US Patent No. 10,169,719

USER CONFIGURABLE MESSAGE ANOMALY SCORING TO IDENTIFY UNUSUAL ACTIVITY IN INFORMATION TECHNOLOGY SYSTEMS


Patent No. 10,169,719
Issue Date January 01, 2019
Title User Configurable Message Anomaly Scoring To Identify Unusual Activity In Information Technology Systems
Inventorship James M. Caffrey, Woodstock, NY (US)
Assignee INTERNATIONAL BUSINESS MACHINES CORPORATION, Armonk, NY (US)

Claim of US Patent No. 10,169,719

1. A method for identifying unusual activity in an information technology (IT) system based on user configurable message anomaly scoring, the method comprising:receiving, by a processing device, a message stream for the IT system;
selecting a plurality of status messages from the message stream that correspond to an interval of time;
determining a default message anomaly score for each status message of the plurality of the status messages of the interval, wherein the default message anomaly scores are generated by IT equipment of the IT system and are included in the plurality of status messages received from the IT equipment;
calculating, by the processing device, an interval anomaly score for the interval by at least performing the following for each status message of the plurality of status messages of the interval:
determining whether the default message anomaly score of the status message corresponds to a message anomaly group comprising a custom scoring group having a custom message anomaly score, wherein the custom message anomaly score of the message anomaly group is received by the processing device as an input from a system expert during training of a model of a historical message stream;
upon determining that the default message anomaly score of the status message corresponds to the message anomaly group having the custom message anomaly score, adding the custom message anomaly score to an interval anomaly score for the interval; and
upon determining that the default message anomaly score of the status message does not correspond to the message anomaly group having the custom message anomaly score, adding the default message anomaly score of the status message to the interval anomaly score for the interval;
identifying a priority level of the interval by comparing the interval anomaly score to one or more priority level cutoffs, wherein the one or more priority level cutoffs are established based on the trained model; and
generating an alert for the selected plurality of status messages of the interval only when the identified priority level of the interval meets the one or more priority level cutoffs based on the comparison, wherein the alert flags the interval such that only the selected plurality of status message of the message stream are transmitted to the system expert.