Granted Patent B2

US 12,554,613 · App. 18/384,158 · Granted Feb 17, 2026

Inventors: Se Jin Kim (Seoul, KR); Chang Jae Park (Seoul, KR); Ju Ho Lee (Seoul, KR); Hwa Young Kim (Seoul, KR)

Assignee: SAMSUNG SDS CO., LTD.

G06F11/3072G06F2201/86

Abstract

Claims (83)

1 . An event processing method performed by at least one processor, the method comprising:

collecting a plurality of events;

grouping at least some of the collected plurality of events based on code values respectively associated with the collected plurality of events, wherein the code values indicate at least one of originating service devices in which the plurality of events have occurred or services provided by the originating service devices;

regenerating the grouped events into a single event;

determining whether the regenerated event qualifies for an automatic action;

acquiring a predefined second rule for the regenerated event, which is a rule that defines the automatic action, based on a determination that the regenerated event qualifies for the automatic action; and

performing the automatic action with respect to the regenerated event in accordance with the predefined second rule.

2 . The event processing method of claim 1 , wherein the grouping comprises:

identifying device groups in which the collected plurality of events have occurred based on the code values; and

grouping events originating from a same device group based on a result of the identifying.

3 . The event processing method of claim 1 , wherein

the grouped events are events originating from a first device group, and

the regenerating comprises:

acquiring a predefined first rule for the first device group, which is a rule that, based on a number of events with a particular grade, among the grouped events, exceeding a threshold value, upgrades the events with the particular grade; and

regenerating the grouped events into an event with a higher grade than the particular grade based on a determination that the number of events with the particular grade, among the grouped events, exceeds the threshold value.

4 . The event processing method of claim 1 , wherein the grouping comprises:

acquiring predefined filtering information, which includes at least one code value associated with each target event to be filtered;

removing at least one of the collected plurality of events by comparing each of the code values of the collected plurality of events and the at least one code value of the predefined filtering information; and

grouping at least some of remaining events of the collected plurality of events.

5 . The event processing method of claim 1 , further comprising:

receiving an additional event;

identifying a scope of a service associated with the additional event based on a code value associated with the additional event, wherein the scope of the service indicates a range of a service provided by an originating service device in which the additional event has occurred; and

generating multiple events from the additional event based on the identified scope of the service.

6 . The event processing method of claim 1 , further comprising:

receiving an incomplete event;

determining similarities between a code value associated with the incomplete event and code values of predefined events; and

supplementing the incomplete event using event information for events having higher similarities than a similarity threshold.

7 . The event processing method of claim 1 , further comprising:

after the performing, determining whether the regenerated event qualifies for an automatic closure; and

pausing a notification to an administrator and terminating a processing process for the regenerated event based on a determination that the regenerated event qualifies for the automatic closure.

8 . The event processing method of claim 1 , further comprising:

collecting an additional event; and

regrouping the additional event and the regenerated event based on code values respectively associated with the regenerated event and the additional event.

9 . The event processing method of claim 1 , wherein

the grouping comprises acquiring a trained machine learning model from data regarding a plurality of events for training, and determining whether the collected plurality of events are grouped, using the trained machine learning model, and

the data includes code values respectively associated with the plurality of events for training and event type information and grouping status information for each of the plurality of events for training.

10 . An event processing system comprising:

at least one processor; and

a memory configured to store one or more instructions,

wherein the at least one processor is configured to, by executing the one or more instructions stored in the memory, perform:

collecting a plurality of events;

grouping at least some of the collected plurality of events based on code values respectively associated with the collected plurality of events, wherein the code values indicate at least one of originating service devices in which the events have occurred or services provided by the originating service devices;

regenerating the grouped events into a single event;

determining whether the regenerated event qualifies for an automatic action;

acquiring a predefined second rule for the regenerated event, which is a rule that defines the automatic action, based on a determination that the regenerated event qualifies for the automatic action; and

performing the automatic action with respect to the regenerated event in accordance with the predefined second rule.

11 . The event processing system of claim 10 , wherein the grouping comprises

identifying device groups in which the collected plurality of events have occurred based on the code values; and

grouping events originating from a same device group based on a result of the identifying.

12 . The event processing system of claim 11 , wherein

the grouped events are events originating from a first device group, and

the regenerating comprises:

acquiring a predefined first rule for the first device group, which is a rule that, based on a number of events with a particular grade, among the grouped events, exceeding a threshold value, upgrades the events with the particular grade; and

regenerating the grouped events into an event with a higher grade than the particular grade based on a determination that the number of events with the particular grade, among the grouped events, exceeds the threshold value.

13 . The event processing system of claim 11 , wherein the grouping comprises:

acquiring predefined filtering information, which includes at least one code value associated with each target event to be filtered;

removing at least one of the collected plurality of events by comparing each of the code values of the collected plurality of events and the at least one code value of the predefined filtering information; and

grouping at least some of remaining events of the collected plurality of events.

14 . The event processing system of claim 11 , wherein the at least one processor is further configured to perform:

receiving an additional event;

identifying a scope of a service associated with the additional event based on code values associated with the additional event, wherein the scope of the service indicates a range of a service provided by an originating service device in which the additional event has occurred; and

generating multiple events from the additional event based on the identified scope of the service.

15 . The event processing system of claim 11 , wherein the at least one processor is further configured to perform:

receiving an incomplete event;

determining similarities between a code value associated with the incomplete event and code values of predefined events; and

supplementing the incomplete event using event information for events having higher similarities than a similarity threshold.

16 . The event processing system of claim 11 , wherein the at least one processor is further configured to perform:

determining whether the regenerated event qualifies for an automatic action;

acquiring a predefined second rule for the regenerated event, which is a rule that defines the automatic action, based on a determination that the regenerated event qualifies for the automatic action; and

performing the automatic action on the regenerated event in accordance with the predefined second rule.

17 . The event processing system of claim 11 , wherein the at least one processor is further configured to perform:

collecting an additional event; and

regrouping the additional event and the regenerated event based on code values respectively associated with of the additional event and the regenerated event.

18 . The event processing system of claim 11 , wherein

the grouping comprises acquiring a trained machine learning model from data regarding a plurality of events for training, and determining whether the collected plurality of events are grouped, using the trained machine learning model, and

the data includes code values respectively associated with the plurality of events for training and event type information and grouping status information for each of the plurality of events for training.

19 . A non-transitory computer-readable recording medium storing computer program executable by at least one processor to perform:

collecting a plurality of events;

grouping at least some of the collected plurality of events based on code values respectively associated with the collected plurality of events, wherein the code values indicate at least one of originating service devices in which the events have occurred or services provided by the originating service devices;

regenerating the grouped events into a single event;

determining whether the regenerated event qualifies for an automatic action;

acquiring a predefined second rule for the regenerated event, which is a rule that defines the automatic action, based on a determination that the regenerated event qualifies for the automatic action; and

performing the automatic action with respect to the regenerated event in accordance with the predefined second rule.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (29)