## 3 Dataset Description  
For this study, we used a dataset from a large multinational company comprising 500,000 total records. The dataset comprised real-time IT incidents collected from January 2020 to March 2021. These incidents were recorded by the organization's three main stakeholders (agencies, employees, and customers). The reported incidents were classified either as major incident reports (**MIR**) or non-major incident reports (**NMIR**). Examples of the incident reports are provided below:  
* **MIR**: _\"Why am I unable to print from any application? All staff is unable to print. No error message.\"_
* **Non-MIR**: _\"How do I update Java? Outlook web version running slow.\"_  
An MIR was an incident report that had been escalated to major status or had a direct link to major incidents identified by the IT team. Conversely, NMIR was a regular incident with less impact on the operation. The class of each incident was labeled retrospectively after processing. The dataset is structured as:  
\[Agency\_records=\sum Agency(\textbf{MIR, NMIR}),\]  
\[Employee\_records=\sum Employee(\textbf{MIR, NMIR}),\]  
\[Customer\_records=\sum Customer(\textbf{MIR, NMIR})\]  
The distribution of the datasets is depicted in Figure 2. The _Agency_records_ contained 493,503 incidents, out of which 15,257 were MIR and 478,246 were NMIR records. The _Employee_records_ contained 245,696 incidents with 3779 MIR and 241,917 NMIR values. The _Customer_records_ had 217,540 incidents with 173 as MIR and 217,367 as NMIR. As observed, the datasets were significantly imbalanced and skewed heavily in favor of NMIR incidents. Specific to this study, we only used the _Description, Short description (incident details)_, and the _Status (labels MIR or NMIR) within the available datasets_ columns. In addition, we utilized the _MIR opened at (MOA)_ and _Incident opened at (IOA)_ columns for estimating the prediction horizon (i.e., time advantage that could be realized by investigating the cause of an incident potentially related to a major outage). A sample of the dataset is described in Table 2. To address the imbalanced class issue in our dataset, we curated new datasets using a custom data-augmentation approach [40]. We added the actual MIR records from  
Figure 2: Distribution of dataset. the other stakeholders' datasets to each stakeholder dataset. This enriched each dataset while preventing additional extraneous information in the vocabulary. Data augmentation was intended to increase the occurrences of the MIR classified incidents that were severely lacking in the original dataset. The dataset composition was, as follows:  
\[ \begin{split} Agency\_resampled=\sum Agency\_records+\sum Employee( \mathbf{MIR})+\sum Customer(\mathbf{MIR}),\\ Employee\_resampled=\sum Employee\_records+\sum Agency( \mathbf{MIR})+\sum Customer(\mathbf{MIR}),\\ Customer\_resampled=\sum Customer\_records+\sum Employee( \mathbf{MIR})+\sum Agency(\mathbf{MIR})\end{split} \]  
We also concatenated all the records to increase the number of MIR records, as follows:  
\[ \begin{split} Combine\_All=\sum(Agency\_records+ Employee\_records+ Customer\_records)\end{split} \]  
We also performed up-sampling using the synthetic minority oversampling technique (SMOTE) [41]. We used SMOTE for oversampling because it generated synthetic data points that were different from the actual points instead of duplicating records with no extra information and increasing vector size. Using SMOTE, we generated three sampled subsets:  
\[ \begin{split} Agency\_smote=\sum SMOTE(Agency( \mathbf{MIR,\_NMIR})),\\ Employee\_smote=\sum SMOTE(Employee(\mathbf{MIR,\_NMIR})),\\ Customer\_smote=\sum SMOTE(Customer(\mathbf{MIR,\_NMIR}))\end{split} \]  
Our literature survey indicated that most of the reported studies did not use resampling, which may have resulted in sub-optimal learning [19; 29; 37].