Patent ID: 11941556
Assignee: LOGSHERO LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 12:
13. The incident management system of claim 12, wherein computing the respective score of the instruction cluster comprises:
computing a plurality of cluster term counts, each indicative of an amount of terms in a cluster of the plurality of instruction clusters;
identifying in the plurality of cluster term counts a maximum cluster term count;
computing a plurality of term frequencies, each for one of the plurality of cluster terms of the instruction cluster and indicative of a frequency of the respective cluster term in the plurality of cluster terms;
computing a plurality of instruction term frequencies, each for one of the group of historical investigation instructions clustered in the instruction cluster and indicative of a sum of a group of term frequencies, each a respective term frequency of one of a group of cluster terms selected from the plurality of cluster terms such that the group of cluster terms were extracted from the respective historical investigation instruction;
computing a plurality of action times, each for one of the group of historical investigation instructions clustered in the instruction cluster and indicative of an amount of time a user interacted with the incident management system when executing the respective historical investigation instruction;
identifying in the plurality of action times a maximum action time;
computing a plurality of elapsed time values, each for one of the group of historical investigation instructions clustered in the instruction cluster and indicative of an amount of days since the respective historical investigation instruction was executed by the incident management system;
computing a plurality of instruction scores, each computed for one of the group of historical investigation instructions clustered in the instruction cluster by:
adding 1 to the respective elapsed time value of the historical investigation instruction to produce an intermediate term;
computing a base 10 logarithm of the intermediate term to produce a log term;
multiplying the maximum cluster term count by the maximum action time and by the log term to produce a divider;
multiplying the respective instruction term frequency of the historical investigation instruction by the respective action time of the historical investigation instruction to produce a product value; and
dividing the product value by the divider to produce the instruction score; and

computing a sum of the plurality of instruction scores to produce the respective score of the instruction cluster.