Patent Description:
Deploying, refactoring, or releasing software code has different kinds of associated risk depending on what code is being changed. Not having a clear view of how vulnerable or risky a certain code deployment may be increases the risk of system outages. Deploying code always includes risks for a company, and platform modernization is a continuous process. A technology shift is a big event for any product, and entails a large risk and opportunity for a software company. When performing such operations, there is a great need to ensure that code is refactored in the most vulnerable areas and that a correct test framework is in place before starting a transition to newly deployed code.

Additionally, software companies have been struggling to apply rules for what changes are allowed in certain releases to avoid outages, and this process is rules based and/or manually subjective. Outages and/or incidents cost companies money in servicelevel agreement payouts, but more importantly, wastes time for personnel via rework, and may risk adversely affecting a company's reputation with its customers. Highest costs are attributed to bugs reaching production, including a ripple effect and a direct cost on all downstream teams. Also, after a modification has been deployed, an incident team may waste time determining what caused a change in performance of a system. <CIT> discloses a risk level of a software commit is assessed through the use of a classifier. <CIT> discloses an approach in which one or more computer processors: create a dictionary for each source code commit in a set of historical source code commits associated with a software deployment; create a similarity model based on the created dictionary for each source code commit in the set of historical source code commits; generate a vector embedding for a source code commit pair based on a set of log differences between source code commit pairs utilizing the created similarity model; generate, responsive to a new source code commit, a new vector embedding based on a set of log differences between the new source code commit and a preceding source code commit utilizing the created similarity model; generate a defect likelihood utilizing the generated new vector embedding; determine, responsive to the generated defect likelihood exceeding a defect likelihood threshold, that the new source code commit contains defects. <CIT> discloses that information concerning software bugs including bug detection, bug prediction data and/or historical bug data can be used to determine whether it is safe to commit, integrate, deploy and/or deliver a software change.

The present disclosure is directed to overcoming one or more of these abovereferenced challenges.

According to certain aspects of the disclosure, systems and methods are disclosed for training and using a machine-learning based model to reduce and troubleshoot incidents in a system and, more particularly, to training and using a machine-learning based model to determine a risk level for a proposed modification to a system.

The scope of protection is defined by the independent claims in the appended set of claims. Dependent claims define preferred embodiments.

The objects and advantages of the disclosed embodiments will be realized and attained by means of the elements and combinations particularly pointed out in the appended claims.

As will be apparent from the embodiments below, an advantage to the disclosed systems and methods is that the disclosed systems and methods provide an end-to-end approach to incidents, as compared to current isolated improvements per department, which will lead to increased communication and focus on common problems. The disclosed systems and methods provides a solution for all departments in a company to supply data to be commonly available for insights to all departments. As a result, a team may take actions such as extra testing, extra staff during hardware and/or software deployment, and provide directions for refactoring code, for example.

For example, the disclosed systems and methods may provide intelligent alerts along the DevOps loop to mitigate incidents, reduce development bugs, and identify risks proactively in real-time. The disclosed systems and methods may be integrated with code repositories to alert developers when critical code segments are modified or provide auto-approve for less critical code segments, which will reduce long-term development maintenance. The disclosed systems and methods may be integrated with deployment and configuration management platforms to alert operations and service delivery personnel when configuration items are modified or auto-approve non-critical changes. The disclosed systems and methods may be used in test-automation, which may reduce time to release. The disclosed systems and methods may be used with incident management to alert incident handlers about potentially code-related or change-related incidents and provide valuable information to improve speed of resolution.

The present disclosure relates to methods and systems for training and using a machine-learning based model to reduce and troubleshoot incidents in a system and, more particularly, to training and using a machine-learning based model to determine a risk level for a proposed modification to a system.

The subject matter of the present disclosure will now be described more fully with reference to the accompanying drawings that show, by way of illustration, specific exemplary embodiments. An embodiment or implementation described herein as "exemplary" is not to be construed as preferred or advantageous, for example, over other embodiments or implementations; rather, it is intended to reflect or indicate that the embodiment(s) is/are "example" embodiment(s). Subject matter may be embodied in a variety of different forms and, therefore, covered or claimed subject matter is intended to be construed as not being limited to any exemplary embodiments set forth herein; exemplary embodiments are provided merely to be illustrative. Likewise, a reasonably broad scope for claimed or covered subject matter is intended. Among other things, for example, subject matter may be embodied as methods, devices, components, or systems. Accordingly, embodiments may, for example, take the form of hardware, software, firmware or any combination thereof (other than software per se). The following detailed description is, therefore, not intended to be taken in a limiting sense.

Throughout the specification and claims, terms may have nuanced meanings suggested or implied in context beyond an explicitly stated meaning. Likewise, the phrase "in one embodiment" as used herein does not necessarily refer to the same embodiment and the phrase "in another embodiment" as used herein does not necessarily refer to a different embodiment. It is intended, for example, that claimed subject matter include combinations of exemplary embodiments in whole or in part.

The terminology used below may be interpreted in its broadest reasonable manner, even though it is being used in conjunction with a detailed description of certain specific examples of the present disclosure. Indeed, certain terms may even be emphasized below; however, any terminology intended to be interpreted in any restricted manner will be overtly and specifically defined as such in this Detailed Description section.

<FIG> depicts an exemplary system overview for risk aware software development and information technology operations (DevOps) using machine learning techniques, according to one or more embodiments.

As shown in <FIG>, a Risk Aware System <NUM> may receive information over network <NUM> from DevOps System <NUM>. DevOps System <NUM> may include at least one of an intake system <NUM>, a development system <NUM>, a release system <NUM>, a deployment system <NUM>, or an incident reporting system <NUM>. The Risk Aware System <NUM> may use machine learning techniques to analyze the received information and display information on display <NUM>.

As an example, when a potential code segment upgrade is submitted into a system for approval, an API may be triggered to send metadata associated with the code segment to the AI engine residing in the cloud, which analyzes the metadata using a trained model, and may provide an alert and/or risk rating to a UI.

Here, the API may be exposed in a Cloud Environment Service and integrated/called from the DevOps system or code repository when new code would be checked in to the repository. Generally, code may be centrally organized in a managed/protected code repository. Metadata may be part of the "code commit". A file is changed by a developer and then committed and pushed into the central repository. The code repository tracks metadata of the commit such as user-name, file change, exact code modified/added/removed, dependencies of the code, timestamp, and reason for code change, for example. Metadata may be different across code repository platforms, but generally consists of the same core fields. The system includes the code repository (database) and also an "analytics database" that would be leveraged for visualization/UI display. In a real-time solution, each code update would trigger either an update to that analytics database directly or have a daily/weekly batch up.

One of the machine learning techniques that may be useful and effective for the analysis is a neural network, which is a type of supervised machine learning. Nonetheless, it should be noted that other machine learning techniques and frameworks may be used to perform the methods contemplated by the present disclosure. For example, the systems and methods may be realized using other types of supervised machine learning such as regression problems, random forest, etc., using unsupervised machine learning such as cluster algorithms, principal component analysis (PCA), etc., and/or using reinforcement learning.

The displayed information may include a determined risk level <NUM> for a first product in DevOps System <NUM>, a determined risk level <NUM> for a second product in DevOps System <NUM>, and a determined risk level <NUM> for a third product in DevOps System <NUM>. The displayed information may also include specific alerts, e.g., an alert <NUM> and alert <NUM>. Alert <NUM> may provide a first alert identifying, for example, a first proposed modification to DevOps System <NUM>, may provide a first suggested action for reducing, for example, the determined risk level for the first proposed modification to the DevOps System <NUM>, and may provide the determined risk level as a first score from <NUM> to <NUM>. Alert <NUM> may provide a second alert identifying, for example, a second proposed modification to DevOps System <NUM>, may provide a second suggested action for reducing, for example, the determined risk level for the second proposed modification to the DevOps System <NUM>, and may provide the determined risk level as a second score from <NUM> to <NUM>. The first and second proposed modifications may include at least one of a modification of a hardware component or a software component of DevOps System <NUM>.

<FIG> depicts a flowchart of a method <NUM> for training a machine-learning based model, according to one or more embodiments.

As shown in <FIG>, in operation <NUM>, the Risk Aware System <NUM> may receive first metadata regarding a previous modification to DevOps System <NUM>, and in operation <NUM>, may extract a first feature from the received first metadata. In operation <NUM>, the Risk Aware System <NUM> may receive second metadata regarding a previous incident related to the previous modification occurring in the DevOps System <NUM>, and in operation <NUM>, may extract a second feature from the received second metadata.

As an example, the first and second metadata may be provided from a database including first incident reports with information for each incident provided with an incident number, closed date/time, category, close code, close note, long description, short description, root cause, and assignment group. As an example, the first and second metadata may be provided from a database including second incident reports with information for each incident provided with an issue key, description, summary, label, issue type, fix version, environment, author, and comments. As an example, the first and second metadata may be provided from a database including third incident reports with information for each incident provided with a file name, script name, script type, script description, display identifier, message, committer type, committer link, properties, file changes, and branch information. These are merely examples of information that may be used as metadata, and the disclosure is not limited to these examples.

In operation <NUM>, the Risk Aware System <NUM> may train the machine-learning based model to learn an association between the previous modification and the previous incident related to the previous modification, based on the extracted first feature and the extracted second feature. In operation <NUM>, the Risk Aware System <NUM> may automatically determine a risk level for the previous modification based on the extracted first feature, by using the trained machine-learning based model, based on the learned association between the previous modification and the previous incident related to the previous modification.

Here, topic modeling, such as Latent Dirichlet Allocation or Neural Topic Modeling, and clustering, such as Bidirectional Encoder Representations from Transformers or Hierarchical Density-Based Spatial Clustering of Applications with Noise, for example, may be performed using metadata from a variety of sources to create clusters. Unsupervised learning may be done for incident descriptions, resolution notes, issue tracking tickets, and code repository commit messages, for example. Auto-labeling of the created clusters may be performed using topic modeling. The finalized clusters may be used as classes to train a supervised classifier model. Because the amount of data may be massive, various Deep Learning models such as Artificial Neural Network, Recurrent Neural Networks, and Long-Short Term Memory may be used. Using the final classification tags from the supervised model, an incident journey may be mapped. These are merely examples of a machine-learning based model, and the disclosure is not limited to these examples.

<FIG> depicts a flowchart of a method <NUM> for determining a risk level for a proposed modification to a DevOps System <NUM>, not forming part of the claimed subject matter.

As shown in <FIG>, in operation <NUM>, the Risk Aware System <NUM> may receive metadata regarding the proposed modification to the DevOps System <NUM>, and in operation <NUM>, may extract a feature from the received metadata, the extracted feature corresponding to a feature of a trained machine-learning based model for determining the risk level for the proposed modification based on a learned association between the extracted feature and an incident occurring in the DevOps System <NUM>. In operation <NUM>, the Risk Aware System <NUM> may automatically determine the risk level for the proposed modification based on the extracted feature, by using the trained machine-learning based model that was trained based on a first feature extracted from metadata regarding a previous modification to the DevOps System <NUM> and a second feature extracted from metadata regarding a previous incident related to the previous modification occurring in the DevOps System <NUM>, based on the learned association between the extracted feature and the incident occurring in the DevOps System <NUM>.

The risk level may be determined using dynamic thresholds (not fixed thresholds) that can vary by application/platform/code repository and change over time and/or by use of a multi-class (e.g. <NUM>-class) classification model (machine-learning/statistical model based) approach that would have more flexibility than a traditional single value/dimension approach.

In operation <NUM>, the Risk Aware System <NUM> may provide an alert identifying the determined risk level for the proposed modification to the DevOps System <NUM>. In operation <NUM>, the Risk Aware System <NUM> may provide a suggested action for reducing the determined risk level for the proposed modification to the DevOps System <NUM>. In operation <NUM>, the Risk Aware System <NUM> may block the proposed modification from being implemented when the determined risk level is above a predetermined threshold. In operation <NUM>, the Risk Aware System <NUM> may provide the determined risk level as a score from <NUM> to <NUM>.

Risk Aware System <NUM> may provide a risk identification model that will predict the degree of risk for every code change/commit. This may be accomplished by using the incident journey, so that the system may reverse engineer and identify the patterns in incoming incidents due to code changes, by training a risk classification model that will tag the code changes to a risk degree, and by using a threshold analysis for setting the risk degrees such as <NUM> Interquartile Range / <NUM> Interquartile Range and Receiver Operating Characteristic curve analysis. The thresholds may be dynamic and specific for a particular Assignment Group. The model may identify risks proactively in real-time as incident, issue ticket, and script data are collected.

Risk Aware System <NUM> may provide a model that can proactively suggest code changes/resolutions for incoming incidents, by building a classification / probability prediction (for example, Multi-Layer Perceptron, Logistic Regression, or Artificial Neural Network) model to identify whether a new incident is code change related or not. If a new incident is code change related, the incident journey may be used to identify which part of the code that needs to be changed to fix the issue. In the code, the incident journey may identify which branch, file, or class or module should be changed.

<FIG> depicts a flowchart of a method <NUM> for determining a risk level for a proposed modification to code of a software component of a DevOps System <NUM>, forming part of the claimed subject matter.

As shown in <FIG>, in operation <NUM>, the Risk Aware System <NUM> receives metadata regarding the proposed modification to code of the software component of the DevOps System <NUM>, and in operation <NUM>, extracts a feature from the received metadata, the extracted feature corresponding to a feature of a trained machine-learning based model for determining the risk level for the proposed modification based on a learned association between the extracted feature and an incident occurring in the DevOps System <NUM>. In operation <NUM>, the Risk Aware System <NUM> automatically determines the risk level for the proposed modification based on the extracted feature, by using the trained machine-learning based model that was trained based on a first feature extracted from metadata regarding a previous modification to the DevOps System <NUM> and a second feature extracted from metadata regarding a previous incident related to the previous modification occurring in the DevOps System <NUM>, based on the learned association between the extracted feature and the incident occurring in the DevOps System <NUM>.

In operation <NUM>, the Risk Aware System <NUM> determines whether the code is a critical code segment or a non-critical code segment. In operation <NUM>, the Risk Aware System <NUM> provides a suggested action for reducing the determined risk level for the proposed modification when the code is determined to be a non-critical code segment and the determined risk level is above a non-critical code predetermined threshold. In operation <NUM>, the Risk Aware System <NUM> blocks the proposed modification from being implemented when the code is determined to be a critical code segment and the determined risk level is above a critical code predetermined threshold.

<FIG> illustrates an implementation of a general computer system that may execute techniques presented herein.

Unless specifically stated otherwise, as apparent from the following discussions, it is appreciated that throughout the specification, discussions utilizing terms such as "processing," "computing," "calculating," "determining", analyzing" or the like, refer to the action and/or processes of a computer or computing system, or similar electronic computing device, that manipulate and/or transform data represented as physical, such as electronic, quantities into other data similarly represented as physical quantities.

A "computer," a "computing machine," a "computing platform," a "computing device," or a "server" may include one or more processors.

<FIG> illustrates an implementation of a computer system <NUM>. The computer system <NUM> can include a set of instructions that can be executed to cause the computer system <NUM> to perform any one or more of the methods or computer based functions disclosed herein. The computer system <NUM> may operate as a standalone device or may be connected, e.g., using a network, to other computer systems or peripheral devices.

In a networked deployment, the computer system <NUM> may operate in the capacity of a server or as a client user computer in a server-client user network environment, or as a peer computer system in a peer-to-peer (or distributed) network environment. The computer system <NUM> can also be implemented as or incorporated into various devices, such as a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile device, a palmtop computer, a laptop computer, a desktop computer, a communications device, a wireless telephone, a land-line telephone, a control system, a camera, a scanner, a facsimile machine, a printer, a pager, a personal trusted device, a web appliance, a network router, switch or bridge, or any other machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. In a particular implementation, the computer system <NUM> can be implemented using electronic devices that provide voice, video, or data communication. Further, while a computer system <NUM> is illustrated as a single system, the term "system" shall also be taken to include any collection of systems or sub-systems that individually or jointly execute a set, or multiple sets, of instructions to perform one or more computer functions.

As illustrated in <FIG>, the computer system <NUM> may include a processor <NUM>, e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both. The processor <NUM> may be a component in a variety of systems. For example, the processor <NUM> may be part of a standard personal computer or a workstation. The processor <NUM> may be one or more general processors, digital signal processors, application specific integrated circuits, field programmable gate arrays, servers, networks, digital circuits, analog circuits, combinations thereof, or other now known or later developed devices for analyzing and processing data. The processor <NUM> may implement a software program, such as code generated manually (i.e., programmed).

The computer system <NUM> may include a memory <NUM> that can communicate via a bus <NUM>. The memory <NUM> may be a main memory, a static memory, or a dynamic memory. The memory <NUM> may include, but is not limited to computer readable storage media such as various types of volatile and non-volatile storage media, including but not limited to random access memory, read-only memory, programmable read-only memory, electrically programmable read-only memory, electrically erasable read-only memory, flash memory, magnetic tape or disk, optical media and the like. In one implementation, the memory <NUM> includes a cache or random-access memory for the processor <NUM>. In alternative implementations, the memory <NUM> is separate from the processor <NUM>, such as a cache memory of a processor, the system memory, or other memory. The memory <NUM> may be an external storage device or database for storing data. Examples include a hard drive, compact disc ("CD"), digital video disc ("DVD"), memory card, memory stick, floppy disc, universal serial bus ("USB") memory device, or any other device operative to store data. The memory <NUM> is operable to store instructions executable by the processor <NUM>. The functions, acts or tasks illustrated in the figures or described herein may be performed by the processor <NUM> executing the instructions stored in the memory <NUM>. The functions, acts or tasks are independent of the particular type of instructions set, storage media, processor or processing strategy and may be performed by software, hardware, integrated circuits, firm-ware, microcode and the like, operating alone or in combination. Likewise, processing strategies may include multiprocessing, multitasking, parallel processing and the like.

As shown, the computer system <NUM> may further include a display <NUM>, such as a liquid crystal display (LCD), an organic light emitting diode (OLED), a flat panel display, a solid-state display, a cathode ray tube (CRT), a projector, a printer or other now known or later developed display device for outputting determined information. The display <NUM> may act as an interface for the user to see the functioning of the processor <NUM>, or specifically as an interface with the software stored in the memory <NUM> or in the drive unit <NUM>.

Additionally or alternatively, the computer system <NUM> may include an input device <NUM> configured to allow a user to interact with any of the components of computer system <NUM>. The input device <NUM> may be a number pad, a keyboard, or a cursor control device, such as a mouse, or a joystick, touch screen display, remote control, or any other device operative to interact with the computer system <NUM>.

The computer system <NUM> may also or alternatively include drive unit <NUM> implemented as a disk or optical drive. The drive unit <NUM> may include a computer-readable medium <NUM> in which one or more sets of instructions <NUM>, e.g. software, can be embedded. Further, the instructions <NUM> may embody one or more of the methods or logic as described herein. The instructions <NUM> may reside completely or partially within the memory <NUM> and/or within the processor <NUM> during execution by the computer system <NUM>. The memory <NUM> and the processor <NUM> also may include computer-readable media as discussed above.

In some systems, a computer-readable medium <NUM> includes instructions <NUM> or receives and executes instructions <NUM> responsive to a propagated signal so that a device connected to a network <NUM> can communicate voice, video, audio, images, or any other data over the network <NUM>. Further, the instructions <NUM> may be transmitted or received over the network <NUM> via a communication port or interface <NUM>, and/or using a bus <NUM>. The communication port or interface <NUM> may be a part of the processor <NUM> or may be a separate component. The communication port or interface <NUM> may be created in software or may be a physical connection in hardware. The communication port or interface <NUM> may be configured to connect with a network <NUM>, external media, the display <NUM>, or any other components in computer system <NUM>, or combinations thereof. The connection with the network <NUM> may be a physical connection, such as a wired Ethernet connection or may be established wirelessly as discussed below. Likewise, the additional connections with other components of the computer system <NUM> may be physical connections or may be established wirelessly. The network <NUM> may alternatively be directly connected to a bus <NUM>.

While the computer-readable medium <NUM> is shown to be a single medium, the term "computer-readable medium" may include a single medium or multiple media, such as a centralized or distributed database, and/or associated caches and servers that store one or more sets of instructions. The term "computer-readable medium" may also include any medium that is capable of storing, encoding, or carrying a set of instructions for execution by a processor or that cause a computer system to perform any one or more of the methods or operations disclosed herein. The computer-readable medium <NUM> may be non-transitory, and may be tangible.

The computer-readable medium <NUM> can include a solid-state memory such as a memory card or other package that houses one or more non-volatile read-only memories. The computer-readable medium <NUM> can be a random-access memory or other volatile rewritable memory. Additionally or alternatively, the computer-readable medium <NUM> can include a magneto-optical or optical medium, such as a disk or tapes or other storage device to capture carrier wave signals such as a signal communicated over a transmission medium. A digital file attachment to an e-mail or other self-contained information archive or set of archives may be considered a distribution medium that is a tangible storage medium. Accordingly, the disclosure is considered to include any one or more of a computer-readable medium or a distribution medium and other equivalents and successor media, in which data or instructions may be stored.

In an alternative implementation, dedicated hardware implementations, such as application specific integrated circuits, programmable logic arrays and other hardware devices, can be constructed to implement one or more of the methods described herein. Applications that may include the apparatus and systems of various implementations can broadly include a variety of electronic and computer systems. One or more implementations described herein may implement functions using two or more specific interconnected hardware modules or devices with related control and data signals that can be communicated between and through the modules, or as portions of an application-specific integrated circuit.

The computer system <NUM> may be connected to a network <NUM>. The network <NUM> may define one or more networks including wired or wireless networks. The wireless network may be a cellular telephone network, an <NUM>, <NUM>, <NUM>, or WiMAX network. Further, such networks may include a public network, such as the Internet, a private network, such as an intranet, or combinations thereof, and may utilize a variety of networking protocols now available or later developed including, but not limited to TCP/IP based networking protocols. The network <NUM> may include wide area networks (WAN), such as the Internet, local area networks (LAN), campus area networks, metropolitan area networks, a direct connection such as through a Universal Serial Bus (USB) port, or any other networks that may allow for data communication. The network <NUM> may be configured to couple one computing device to another computing device to enable communication of data between the devices. The network <NUM> may generally be enabled to employ any form of machine-readable media for communicating information from one device to another. The network <NUM> may include communication methods by which information may travel between computing devices. The network <NUM> may be divided into sub-networks. The sub-networks may allow access to all of the other components connected thereto or the sub-networks may restrict access between the components. The network <NUM> may be regarded as a public or private network connection and may include, for example, a virtual private network or an encryption or other security mechanism employed over the public Internet, or the like.

In accordance with various implementations of the present disclosure, the methods described herein may be implemented by software programs executable by a computer system. Further, in an exemplary, non-limited implementation, implementations can include distributed processing, component/object distributed processing, and parallel processing.

Although the present specification describes components and functions that may be implemented in particular implementations with reference to particular standards and protocols, the disclosure is not limited to such standards and protocols. For example, standards for Internet and other packet switched network transmission (e.g., TCP/IP, UDP/IP, HTML, HTTP) represent examples of the state of the art.

It will be understood that the steps of methods discussed are performed in one embodiment by an appropriate processor (or processors) of a processing (i.e., computer) system executing instructions (computer-readable code) stored in storage. It will also be understood that the disclosure is not limited to any particular implementation or programming technique and that the disclosure may be implemented using any appropriate techniques for implementing the functionality described herein. The disclosure is not limited to any particular programming language or operating system.

It should be appreciated that in the above description of exemplary embodiments of the disclosure, various features of the disclosure are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the various inventive aspects. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed disclosure requires more features than are expressly recited in each claim. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this disclosure.

Furthermore, while some embodiments described herein include some but not other features included in other embodiments, combinations of features of different embodiments are meant to be within the scope of the disclosure, and form different embodiments, as would be understood by those skilled in the art.

Furthermore, an element described herein of an apparatus embodiment is an example of a means for carrying out the function performed by the element for the purpose of carrying out the disclosure.

However, it is understood that embodiments of the disclosure may be practiced without these specific details.

Similarly, it is to be noticed that the term coupled, when used in the claims, should not be interpreted as being limited to direct connections only. The terms "coupled" and "connected," along with their derivatives, may be used. Thus, the scope of the expression a device A coupled to a device B should not be limited to devices or systems wherein an output of device A is directly connected to an input of device B. It means that there exists a path between an output of A and an input of B which may be a path including other devices or means. "Coupled" may mean that two or more elements are either in direct physical or electrical contact, or that two or more elements are not in direct contact with each other but yet still co-operate or interact with each other.

Claim 1:
A method (<NUM>) for training a machine-learning based model, the method comprising, performing by one or more processors, operations including:
receiving (<NUM>) first metadata regarding a previous modification to a system;
extracting (<NUM>) a first feature from the received first metadata;
receiving (<NUM>) second metadata regarding a previous incident related to the previous modification occurring in the system;
extracting (<NUM>) a second feature from the received second metadata;
training (<NUM>) the machine-learning based model to learn an association between the previous modification and the previous incident related to the previous modification, based on the extracted first feature and the extracted second feature; and
automatically determining a risk level for the previous modification (<NUM>) based on the extracted first feature, by using the trained machine-learning based model, based on the learned association between the previous modification and the previous incident related to the previous modification;
the method further characterized in that
the previous modification includes a modification to code of a software component of the system and the machine-learning based model is trained to reduce a risk level for a proposed modification to the system when the code is determined to be a critical code segment and the risk level is above a critical code predetermined threshold by determining blocking the previous modification, and to reduce the risk level for the previous modification when the code is of a non-critical code segment and the risk level is above a non-critical code predetermined threshold by determining a suggested action for reducing the determined risk level.