructured Information Management Architecture (UIMA), an off-the-shelf text analytics suite, and a custom text analytics suite.

4. The method of claim 1, wherein correlating includes computing a correlation score for each change serving as a candidate cause for the incident that indicates a relative likelihood of the occurrence of that change as a cause of the incident.

5. The method of claim 4, further comprising identifying the one or more candidate causes with a highest correlation score as a cause for the incident.

6. The method of claim 1, wherein the time associated with the request includes at least one of a time of the incident, a current time, and a date entered by a requester.

7. The method of claim 1, wherein the index of analyzed data includes one or more of annotations referencing the one or more change records, extensible markup language (XML) representations of the one or more change records, and metadata configured to provide additional change record information.

8. A system for determining a root cause of an incident, said system comprising:

a computer system including at least one processor configured to;

analyze one or more change records based on text analytics using a dictionary and rules for the analysis in order to generate an index of analyzed data that represents the one or more change records in an abbreviated representation for searching, wherein the incident pertains to a defect with a manufactured product provided by an entity, and wherein the change records each include a change implemented to operations that produce the manufactured product provided by the entity and a corresponding time frame for occurrence of the change;

search the index of analyzed data by applying information from a request for the root cause of the incident to the index of analyzed data to determine one or more change records from the abbreviated representation listing changes serving as one or more candidate causes for the incident, wherein applying the information includes;

correlating the request with the changes listed by the one or more change records based on a time associated with the request being within a specified time interval of the corresponding time frame of occurrence of the changes listed by the one or more change records; and

identifying the one or more candidate causes in the one or more change records as causes for the incident based on the correlation.

9. The system of claim 8, wherein the text analytics include dictionaries based on one of an Unstructured Information Management Architecture (UIMA), an off-the-shelf text analytics suite, and a custom text analytics suite.

10. The system of claim 8, wherein the text analytics include rules based on one of an Unstructured Information Management Architecture (UIMA);

an off-the-shelf text analytics suite, and a custom text analytics suite.

11. The system of claim 8, wherein correlating includes computing a correlation score for each change serving as a candidate cause for the incident that indicates a relative likelihood of the occurrence of that change as a cause of the incident.

12. The system of claim 11, further comprising identifying the one or more candidate causes with a highest correlation score as a cause for the incident.

13. The system of claim 8, wherein the time associated with the request includes at least one of a time of the incident, a current time, and a date entered by a requester.

14. The system of claim 8, wherein the index of analyzed data includes one or more of annotations referencing the one or more change records, extensible markup language (XML) representations of the one or more change records, and metadata configured to provide additional change record information.

15. A computer program product for determining a root cause of an incident, said computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising computer readable program code configured to cause a processor to;

analyze one or more change records based on text analytics using a dictionary and rules for the analysis in order to generate an index of analyzed data that represents the one or more change records in an abbreviated representation for searching, wherein the incident pertains to a defect with a manufactured product provided by an entity, and wherein the change records each include a change implemented to operations that produce the manufactured product provided by the entity and a corresponding time frame for occurrence of the change;

search the index of analyzed data by applying information from a request for the root cause of the incident to the index of analyzed data to determine one or more change records from the abbreviated representation listing changes serving as one or more candidate causes for the incident, wherein applying the information includes;

correlating the request with the changes listed by the one or more change records based on a time associated with the request being within a specified time interval of the corresponding time frame of occurrence of the changes listed by the one or more change records; and

identifying the one or more candidate causes in the one or more change records as causes for the incident based on the correlation.

16. The computer program product of claim 15, wherein the text analytics include dictionaries based on one of an Unstructured Information Management Architecture (UIMA), an off-the-shelf text analytics suite, and a custom text analytics suite.

17. The computer program product of claim 15, wherein the text analytics include rules based on one of an Unstructured Information Management Architecture (UIMA), an off-the-shelf text analytics suite, and a custom text analytics suite.

18. The computer program product of claim 15, wherein correlating includes computing a correlation score for each change serving as a candidate cause for the incident that indicates a relative likelihood of the occurrence of that change as a cause of the incident.

19. The computer program product of claim 18, further comprising identifying the one or more candidate causes with a highest correlation score as a cause for the incident.

20. The computer program product of claim 15, wherein the time associated with the request includes at least one of a time of the incident, a current time, and a date entered by a requester.

21. The computer program product of claim 15, wherein the index of analyzed data includes one or more of annotations referencing the one or more change records, extensible markup language (XML) representations of the one or more change records, and metadata configured to provide additional change record information.