Diagnosing incidents for information technology service management

Abstract

Diagnosing and detecting causes of an incident may comprise classifying the incident by keywords, searching for co-occurring and reoccurring group of incidents, summarizing commonalities in the group of incidents, correlating the group of incidents with causes, defining association rules between the commonalities, and predicting potential problems based on the correlated group of incidents with causes.

We claim: 
     
         1 . A computer-implemented method of diagnosing and detecting causes of an incident interactively, the method performed by one or more processors, the method comprising:
 classifying the incident by keywords by searching a problem ticket generated in an information technology (IT) system, the problem ticket describing the incident for the keywords;   adding dependency keywords to the keywords, the dependency keywords representing dependent components among IT components involved in the problem ticket, wherein the dependency keywords are respectively given a boosting weight based on an impact of the respective keyword;   assigning accuracy weight to the respective keyword based on a validity of the respective keyword and the boosting weight;   searching for co-occurring and reoccurring group of incidents based on the keywords with respective accuracy weights and boosting weights;   summarizing commonalities in the group of incidents;   correlating the group of incidents with causes;   defining association rules between the commonalities; and   predicting potential problems based on the correlated group of incidents with causes.   
     
     
         2 . The method of  claim 1 , wherein the searching for co-occurring and reoccurring group of incidents further comprises searching for similarity among the incidents in the group. 
     
     
         3 . The method of  claim 1 , wherein the searching for co-occurring and reoccurring group of incidents further comprises searching for dependency among the incidents in the group. 
     
     
         4 . The method of  claim 1 , wherein the searching for co-occurring and reoccurring group of incidents further comprises searching for shared environment among the incidents in the group. 
     
     
         5 . The method of  claim 1 , wherein the causes comprise changes to an information technology system, traffic of the information technology system, maintenance of the information technology system. 
     
     
         6 . The method of  claim 1 , wherein the classifying comprises:
 extracting keywords from consolidated incident data;   validating the keywords using provided and automatically learned domain knowledge built from historical incident data, wherein the automatically learned domain knowledge comprises at least said defined association rules; and   assigning accuracy weight for each of the keywords based on confidence level associated with each of the association rules.   
     
     
         7 . The method of  claim 1 , wherein the searching comprises:
 finding incidents matching the keywords and other keywords with one or more dependency relationships specified in the association rules; and   calculating relevancy score of each of the found incidents based on accuracy of matched keywords, dependency, and context relevancy.   
     
     
         8 . The method of  claim 1 , wherein the correlating comprises:
 finding common events comprising one or more of changes, traffic anomaly patterns, and other events preceding the group of incidents;   statistically determining a correlation relationship between the common events and the incidents.   
     
     
         9 . The method of  claim 1 , further comprising:
 generating diagnosis comprising creating a report showing the co-occurring and reoccurring incidents, the causes, the defined association rules between the commonalities of the incident group and the causes.   
     
     
         10 . The method of  claim 9 , further comprising:
 collecting user feedback on the report and iteratively improving the diagnosis.   
     
     
         11 . A computer readable storage medium storing a program of instructions executable by a machine to perform a method of diagnosing and detecting causes of an incident interactively, comprising:
 classifying the incident by keywords by searching a problem ticket generated in an information technology (IT) system, the problem ticket describing the incident for the keywords;   adding dependency keywords to the keywords, the dependency keywords representing dependent components among IT components involved in the problem ticket, wherein the dependency keywords are respectively given a boosting weight based on an impact of the respective keyword;   assigning accuracy weight to the respective keyword based on a validity of the respective keyword and the boosting weight;   searching for co-occurring and reoccurring group of incidents based on the keywords with respective accuracy weights and boosting weights;   summarizing commonalities in the group of incidents;   correlating the group of incidents with causes;   defining association rules between the commonalities; and   predicting potential problems based on the correlated group of incidents with causes.   
     
     
         12 . The computer readable storage medium of  claim 11 , wherein the searching for co-occurring and reoccurring group of incidents further comprises searching for shared environment among the incidents in the group. 
     
     
         13 . The computer readable storage medium of  claim 11 , wherein the searching comprises:
 finding incidents matching the keywords and other keywords with one or more dependency relationships specified in the association rules; and   calculating relevancy score of each of the found incidents based on accuracy of matched keywords, dependency, and context relevancy.   
     
     
         14 . The computer readable storage medium of  claim 11 , wherein the correlating comprises:
 finding common events comprising one or more of changes, traffic anomaly patterns, and other events preceding the group of incidents;   statistically determining correlation relationship between the common events and the incidents.   
     
     
         15 . The computer readable storage medium of  claim 11 , further comprising:
 generating diagnosis comprising creating a report showing the co-occurring and reoccurring incidents, the causes, the defined association rules between the commonalities of the incident group and the causes; and   collecting user feedback on the report and iteratively improving the diagnosis.   
     
     
         16 . A system for diagnosing and detecting causes of an incident interactively, comprising:
 a processor;   a user interface operable to execute on the processor and issue a query;   a search engine operable to execute on the processor, and further operable to receive the query, transform the query into sub-queries comprising a structured search and a free-text search, to search for co-occurring and reoccurring group of incidents, the search engine further operable to correlate the group of incidents with causes based on common events found in the group of incidents, and present the co-occurring and reoccurring group of incidents and the causes to the user interface,   wherein the query is built based on searching a problem ticket describing one of the incidents for the keywords, the problem ticket generated in an information technology (IT) system,   the keywords assigned accuracy weights respectively based on a validity of the respective keyword and boosting weights respectively based on impact of the respective keyword, wherein dependency keywords are added to the keywords, the dependency keywords representing dependent components among IT components involved in the problem ticket, wherein the dependency keywords are respectively given boosting weights.   
     
     
         17 . The system of  claim 16 , further comprising:
 a text mining module operable to receive incident data and information associated with maintenance schedule, traffic data, and change plan of an information technology system, classify the incident data by keywords, and store the classified data as consolidated incident data.   
     
     
         18 . The system of  claim 17 , further comprising:
 a learning module operable to summarize commonalities in the group of incidents and define association rules between the commonalities.   
     
     
         19 . The system of  claim 18 , wherein the learning module is further operable to predict potential problems based on the correlated group of incidents with causes.