SYSTEM AND METHODS FOR ADAPTIVE NOTIFICATION AND TICKETING

[0001] This Patent Application is related to and claims priority under 35 U.S.C. §119(e) to U.S. Provisional Patent Application No. 62/245,140 entitled “ADAPTIVE NOTIFICATION AND TICKETING SYSTEM”, filed Oct. 22, 2015, the entire contents of which is herein incorporated by reference in its entirety.

[0002] Aspects of the present disclosure relate to an adaptive notification and ticketing system for a network; and more particularly, to a system that generates models including rules, functions or algorithms derived from analysis of data associated with network events (such as alerts, feedback, traffic, and tickets) to correlate network events, determine service impacting events from the network events, and adjust notifications regarding the network events.

[0003] A service provider in the telecommunications industry faces unique challenges with respect to deploying, monitoring, and maintaining technical infrastructure needed to provide telecommunications services to customers. For example, hundreds of devices may be deployed and interconnected throughout a large geographic region in order to provide voice or data services, and any number of possible alerts, often referred to as “events,” may occur that affect or relate to those devices. The service provider must identify and respond to certain events in a timely manner. There are systems where the occurrence of an event causes the generation of a ticket, and then actions are taken to correct whatever problem exists and close the ticket.

[0004] Conventional ticketing and service systems, however, have various drawbacks. For example, conventional systems may generate multiple tickets when one event causes other events and tickets are generated for each event. With conventional systems, a great amount of human effort is required to process information, false alarms may be generated, and effective reporting may be lacking. Customers may even discover problems before the problem is recognized in the system.

[0005] It is with these observations in mind, among others, that various aspects of the present disclosure were conceived and developed.

[0006] A need exists for a system that can predict or identify service impact events from other events in a telecommunications network and also provide adaptive notification regarding such service impact events. Accordingly, one implementation of the present disclosure may take the form of a method for adaptive notification and ticketing, comprising: utilizing a computing device comprising a memory for storing instructions that are executed by a processor to perform operations of: accessing data associated with a plurality of past events from a plurality of network elements of a telecommunications network; generating a model from the data, the model configured to receive a plurality of new events and generate an output indicative of a service impact event; applying the plurality of new events to the model to generate the output indicative of the service impact event; and from the output indicative of the service impact event, generating a responsive action.

[0007] Another implementation of the present disclosure may take the form of an adaptive notification and ticketing apparatus, comprising: a network element of a telecommunications network that generates past network event data, the past network event data associated with a past network event; and a computing device with access to the past network event data, the computing device generating a rule from the past network event data and applying a new network event to the rule to identify a service impact event.

[0008] Another implementation of the present disclosure may take the form of a method for adaptive notification and ticketing, comprising: utilizing machine learning to train a computing device, by: providing a training data set to the computing device, the training set comprising a series of network events, at least a portion of the training data set comprising certain network events associated with known classes defining one or more service impacting events; generating a classification function based on results of the providing of the training data set to the computing device to predict future service impacting events; and applying the classification function to a new network event to identify a class associated with the new network event. The class indicates whether the new network event is associated with a service impact event.

[0021] Aspects of the present disclosure involve a computing system and methods, implemented by the computing system, for adaptive notification and ticketing (ANT) in a telecommunications network. The ANT method involves accessing a wide variety of event data or data associated with events (including alerts, utilization traffic, tickets, and the like). The ANT system then generates models, including rules and functions, from the event data. In one example, the ANT system includes a machine learning, complex event processing, or similar computational method or combinations thereof, to which the event data is fed to generate a model. Once the model is generated, new event data may be fed into the model and used to predict significant events or service impact events that would cause a service outage, among other features. For example, relatively minor “child” events may feed into the model, and predict a relatively more important parent event or service impacting event. The ANT system may further adjust notifications and ticketing for customer devices affected by the service impacting event. A customer device or service may be identified as being affected by the service impact event where the customer device accesses a device or service associated with the service impact event. For example, where the service impact event involves a router failure, a customer device affected by that service impact event may be a device that accesses that router to receive a telecommunications service. Notifications may be transmitted to customers to alert the customers regarding any customer network devices affected by the service impact event and notification preferences may be adjusted based on feedback regarding such notifications. Further, where the service impact event caused a plurality of tickets to be generated from child events associated with the service impact event, such tickets may be closed so that network technicians (and customers) can focus on the service impact event which reduces time addressing child events to instead focus on the service impact event.

[0022] The ANT system and method may utilize complex event processing by implementing a complex event processor to generate and apply the model as disclosed herein. Complex event processing may involve tracking and analyzing (processing) numerous data streams associated with network events that take place (or have already taken place) in the telecommunications network as described herein, and identifying patterns or relationships between such events to generate one or more rules. For example, a pattern may be identified that a particular sequence of events is typically indicative of a fiber cut, which is considered a service impact event because any customer accessing Internet, voice or other services over that fiber would have those services possibly unavailable until the fiber is replaced. When fiber is cut, such as from the fiber being run over in a data center, accidently dug up during construction, or any number of the other things, a cascade of network errors may flow from the event. In this example, the known sequence of events may be used to generate a rule that would recognize the same or a similar sequence of events, and identify a new fiber cut when that sequence is recognized using the rule.

[0023] The ANT system may further employ machine learning methods with a computing device to enhance, supplement, or compliment any rules derived from the complex event processing. Machine learning methods may include unsupervised machine learning such as clustering. With clustering machine learning methods, the ANT system may generate a model using a computing device that deduces attributes or structures present in network event data to group network events based on similarities between such attributes. Machine learning methods may further include supervised or semi-supervised methods such as classification. With classification machine learning methods, the ANT system may present the computing device with training data to generate a function. The training data comprises past network event data and patterns, or known correlations between past events (such as any patterns or rules derived from complex event processing identifying certain events as being indicative of service impact events). The function is a computer-generated representation of any rule or pattern provided by the training data and attributes of new network data may be fed to the function to output a class, which may define a service impact event, as described herein. So, for example, returning to the example of a fiber cut, machine learning may be used to learn other events, not present in the known sequence, that are also indicative of a fiber cut.

[0024] Generation of a model and implementation of the model to identify a service impact event may be described by the exemplary process flow 500 shown in FIG. 8 with reference to an ANT system 100 described in FIGS. 1A-1B and FIG. 2. As described in block 502 of FIG. 8, past network event data, or data associated with a plurality of past events in a telecommunications network, such as a network 102, may be accessed by a computing device 140. The computing device 140 of FIG. 1A may be a server, a desktop, or other suitable computing device. The computing device 140 includes at least one processor for executing an ANT application 112 which provides functionality for accessing the network event data in addition to other functions such as defining rules or implementing machine learning using the computing device 140, managing network events, providing information to certain devices, and displaying alerts to computing systems of the ANT system 100 as described herein. The network 102 may comprise a telecommunications network managed by a service provider and may include virtual private networks, local area networks, wide area networks, Wi-Fi networks, cellular networks, Internet Protocol (IP) networks, voice and voice over IP (VoIP) networks or any combination thereof. The network 102 may comprise a plurality of sub-networks, or customer networks, or the network 102 may otherwise have access to the same. The network 102 may further comprise a plurality of interconnected or linked network devices such as switches, routers, and associated computing resources that are used to provide or access telecommunications services. In the example of FIG. 1A, such devices may include a network element 120A, a network element 120B, a network element 120C (for providing telecommunication services), and computing systems 124 (for accessing and administering the telecommunications services).

[0025] The computing device 140 may access the past network event data from a past events database 152 (FIGS. 1A-1B) or event history database 242 (FIG. 2). Past network event data from the past events database 152, may include messages, system logs, alerts, tickets, or the like and associated with past network events such as errors, outages, failures, and other such events that have transpired within or otherwise involved the network 102. For example, a past network event may involve a device failure which may be associated with past network event data in the form of an error message or system log that the device (or a different network element) generated to memorialize the device failure. It should be understood that an event as described herein may also include activity associated with the network 102 that is not necessarily negative or reflective of a network issue. For example, an event may also include a survey response submitted by a customer who the customer uses to indicate how frequently the customer desires to receive notifications regarding changes or service impact events concerning the network 102.

[0026] In the example of FIG. 1A, the past network event data of the past events database 152 is generated by the network element 120A, network element 120B, the network element 120C, and the computer systems 124. The past events database 152 may be maintained within a storage device 125 or any computing device having sufficient memory and computing resources to store and retrieve such past event data for the computing device 140 as needed. As further shown, a system log server 121 may be implemented to aggregate network event data from one or more of the network elements associated with the network 102 (such as the network element 120A and network element 120b). In many cases, event data from some form of network element may be of different forms and include different information; the log server or other component of the ANT system may normalize event data into a common form or format useful for the system to process. The past events database 152 is not limited to a single database and may comprise a plurality of databases stored across one or more storage devices. The information within the database 152 may be considered “big data” and may comprise large data sets that may be analyzed computationally by the computing device 140 to reveal patterns, trends, and associations as described herein. In other words, the past network event data of the past events database 152 can be used to build and test rules, functions, or other models.

[0027] As explained in block 504 of FIG. 8, a model 154 which may include a function, rule, algorithm, or the like (or combinations thereof) may be generated using the past network event data of the past events database 152. The model may be generated using complex event processing, machine learning, human input, or combinations thereof as described herein. FIG. 1B illustrates exemplary model generation using the past network event data from the past event database 152. As shown, the ANT system 100 may generate the model 154 taking into account input from complex event processing 170. The ANT system 100 may further utilize input from machine learning (ML) 160 to generate (or supplement) the model 154 which may involve patterns 162 derived or known from the past network event data of the past event database 152.

[0028] Complex event processing 170may involve tracking and analyzing (processing) data streams associated with network events that occur in the network 102 to identify patterns or relationships between such events, and generating a rule based on the stream of events. The rule is intended to generate an output that identifies one or more possible parent events or service impact events when a similar pattern or set of events is applied to the rule, where the events represent inputs into the rule. Complex event processing 170 may be used to generate rules as a subset for the model 154 and also to apply the model 154 to new network event data. The CEP 228 may be a dedicated processor implemented by the computing device 140 or other device with hardware suitable for processing voluminous amounts of data, such as a quad core processor with 4 GB of RAM, or the like. To generate a rule, the CEP 228 may pinpoint the most significant events or service impact events, and identify trigger actions or network events that typically lead to a service impact event. The output of a rule may be an alert of an impending or existing service impacting event. In such an example, the CEP 228 receives an event stream, which may be a sequence of events, that when processed by a rule, provides the alert.

[0029] The CEP 228 may utilize any number of complex event processing methods. For example, the CEP 228 may conduct event aggregation to group multiple events into an underlying data event (such as a service impacting event) that are similar in nature but not necessarily identical. Grouping in this manner may be achieved using various analytics methods. For example, statistical summaries of network events may identify service impacting events and the devices that are affected by those events. Temporal aggregation may further be utilized to identify when the same problem is reported repeatedly by a service impacting event. The CEP 228 may further employ root cause analysis to analyze dependencies between various network events to detect where some events can be explained by other events. For example, using the computing device 140, and analyzing past network event data, the CEP 228 may be used to determine that a particular sequence of events, in an event stream, is typically an indicator of a service impact event associated with a network device failure. As such, the ANT administrator 212 may generate a rule that defines new network data, or new network data event streams, having the same or similar sequence of events, as being an indicative of the same or similar network device failure. As another example, the CEP 228 may be used to scan through past network event data of the event history database 242 to identify a time period reflecting spikes in frequency of network events (which may indicate that a service impact event occurred during that time period). In some embodiments, the CEP 228 or related features may be accessed remotely from a content provider 132 via an API 130 as shown in FIG. 1A.

[0030] FIG. 2 further shows the CEP 228 may scan data and events in an event queue 232 and can be used to identify rules for service impacting events.

[0031] In some embodiments, the model 154, which may be stored in the rules database 248, may be edited or accessed by way of a user interface (UI) 164, which may be similar to the user interfaces 118 of FIG. 1A. For example, a technician or a group of technicians may determine that the model 154 needs to be edited to reflect a newly discovered root cause of a certain past service impact event. The UI 164 may be utilized to access and modify the model 154 stored in the rules database 248 so that the model 154 upon being modified may be used to monitor events for the root cause (so that the model 154 as modified can predict other future service impact events that show similar signs of the root cause). The UI 164 may further allow an administrator to delete rules of the model 154 or otherwise conduct other management functions with respect to the model 154 as necessary. Sequences 1, 7, 13, and 14 of FIG. 2 are associated with the features of viewing, deleting and creating such rules for the model 154 of the ANT system 100. Sequence 1 shows an ANT administrator 212, accessing a rule administration user interface (UI) 218 which may be similar to an admin UI 118a of FIG. 1A or the UI 164 of FIG. 1B. The rule administration UI 218 may be accessed by way of a computing device such as an admin computing system 124a. The ANT administrator 212 may access the rule administration UI 218 to view, delete, create, or update rules or functions about the network event data described herein. Sequence 13 shows that the rule administration UI 218 may be utilized to access past network event data from an event history database 242 so that the past network event data can be filtered and displayed to determine if a correlation or pattern exists between events and whether events are associated with a service impact event. For example, it may be desired to access information about a past service impact event that occurred during a predefined time period, in order to identify child events, or other events associated with the service impact event that also occurred during the same predefined time period or shortly thereafter. The rule administration UI 218 may be used to filter the past network event data of the event history database 242 to view network events within or close to the predefined time period. Sequences 7 and 14 of FIG. 2 indicate that once a rule for the model 154 has been created, the rules syntax may be verified and tested against data of the event history data 242. A rule may then be stored in a database as part of the model 154, such as the rules database 248, to be used by the CEP 228 as described herein.

[0032] The model 154 generated in block 504 of FIG. 8 may be supplemented or entirely generated using machine learning. The ANT system 100 may utilize machine learning 160 as shown in FIG. 1B, implemented using the computing device 140 and the ANT application 112. The machine learning 160 may in some embodiments make use of patterns 162 associated with the event data 152 identified during complex event processing 170. Machine learning 160 may encompass any computer science methodologies to train, or teach the computing device 140 to learn without being explicitly programmed to arrive at a particular output. With machine learning 160, the computing device 140 (or other device) may be trained with or learns from network event data, likely but not limited to event data that has occurred in the past (historical event data). Machine learning 160 may generate functions or additional rules for the model 154 that can be used to process or otherwise analyze network event data. In particular, machine learning 160 may enhance or lend greater precision to the model 154 because the machine learning 160 may be used to break down network event data associated with events into data features or attributes, and identify relationships between events based on the event data attributes as discussed herein. In addition, the machine learning 160 may modify any machine-learning generated rules or functions over time to improve accuracy as discussed herein.

[0033] Machine learning 160 may include unsupervised machine learning such as clustering. With clustering machine learning methods, the computing device 140 of the ANT system 100 may be used to generate a set of rules that deduces attributes or structures present in past network event datasets, and groups network events based on similarities between such attributes or distances. Similarities are a set of rules that serve as criteria for grouping or separating items in the context of data clustering. Clustering with the machine learning 160 may help to identify that a plurality of events are related in some form (to identify service impact events). For example, data attributes may be extracted from discrete entries within system log files, data of the system log files being associated with network events such as device failures. The attributes extracted from the system log files may include a time stamp, a device identifier indicating which device generated the log file, an error type identifier, a telecommunications service identifier, and the like. The machine learning 160 may be used to generate a clustering model or set of rules that clusters certain network events, or attributes of such log files, within a close temporal range based on comparison of timestamp values for the various event records. Specifically, a first network event may be clustered with a second network event when timestamps for the two events occur simultaneously or within some threshold difference in time. The threshold may depend on the type of event and to what extent one event causes, directly or indirectly, the second event, and the time of such causation.

[0034] Machine learning 160 may involve supervised or semi-supervised methods such as classification. Classification can be used to predict classes, where service impact events may be assigned to certain classes of a classification model. Classification machine learning methods may involve a training phase where initial training data is presented to the computing device 140 to generate a classification function. The initial training data may comprise past network event data, patterns of events with known correlation to service impacting events, as well as other classifications. In particular, the initial training data may include patterns, or other forms of data that may be used to teach the machine learning method that network events, alone or in combination with patterns or other classifications, are indicative of a service impacting event or other event. As such, the function is a computer-generated representation generated in response to the initial training data that predicts whether a network event is associated with a service impact event.

[0035] The computing device 140 may then be subject to additional training data to test or refine the model over time as new data is collected. Training may thus involve presenting additional past network event data to the function to output a class and test whether the function identified the correct class for the data input. The class outputted from the function may then be compared with a known correct result (known correct class for the additional past network event data). A known correct result may be a result that is predetermined to be correct by an expert or other definitive source, or based on evidence or collective agreement. For example, the function may take as an input the additional training data, process the additional training data using the function, and assign a class “X”. The class X may be predetermined as being associated with a service impact event. One objective of the training phase is to minimize discrepancies between known correct results and outputs by the computing device 140 during classification. In the case of a discrepancy, results from an output of the computing device 140 may be used to adjust certain parameters of the function in such a way that if a data pattern were presented to the computing device 140 another time, the computing device 140 would theoretically produce a different output (different class) consistent with the known correct results. As such, machine learning 160 functions lend greater accuracy to the model 154 because the computing device 154 may modify such functions over time to increase prediction accuracy. Training of the computing device 140, using such classification methods, may be said to be complete when subsequent test data is presented to the computing device 140, the computing device 140 generates an output on that test data, and a comparison between the output and known correct results yields a difference or value that is within a predetermined acceptable margin. The present disclosure is not limited to training or machine learning with a computing device using classifiers and clustering. Additional methods for machine learning 160 may include: data visualization, statistics and probability, linear algebra, and data modeling (k-nearest neighborhoods, Naive Bayes, linear regression, logistics regression, decision trees, neural networks, network analysis, and Map Reduce). The ANT application 112 may be used to conduct aspects of the above described machine learning with the computing device 140. Using machine learning 160 methods as described herein, or otherwise analyzing network event data computationally to reveal patterns, trends, and associations about network events provides predictive analysis for service impacting events.

[0036] Returning to FIG. 8, block 506 describes that new network event data, which may be processed in real-time or near real-time (within a few minutes of being received or stored in the database) may be accessed by the computing device 140, and the computing device 140 may apply the new data to the model 154 to identify an imminent or active service impact event. New network event data may include messages, system log files, alerts, tickets, or the like associated with new network events such as errors, outages, failures, and other such events that occur within or otherwise involve the network 102 similar to the past event network data. The new network event, in the form of new network event data, may be accessed after the model 154 (rule or function) is generated in block 504 such that the new network event data may comprise new event data that needs to be interpreted or analyzed in some form. It should be understood that the ANT system 100 may process a large number of new network events that needs to be classified or otherwise interpreted using the function or rules generated in block 504 in order to identify and address service impact events.

[0037] In one embodiment, the ANT system 100 utilizes the CEP 228 to apply the model 154 to new event data or live event data streams occurring in real time in the network 102 in order to identify service impact events. The CEP 228 may access and combine new event data from multiple sources (such as network element 120A and network element 120B). For example, the CEP 228 may receive event data and apply a rule to identify a sequence of events S that is known to be a sign that a service impact event has occurred or is actively occurring, and generate an output indicating the same.

[0038] One method employed by the CEP 228 is illustrated by the combination of steps 20, 15, 19, 16, and 22-26 of FIG. 2. Sequence 20 shows an event queue 232 may temporarily store and organize new network event data for the CEP 228 as new network event data is retrieved or accessed by way of a stream bus 209. In other words, the stream bus 209 may operate as a communication hub that provides access to live or new network event data to the CEP 228 as generated from network devices such as the network element 120A and network element 120B. It should be understood that the new network data may also be aggregated and stored within a database such as the ANT data 246 or the database 122 of FIG. 1A. Temporary storage of the new network data within the new event database 122 may involve normalizing the new event data before it is stored and made available for use. In addition, the system log server 121 of FIG. 1A may be implemented to aggregate new network event data from one or more of the network elements associated with the network 102. In other embodiments, the CEP 228 may access network event data directly from network event data-generating resources such as the network element 120C.

[0039] The CEP 228 accesses and reads the model 154 or any rules suitable for identifying service impacting events, which may be stored in a rules database 248. A rule may define that where a system alert A occurs in the network 102, the occurrence of the system alert A is indicative of a service impact event. A new network event, new event stream, or new event sequence, which may comprise one or more events generated in a particular order, or sequence may be processed by the CEP 228 to identify whether a new event sequence associated with a new event stream matches, triggers, or satisfies the rule from block 504 in some form, meaning a particular service impact event has occurred or is likely occurring. FIG. 2 shows the CEP 228 may further use an ANT data access component 236 for its input and output (I/O) operations, and that the ANT data access 236 may write a plurality of logs which may be stored in a database referred to as ANT logs 244 as the CEP 228 scans new network data and identifies service impact events.

[0040] The CEP 228 may further apply or feed the new network data to any rules or functions generated from the machine learning 160 to identify whether a new network event is indicative of a service impact event. To feed a new network event through a model 154 incorporating the machine learning 160, network data associated with the new network event may be broken down into attributes as described herein which may be used as input parameters for any of the rules or functions generated from the machine learning 160. Specifically, attributes of new network event data may define a set of quantifiable properties or features which may be used as input parameters for functions or rules associated with machine learning 160. For example, discrete entries within system log (network event data) may include attributes such as a timestamp or other information about when the system log occurred, a network device identifier associated with the system log, or the like. Such attributes may be fed into the rules or functions developed during machine learning 160. For example, attributes from a system log may be fed into a function generated from machine learning 160 for classifying a particular event. The function may output a particular class, which may be predetermined as defining a service impact event.

[0041] As described in block 508, a responsive action 156 may be identified to address the service impact event identified in block 506. The responsive action 156 may include a task, or set of tasks to address the service impact event of block 506. For example, the responsive action may include issuing a notification about the service impact event to one or more customer devices such as the customer computing system 124c. In some embodiments, the responsive action 156 may be to issue an alert that a new network event indicates an active service impacting event is taking place in the network 102. For example, when the system identifies a fiber cut, the system may generate an a notification about the fiber cut, and that notification transmitted or otherwise triggered at a customer device, service provider device, or the like. Moreover, in some instances, the result of the event may be triggered or provided. For example, with respect to the service provider, the actual occurrence of a fiber cut may be triggered, whereas the service disruption triggered by the fiber cut may be triggered at the customer device.

[0042] The responsive action 156 may further involve generating a recommendation for a technical resolution suggestion to resolve the service impact event. More specifically, the system may use the event generated by the rule as a key to access an event history database 242 or the past events database 152 that stores information about past events, including information about the resolution of past events.

[0043] As described in block 510, a resolution action may be initiated to resolve the service impact event. This may be triggered automatically by the ANT system 100. A responsive action may comprise, for example, reconfiguring (or instructing other systems to reconfigure) one or more service instances to address a service impact event as a network outage in a specific location. For example, to address a service outage in a first location, which may be identified by the output of block 506, the computing device 140 may be configured to automatically and proactively initiate resolution or corrective action and reconfigure network connections for customers in the first location (before the customers have to submit tickets or technical requests for assistance or complaints). Another example of a responsive action may involve initiating a rollback to a previous version of a driver for a router where a driver update installed to the router causes the router to malfunction. In this example, the router malfunction would be the service impact event, and the act of rolling back to a previous driver version for the router would be the resolution action to address the service impact event.

[0044] FIG. 9 is a process flow 600 related to the process flow of FIG. 8 for describing adaptive notification and ticketing for service impact events (identified in FIG. 8), which may be described with reference to FIG. 1A, FIG. 2, and FIGS. 3-8. In block 602, a service impact event associated with the network 102 is identified using the steps detailed in FIG. 8. The service impact event may be, for example, a fiber cut that has occurred somewhere in the network 102. For example, a fiber cut may have occurred in New York, as illustrated by the service impact event 302 of the exemplary map interface 300 of FIG. 3. The map interface 300 comprises a feature of the dashboard 220, where network events may be displayed in different geographical locations so that a customer or network administrator can assess events from a map perspective. In addition, time duration settings of the map interface 300 may be adjusted so that network events displayed may be associated with a specific time, date, or temporal range. The map interface 300 may be generated by the dashboard 220.

[0045] In block 604, the ANT system 100 may identify specific customer services affected by a service impacting event. For example, attributes of an event sequence (when applied to a rule that identifies a fiber cut) may reference a particular router or portion of a router affected by the fiber cut. The router attribute may be used to query an inventory database 250 that stores information about the router. The ANT system 100 may also use the router information from the inventory database 250 to query a customer enrichment database 252 that maps inventory information from the inventory database 250 to customer utilization. The ANT system 100 may use the router information from the inventory database 250 to query an entitlements and service level agreement (SLA) database 254 that tracks customer service information. The aforementioned information may be used to determine what customer devices are accessing the router or what customer services or connections may be impacted by the router being offline due to the fiber cut. Referring back to the example in FIG. 3, the map interface 300 indicates that the service impact event 302 dealing with a fiber cut In New York affects or impacts devices and/or services in Austin, Tex. The ANT system 100 may identify that the fiber cut associated with the service impact event 302 that occurs in Net York affects customer devices or services in Austin, Tex. by accessing attributes of an event sequence that triggered the fiber cut associated with the service impact event 302. The attributes of the event sequence may include router information that may be used to query the inventory database 250 and identify that a particular router or portion of a router located in Austin, Tex. has been affected by the fiber cut in New York.

[0046] In block 606, a notification or alert may be generated for the fiber cut. Sequences 10, 9, 27, 17, 18, 11, 12, 5, and 6 of FIG. 2 are associated with the features of providing alerts or notifications to devices communicating with ANT system 100. A notification may be generated for a customer device such as the computing system 124c regarding the fiber cut. The alert engine 230 of FIG. 2 processes such service impact events and notifies applications users based on user preferences. The alert engine 230 may be utilized to send at least one alert to a notification API 240. The notification API 240 is an interface that may be used to translate information about alerts into a notification so that notifications may be sent to customers regarding alerts. The alert engine 230 may further be used to open a master ticket for the new service impacting event of the fiber cut. A master ticket may be a ticket that signifies a larger event, such as a service impact event that needs immediate attention. Sequence 10 of FIG. 2 shows that a service impacting event and status changes regarding the service impact event of the fiber cut may be sent from the CEP 228 to the alert engine 230. Sequence 11 shows the notification API 240 may be used to translate information about an alert to a notification. The notification may then be sent to a customer using an SMS service or SMS alerts component 222. In sequences 5 and 6, the SMS alerts component 222 transmits notifications to phones and tablets 214B so that customers can receive the notification regarding the fiber cut in the form of text messages. Sequence 12 shows the notification API 240 may further be used to translate an alert to an email notification which may be used by the sendmail service or email alerts component 224 so that customer devices may receive the notification in the form of an email. Exemplary notifications regarding service impact events are depicted in notifications 362A-362kb and 364 of FIG. 6, and 382a-382h and 384 of FIG. 7. Notifications 364 and 384 may be associated with new or more critical service impact events by being prominently displayed as shown. In some embodiments, notifications may be provided to customers via social media accounts (on a social media wall of a user).

[0047] As further shown in block 606, the ANT system 100 may close any child tickets associated with the fiber cut. Where it is determined that a smaller number of network events are actually indicating a larger service impacting event such as the fiber cut , tickets for the smaller network events (children tickets) may be closed out as needed when a master ticket associated with the service impacting event is opened. Ticket priority may also be assigned based on a class or type of service impacting event that occurs in the network 102.

[0048] In block 608, the computing system 140 of the ANT system 100 accesses notification feedback from a customer device regarding the notification of a service impact event, such as the notification regarding the fiber cut. Notification feedback from a customer may be received from a customer portable electronic device 214b or other customer computing device 214a using an input window, shown in FIG. 6 as input window 370 and shown in FIG. 7 as input window 390 as part of the dashboard 220, user interface 118, or other portal for displaying the notification. As further shown in FIGS. 6 and 7, the input windows 370 and 290 allow customer devices to provide notification feedback upon being presented with service impact events in the form of alerts 362A-362kb and 364 of FIG. 6, and 382a-382h and 384 of FIG. 7. Further, the customer devices may also call dashboard APIs, such as the notification API 240, from the integration tier 208 to e.g. adjust notification preferences.

[0049] In block 610, the ANT system 100 utilizes any notification feedback received to adjust notification preferences for customer devices. Specifically, in sequences 2 or 3, the dashboard 220 may receive feedback from a customer 215 through the customer device 214a or customer device 214b about relevance of alerts transmitted to the customer devices. The customer preference information and other ANT data may be read by the alert engine 230. The ANT system 100 may submit the feedback to the adaptive API 234. The adaptive API 234 may translate the feedback, or normalize the feedback to a form that may analyzed by the CEP 228, to learn from the feedback, determine updates need to be made to customer preferences regarding notifications, and may update customer preferences data as needed. In sequence 21, user preferences may be stored in a database such as the ANT data 246.

[0050] In some embodiments, customer feedback may be interpreted using the machine learning 160 to adapt network event notifications to customer preferences. The computing device 140 may be tested with a customer operating the customer computing system 124c to determine whether the adapted notification preferences stored in the ANT data 246 are acceptable to the customer. A customer of the network 102 may have the ability to view, subscribe to, and unsubscribe from receiving alerts and notifications which deal with events that impact the customer's network.

[0051] The functionality of the ANT system 100 may be extended to customer devices and network administrator devices as needed. The dashboard 220 of FIG. 2 may be used to access or view aspects of the ANT system 100. In sequence 2, a web application may be implemented by a customer device of the network 120 to view aspects of the dashboard 220 by using a customer device 214A (similar to the customer computing system 124c). More specifically, the dashboard 220 may be used to display information about network events to customer devices 214, employee devices, or other predetermined devices. In sequences 3 and 4 of FIG. 2, other customer devices such as phones or tablets 214B, may have access to the dashboard 220, and such access may be implemented using native applications so that the customers can securely access network event data behind a firewall. The phones and tablets 214B may utilize HTML 5 web applications to access data from the ANT system 100.

[0052] Returning to FIG. 1A, the network 102 may further be communicably coupled to one or more computing devices or computing systems 124. In the example of FIG. 1A, the computing systems 124 may include at least one of an administrator (admin) computing system 124a, an employee computing system 124b, and a customer computing system 124c. Each of the computing systems 124 may comprise a personal computer, a tablet, a smart phone or the like, that is capable of communicating with, accessing, or executing aspects of the ANT application 112 for functions including management, processing, and displaying of alerts and events. In some embodiments, the computing systems 124 may include native software applications so that the computing systems 124 may communicate with the ANT application 112 and access data.

[0053] As further shown in FIG. 1A, in some embodiments, each of the computing devices 124 communicates with or otherwise accesses aspects of the ANT application 112 via a dashboard or user interface (UI) 118. Specifically, to access the ANT application 112, the admin computing system 124a utilizes an admin UI 118a, the employee computing system 124b accesses an employee UI 118b, and the customer computing system 124c accesses a customer UI 118c. User interfaces 118a-118c offer different levels of functionality and accessibility of the ANT application 112 depending on the type of user operating the one or more computing systems 124. For example, in one embodiment, an admin UI 118a allows the admin computing system 124a to manage system events and alerts whereas the customer UI 118c limits the customer computing device 124c to receiving alerts about events of network 102 without management functionality. In some embodiments, the Uls 118 may comprise a web interface. More specifically, a user can log onto a web page via a browser of the computing system 124 and access the UI 118. The Uls 118 may further comprise at least one application program interface (API) to provide additional flexibility of access. In some embodiments, the UI 118 is accessible to a user of a computing system 124 via a mobile or general software application downloaded or accessible on the computing system. Each of the Uls 118 may be tuned to user preferences corresponding to the respective users of the Uls 118. Specifically, as explained herein, the computing device 140, in concert with the ANT application 112, may learn to identify patterns about what kinds of alerts or notifications certain users wish to receive and what kinds of alerts or notifications such users would rather not receive based on user feedback, or other raw network data and by utilizing machine learning and event processing as described herein. The Uls 118 may further include an explore feature that displays data geographically and temporally for enhanced analysis. For example, an admin user may utilize the admin UI 118a to view network events for a specific location and duration of time.

[0054] Additional description will now be provided regarding the exemplary interfaces of FIGS. 4-7. FIG. 4 illustrates an exemplary alerts and data tab 320. As shown, a user may be provided with a list of network events (and possible service impacting events), listed according to date and time with a description or details about each event. FIG. 5 illustrates an exemplary measure tab 340. As shown, the measure tab may include statistics regarding network events that have transpired within the network 102. The measure tab may display graphical information about customer/service impacting events that have been generated or opened, how many of the events have been closed by the ANT application 112, reporting about early notifications to customers (where the ANT application 112 and the trained computing device 140 have proactively discovered service impacting events before being reported), and the like.

[0055] FIG. 6 illustrates an exemplary dashboard 360 that may be accessible by a customer of the service provider managing the network 102, embodied within or as part of the customer UI 118c. As shown, a list of alerts regarding service impact events (362A-362K) may be displayed in a history box, and alerts regarding certain service impacting events, such as the service impacting event alert 364 may be displayed more visibly as a part of a ribbon or pop-up at the bottom of the example interface. In addition, a map outlining network events may be displayed in a side window pane. The example shows that multiple reporting details may be displayed all at once. FIG. 7 illustrates an exemplary implementation of an interface 380 for a mobile phone. Similar to FIG. 6, a list of alerts associated with network events (382A-382H) may be displayed with an alert regarding a new service impacting event 384 visibly displayed to the user to quickly bring such an event to the user's attention.

[0056] Returning to FIG. 2, the ANT system 100 may comprise a number of components described herein and associated with a client tier 202, a presentation tier 204, a business tier 206, an integration tier 208, and a resource tier 210. The components of FIG. 2 may be associated with the following definitions in Table 1.

TABLE 1
Name	Description
Personal Computer	ANT system may support the personal computer for the dashboard,
	email, short message service (SMS) alerts and administration clients.
Smart Phones	ANT system may support smart phones for the dashboard, email, and
	SMS alerts.
Tablets	ANT system may support the tables for the dashboard, email, and SMS
	alerts.
Rule Admin UI	The subject tool may aid an administrator in analyzing a service
	impacting event. It may further aid in defining and testing the rule in the
	history data.
Dashboard	The dashboard may collect alerts from the Alert Engine. It may apply
	the rules from an adaptive API and the user role to display service
	impacting events and display them on the user's dashboard. It may take
	the user's feedback and send it to the Adaptive API.
SMS Alerts	The component may push the alerts to the mobile devices.
Email Alerts	The component may send email alerts via email.
Rule Validation	This module may validate rule syntax and tests rules against existing
	data to verify it meets predetermined requirements.
Complex Event	The Complex Event Processor (CEP) scans an event stream to
Processor	match/find an event sequence that matches a rule. It may identify the
	service impacting events.
Alert Engine	The Alert Engine processes the service impacting events and notifies
	application users based on user preference either learned or provided
	by the customer. The alerts may be placed on the dashboard, sent via
	SMS and email, or ignored.
Stream Bus	The component is the source of events, conditions, and logs of any type
	which has information to determine a service impacting event. In some
	embodiments, the stream bus may utilize Splunk, and other sources.
Event Queue	The component may be filter down data that is scanned by the Complex
	Event Processor (CEP). It may be a component of the CEP.
Adaptive API	The component takes feedback for customers and other data to
	programmatically build rules used by the CEP and Alert Engine.
ANT Data	The ANT Data is a set of APIs to access data for ANT.
Ticket API	A Ticketing API.
Notification API	A module for notifying customers about network events, which may
	include notifications through email and SMS alerts.
Event History	This may include history of events including data which can be used to
	build and test rules.
Ant Logs	The component comprises a log of service impacting events. The status
	history and actions taken on the events.
ANT Data	One possible database for ANT systems. It may store the status change
	and other metadata for the service impacting events.
Rules Inventory	This component comprises rules built to correlate the data and customer
	notification preferences/network and equipment inventory data.
Customer	This component includes data to map the inventory to customer
Enrichment Data	utilization.
Entitlements	This component includes customer entitlement and service level
and SLA	agreement (SLA) information.

[0057] It should be understood that the ANT system 100 according to aspects of the present disclosure is not limited to the components and sequences of FIG. 2. It should be further understood that the sequences depicted from 1-27 are merely for demonstrative and explanatory purposes such that FIG. 2 is not intended to limit the sequences discussed to any particular order or content. Consequently, in some embodiments, the sequences discussed may vary in order and content and additional components and interactions between components of the ANT system 100 are contemplated. It should be further understood that the embodiments of FIG. 1A and FIG. 2 are not mutually exclusive such that the present disclosure contemplates one or more features of FIG. 1A may be integrated with FIG. 2 and one or more features of FIG. 2 may be integrated with FIG. 1A.

[0058] FIG. 10 is an example schematic diagram of a computing system 700 that may implement various methodologies discussed herein. For example, the computing system 700 may comprise the computing device 140 used to execute the ANT application 112, or, it may comprise a computing system 124 used by end users to communicate with the ANT application 112 and receive alerts and information related to alerts. The computing system 700 includes a bus 701 (i.e., interconnect), at least one processor 702 or other computing element, at least one communication port 703, a main memory 704, a removable storage media 705, a read-only memory 706, and a mass storage device 707. Processor(s) 702 can be any known processor, such as, but not limited to, an Intel® Itanium® or Itanium 2® processor(s), AMD° Opteron® or Athlon MP® processor(s), or Motorola® lines of processors. Communication port 703 can be any of an RS-232 port for use with a modem based dial-up connection, a 10/100 Ethernet port, a Gigabit port using copper or fiber, or a USB port. Communication port(s) 703 may be chosen depending on a network such as a Local Area Network (LAN), a Wide Area Network (WAN), or any network to which the computing system 700 connects. Computing system may further include a transport and/or transit network 755, a display screen 760, an I/O port 740, and an input device 745 such as a mouse or keyboard.

[0059] Main memory 704 can be Random Access Memory (RAM) or any other dynamic storage device(s) commonly known in the art. Read-only memory 706 can be any static storage device(s) such as Programmable Read-Only Memory (PROM) chips for storing static information such as instructions for processor 702. Mass storage device 707 can be used to store information and instructions. For example, hard disks such as the Adaptec® family of Small Computer Serial Interface (SCSI) drives, an optical disc, an array of disks such as Redundant Array of Independent Disks (RAID), such as the Adaptec® family of RAID drives, or any other mass storage devices, may be used.

[0060] Bus 701 communicatively couples processor(s) 702 with the other memory, storage, and communications blocks. Bus 701 can be a PCI/PCI-X, SCSI, or Universal Serial Bus (USB) based system bus (or other) depending on the storage devices used. Removable storage media 705 can be any kind of external hard drives, thumb drives, Compact Disc-Read Only Memory (CD-ROM), Compact Disc-Re-Writable (CD-RW), Digital Video Disk-Read Only Memory (DVD-ROM), etc.

[0061] Embodiments herein may be provided as a computer program product, which may include a machine-readable medium having stored thereon instructions which may be used to program a computer (or other electronic devices) to perform a process. The machine-readable medium may include, but is not limited to optical discs, CD-ROMs, magneto-optical disks, ROMs, RAMs, erasable programmable read-only memories (EPROMs), electrically erasable programmable read-only memories (EEPROMs), magnetic or optical cards, flash memory, or other type of media/machine-readable medium suitable for storing electronic instructions. Moreover, embodiments herein may also be downloaded as a computer program product, wherein the program may be transferred from a remote computer to a requesting computer by way of data signals embodied in a carrier wave or other propagation medium via a communication link (e.g., modem or network connection).

[0062] As shown, main memory 704 is encoded with an ANT application 112 that supports functionality as discussed above. The ANT application 112 (and/or other resources as described herein) can be embodied as software code such as data and/or logic instructions (e.g., code stored in the memory or on another computer readable medium such as a disk) that supports processing functionality according to different embodiments described herein. During operation of one embodiment, processor(s) 702 accesses main memory 704 via the use of bus 701 in order to launch, run, execute, interpret, or otherwise perform processes, such as through logic instructions, executing on the processor 702 and based on the ANT application 112 stored in main memory or otherwise tangibly stored.

[0063] The description above includes example systems, methods, techniques, instruction sequences, and/or computer program products that embody techniques of the present disclosure. However, it is understood that the described disclosure may be practiced without these specific details. In the present disclosure, the methods disclosed may be implemented as sets of instructions or software readable by a device. Further, it is understood that the specific order or hierarchy of steps in the methods disclosed are instances of example approaches. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the method can be rearranged while remaining within the disclosed subject matter. The accompanying method claims present elements of the various steps in a sample order, and are not necessarily meant to be limited to the specific order or hierarchy presented.

[0064] The described disclosure may be provided as a computer program product, or software, that may include a machine-readable medium having stored thereon instructions, which may be used to program a computer system (or other electronic devices) to perform a process according to the present disclosure. A machine-readable medium includes any mechanism for storing information in a form (e.g., software, processing application) readable by a machine (e.g., a computer). The machine-readable medium may include, but is not limited to optical storage medium (e.g., CD-ROM); magneto-optical storage medium, read only memory (ROM); random access memory (RAM); erasable programmable memory (e.g., EPROM and EEPROM); flash memory; or other types of medium suitable for storing electronic instructions.

[0065] It is believed that the present disclosure and many of its attendant advantages should be understood by the foregoing description, and it should be apparent that various changes may be made in the form, construction, and arrangement of the components without departing from the disclosed subject matter or without sacrificing all of its material advantages. The form described is merely explanatory, and it is the intention of the following claims to encompass and include such changes.

[0066] While the present disclosure has been described with reference to various embodiments, it should be understood that these embodiments are illustrative and that the scope of the disclosure is not limited to them. Many variations, modifications, additions, and improvements are possible. More generally, embodiments in accordance with the present disclosure have been described in the context of particular implementations. Functionality may be separated or combined in blocks differently in various embodiments of the disclosure or described with different terminology. These and other variations, modifications, additions, and improvements may fall within the scope of the disclosure as defined in the claims that follow.