Budget Overspending Attribution System

Abstract

A budget overspending attribution system is disclosed, suitable for communicating with a budget alarm receiving server, a log database server, and a user-end electronic device. The system is configured to: receive budget alarm data from the budget alarm server, the budget alarm data including a project identification code and an alarm time point; calculate a preset time interval based on the alarm time point; transmit a query request containing the project identification code and the preset time interval to the log database server, and receive multiple log records returned by the log database server; generate a budget attribution report using a pre-trained large-scale language model based on the budget alarm data and the log data; and output the budget attribution report to the user-end electronic device.

Description

Budget Overspending Attribution System Technical Field

[0001] This invention relates to a system, and more particularly to a budget overrun attribution system for cloud services. Prior Technology

[0002] Existing cloud service systems can monitor project or departmental expense usage and generate alerts when expenses exceed preset thresholds. However, these systems only provide notifications of expense anomalies without further analysis of the technical causes. Therefore, technical personnel still need to manually query multiple system logs and resource usage records to deduce possible causes of expense anomalies. This process involves cross-system data integration and manual judgment, which is time-consuming and inefficient.

[0003] Therefore, how to develop a system that can automatically perform cost anomaly attribution analysis when budget alerts occur has become the subject of this new invention. Summary of the Invention

[0004] Therefore, the purpose of this invention is to provide a budget overrun attribution system that improves upon the inconveniences of existing technologies.

[0005] This novel budget overspending attribution system is suitable for communication with a budget alarm receiving server, a log database server, and a user-end electronic device. The system includes a processing unit and a storage unit electrically connected to the processing unit. The storage unit stores a pre-trained large-scale language model pre-trained using machine learning techniques. The processing unit receives budget alarm data from the budget alarm server, including a project identification code and an alarm time point. Based on the alarm time point, the processing unit calculates a preset time interval. The processing unit transmits a query request containing the project identification code and the preset time interval to the log database server and receives multiple log records corresponding to the query request from the log database server. Based on the budget alarm data and the log data, the processing unit uses the pre-trained large-scale language model to generate a budget attribution report, which includes a root cause summary. The processing unit outputs the budget attribution report to the user-end electronic device.

[0006] In some implementations of this novel budget overrun attribution system, the log data includes multiple event logs. The processing unit establishes a relational graph model based on the budget alarm data and the event logs. This model includes multiple event nodes corresponding to the event logs, indicator nodes corresponding to the budget alarm data, and multiple directed edges representing the temporal or logical relationships between the event nodes and the indicator nodes. The processing unit analyzes the relational graph model using a graph theory algorithm to calculate a correlation score for each event node relative to the indicator node. Based on the correlation scores, the processing unit sorts the event logs corresponding to the event nodes. Finally, based on the budget alarm data and the sorted event logs, the processing unit uses a pre-trained large-scale language model to generate the budget attribution report.

[0007] In some implementations of this novel budget overspending attribution system, the storage unit also stores historical cost data corresponding to the project identification code and a budget threshold value. Based on the historical cost data, the processing unit uses a time series prediction algorithm to generate a predicted cost curve corresponding to the project identification code. The predicted cost curve includes multiple predicted cost values ​​corresponding to multiple future time points. The processing unit determines whether any of the predicted cost values ​​is greater than the budget threshold value. When it is determined that any of the predicted cost values ​​is greater than the budget threshold value, the processing unit outputs an early warning notification to the user's electronic device.

[0008] In some implementations of this novel budget overrun attribution system, the log data contains a variety of characteristic information, including at least one of the following: identity and access characteristics, time and behavior sequence characteristics, request and response content characteristics, and system and environment status characteristics.

[0009] The advantages of this new system are as follows: After receiving budget alarm data from the budget alarm server, the system automatically calculates a preset time interval prior to the alarm time. It then sends a query request containing the project identifier and the preset time interval to the log database server to receive the log data. A pre-trained large-scale language model is used to perform semantic integration and causal analysis on the budget alarm data and log data, generating a budget attribution report that includes a root cause summary, key evidence, and corresponding countermeasures. Furthermore, the system can output an early warning notification when any predicted cost value exceeds the budget threshold, alerting users to potential future cost anomalies. This allows users to investigate potential problems, optimize resources, or apply for temporary budgets, achieving a preventative effect. Therefore, this case can integrate the budget alert mechanism with the log analysis process. Upon receiving an abnormal expense event, it can automatically trigger subsequent log retrieval and attribution analysis procedures to generate a budget attribution report that includes a summary of the root cause, key evidence, and countermeasures. This avoids the time spent manually searching and comparing log information one by one, allowing users to directly grasp the possible causes of expense anomalies. Simple Explanation of the Diagram

[0010] Other features and benefits of this invention will be clearly presented in the embodiments with reference to the drawings.

[0011] Figure 1 is a block diagram illustrating an embodiment of the novel budget overspending attribution system.

[0012] Figure 2 is a flowchart illustrating, by way of example, how a budget alarm attribution procedure is implemented in a budget overrun attribution method in this embodiment.

[0013] Figure 3 is a flowchart illustrating, by way of example, how a budget warning procedure is implemented in a budget overspending attribution method in this embodiment. Implementation

[0014] Before this invention is described in detail, it should be noted that, unless otherwise defined, the term "electrically connected" in this patent specification refers to the "coupled" relationship between computer hardware (such as electronic systems, devices, apparatuses, units, and components), and broadly refers to "wired electrical connections" achieved by physically connecting multiple computer hardware components through conductor / semiconductor materials, and "radio connections" that achieve wireless data transmission using wireless communication technologies (such as, but not limited to, wireless networks, Bluetooth, and electromagnetic induction). On the other hand, unless otherwise defined, the term "electrical connection" in this patent specification also broadly refers to "direct electrical connections" achieved by directly coupling multiple computer hardware components to each other, and "indirect electrical connections" achieved by indirectly coupling multiple computer hardware components through other computer hardware components.

[0015] Before this invention is described in detail, it should be noted that the term "unit" in this patent specification refers to computer hardware, not software. For example, "processing unit" refers to computer hardware with data processing capabilities. Furthermore, the term "unit" in this patent specification can refer to a single piece of computer hardware with a specific function, or it can refer to a group of computer hardware with similar functions. For example, "processing unit" can refer to a single processor with data processing capabilities, but it can also refer to a collection of processors.

[0016] Referring to Figure 1, one embodiment of the novel budget overspending attribution system 100 is adapted to communicate with a budget alarm receiving server 200, a log database server 300, and a user-end electronic device 400. The budget alarm receiving server 200 can be, for example, a physical or virtual server device, used to receive budget alarm data sent from external monitoring systems or financial management systems via API calls or message queue mechanisms. The log database server 300 can be, for example, a server device with data storage and retrieval functions, used to centrally store system log data from various sources, such as resource consumption logs, application operation records, event logs, error messages, and performance monitoring data, but is not limited thereto. The user-end electronic device 400 can be a mobile phone, tablet computer, laptop computer, or desktop computer.

[0017] In this embodiment, the budget overspending attribution system 100 is a server device, and the budget overspending attribution system 100 includes a processing unit 1 and a storage unit 2 electrically connected to the processing unit 1. Furthermore, the processing unit 1 is electrically connected via a network to the budget alarm receiving server 200, the log database server 300, and the user electronic device 400.

[0018] In this embodiment, the processing unit 1 is a processor implemented with integrated circuitry and possessing data processing and instruction transmission / reception functions. However, in different embodiments, the processing unit 1 may also be a circuit assembly including a processor and a circuit board, or a collection of multiple processors. The storage unit 2 is a data storage device (e.g., a hard disk) for storing digital data. However, in different embodiments, the storage unit 2 may also be a collection of multiple storage devices of the same or different types.

[0019] Furthermore, in other embodiments, the budget overrun attribution system 100 can also be implemented as multiple electrically connected server devices. In this case, the processing unit 1 can be implemented as a collection of multiple processors / circuit components each of the server devices, and the storage unit 2 can be implemented as a collection of multiple storage devices each of the server devices. Based on the above, the actual implementation of the budget overrun attribution system 100 in terms of computer hardware is not limited to this embodiment.

[0020] In this embodiment, the storage unit 2 stores a pre-trained large language model M that has been pre-trained using machine learning technology.

[0021] The pre-trained large language model M is, for example, a large language model (LLM) implemented using neural network technology. This large language model is pre-trained using supervised deep learning, for example, based on multiple budget overrun events and multiple root cause analysis reports corresponding to those budget overrun events as training data. Each budget overrun event includes a budget overrun warning and a corresponding system log data. The standard root cause analysis report, written by experts, indicates the root cause of the budget overrun warning and provides quantitative evidence. Furthermore, this large-scale language model includes, but is not limited to, generative pre-trained transformers (GPT) language models, GPT-2 language models, GPT-3 language models, GPT-4 language models, ChatGPT language models, Claude language models, Gemini language models, language models for dialogue applications (also known as LaMDA), or LLaMA (Large Language Model Meta AI), but is not limited thereto. It should be understood that the training method of this pre-trained large-scale language model M and the specific algorithms employed are not the focus of this patent specification, and therefore their details will not be elaborated upon here.

[0022] The following exemplarily illustrates how the budget overspending attribution system 100 of this embodiment implements a budget overspending attribution method. In this embodiment, the budget overspending attribution method includes, for example, a budget alarm attribution procedure and a budget warning procedure.

[0023] Referring to Figures 1 and 2, the following section will first explain the budget alarm attribution procedure of this budget overspending attribution method.

[0024] First, in step S11, the processing unit 1 receives budget alarm data from the budget alarm server. The budget alarm data includes a project identification code, a total budget indicating the budget limit amount, an actual expenditure indicating the cumulative amount spent at the time the alarm occurred, an alarm time point, and an overspending amount indicating the difference between the actual expenditure and the total budget.

[0025] After the processing unit 1 obtains the budget alarm data, the process proceeds to step S12.

[0026] In step S12, the processing unit 1 calculates a preset time interval based on the alarm time point. In this embodiment, the preset time interval is, for example, a preset time range before the alarm time point (e.g., the previous two hours).

[0027] After the processing unit 1 calculates the preset time interval, the process proceeds to step S13.

[0028] In step S13, the processing unit 1 transmits a query request containing the project identification code and the preset time interval to the log database server 300, and receives multiple log data corresponding to the query request from the log database server 300.

[0029] In this embodiment, the log data may consist of multiple system records related to the project identification code and the preset time interval. In addition to resource consumption information such as server usage, API call counts, cloud resource consumption, storage space usage, network traffic, or database read / write counts, the log data may also include various feature information to support subsequent correlation analysis and attribution determination. These feature information include at least one of the following: identity and access characteristics, time and behavior sequence characteristics, request and response content characteristics, and system and environment status characteristics.

[0030] Specifically, the characteristic information related to identity and access features includes user identification code / service account identification code, source IP address, and authentication information (such as API key, OAuth token, etc.). Among them, the user identification code / service account identification code is used to indicate "which user" or "which automated service account" performed the operation; the source IP address is used to indicate the network address from which the request was initiated; and the authentication information is used to trace which application or script triggered a large number of costly calls.

[0031] On the other hand, the feature information related to time and behavior sequence characteristics includes timestamps, request IDs / transaction IDs, event durations / delay times, etc. Among them, timestamps are used to record the precise time when the event occurred; request IDs / transaction IDs are used to track all microservices or system components involved in a complete operation process; and event durations / delay times are used to record the processing time of a single operation or API call.

[0032] On the other hand, characteristic information related to the content of requests and responses includes HTTP methods and response status codes, resource paths, data transfer volume, and user agent information. Specifically, HTTP methods and response status codes indicate request methods such as POST and GET, and response status codes such as 200 (success), 400 (client error), and 500 (server error); the resource path indicates the specific URL or API endpoint path of the request to determine which API is being called abnormally frequently; the data transfer volume indicates the size of the request and response payload; and the user agent indicates the client information that issued the request (such as browser, operating system, automation script library, etc.).

[0033] On the other hand, characteristic information related to system and environment status includes error and warning messages, system configuration change logs, and resource utilization snapshots. Among them, error and warning messages are used to indicate the error descriptions and stack traces clearly recorded in the logs; system configuration change logs are used to record operations such as system deployment, feature flag changes, and resource quota adjustments; and resource utilization snapshots are used to indicate the instantaneous utilization of CPU, memory, and disk I / O at a specific point in time.

[0034] In some embodiments, the processing unit 1 may perform cross-resource or cross-service correlation analysis based on the aforementioned feature information to determine whether the fee anomaly originates from the project itself or is indirectly caused by the abnormal performance of shared resources.

[0035] In some embodiments, such log data includes multiple event log records, such as change records of code version control systems (e.g., Git commit records), deployment records of continuous integration / continuous deployment systems (e.g., deployment logs generated by Jenkins or other CI / CD platforms), and feature flag change records. That is, in addition to runtime metrics and system logs, such log data covers event records from multiple data sources including development, deployment, and configuration changes. Therefore, the specific implementation of such log data is not limited to this embodiment.

[0036] After the processing unit 1 obtains the log data, the process proceeds to step S14.

[0037] In step S14, the processing unit 1 uses the pre-trained large language model M to generate structured data and a budget attribution report based on the budget alarm data and the log data.

[0038] Specifically, the storage unit 2, for example, pre-stores a prompt word template, and the processing unit 1 uses the pre-trained large language model M to generate the budget attribution report based on the budget alarm data, the log data, and the prompt word template. The prompt word template includes a role and task instruction, budget alarm data, and system log data.

[0039] The role-playing instruction is, for example, "You are a senior Site Reliability Engineer (SRE). Your task is to analyze the following budget overrun alerts and related system logs, summarize the root cause of the cost anomalies in natural language, and provide key evidence and handling recommendations. Please output your analysis results in JSON format." The budget alert data is, for example, "The following is the content of the budget overrun alert for this project:", and this budget alert data includes a fill-in area for the budget alert information obtained by the processing unit 1 from the budget alert receiving server 200. The system log data is, for example, "The following are system logs related to this project retrieved from the log database server 300:", and this system log data also includes a fill-in area for the log information obtained by the processing unit 1 from the log database server 300.

[0040] In this embodiment, the structured data is a structured information containing root cause summaries and key evidence generated based on the analysis of budget alarm data and log data. Table 1 below provides an example of this structured data. Table 1: { "Root_Cause_Summary": "The root cause of the budget overrun was a large number of failed HTTP 503 errors (HTTP 503 errors) requests from user 'user_A' (source IP: 1.2.3.4) to API ' / api / v1 / process_data', triggering the client's automatic retry mechanism. Logs showed that the backend database connection pool was exhausted and unable to handle normal requests, leading to a sharp increase in computing resources and network traffic costs within a short period." "Key_Evidence": [ { "evidence_type": "Abnormal User Activity", "detail": "User 'user_A' generated over 95% of the requests to the failing API."}, { "evidence_type": "Dominant Error Code", "detail": "HTTP Status Code 503 (Service Unavailable) accounted for the majority of responses."}, { "evidence_type": "System Bottleneck", "detail": "Log message 'Database connection pool exhausted' appeared at 14:45Z, confirming the underlying issue."} ], "Suggested_Actions": [ "Immediately check and expand the connection pool limit for the database service." "Implement request rate limiting for API ' / api / v1 / process_data' to prevent a single user from crippling the service." "Optimize the client-side retry logic by employing an exponential backoff strategy." ] }

[0041] In this embodiment, the budget attribution report includes an alarm report, a root cause summary, key evidence and data indicators, and recommended countermeasures.

[0042] The alarm report includes a report title, the project identifier, the alarm time, the overspending amount, and a severity level. Table 2 below provides an example of the alarm report content. Table 2: Report Title: Proactive Budget Overspending Attribution Report Project Identifier: Project-Alpha Alarm time: 2025-10-31 14:50:00 (UTC) Overspending: 500.00 USD Severity Level: High / Medium / Low (Can be dynamically set based on the overspending percentage or amount)

[0043] The root cause summary can be illustrated in Table 3 below. Table 3: "The root cause of the cost overrun was that user 'user_A' (source IP: 1.2.3.4) experienced a large number of failed requests (HTTP 503 errors) to the API ' / api / v1 / process_data', triggering the client's automatic retry mechanism. Logs showed that the backend database connection pool was exhausted and unable to process normal requests, causing a sharp increase in computing resources and network traffic costs in a short period of time."

[0044] The key evidence and data indicators include a source of anomalous activity, a key system event, an impact indicator, and evidence of system bottlenecks. Table 4 below provides examples of these key evidence and data indicators. Table 4: Evidence categories Key Indicators Numerical / Description Source of abnormal activity Top User ID user_A Top Source IP 1.2.3.4 Critical system events Most Frequent API / api / v1 / process_data Dominant Status Code 503 Service Unavailable Influence indicators Abnormal Request Count 15,200 times (within 30 minutes) Peak Cost Time 14:30 - 15:00 Evidence of system bottlenecks Key Error Log "Database connection pool exhausted"

[0045] The recommended response includes an immediate improvement suggestion and a long-term improvement suggestion. Table 5 below provides examples of these recommended response measures. Table 5: [Immediate Action Recommendation] 1. (High Priority) Restrict Source IP: Temporarily block or restrict IP address 1.2.3.4's access to / api / v1 / process_data to immediately stop the cost from continuing to rise. 2. (High Priority) Expand Database Resources: Immediately check and expand the connection pool limit for the database service. [Long-term improvement suggestions] 1. (Medium Priority) Optimize retry logic: It is recommended that front-end or client applications adopt an exponential backoff strategy to avoid intensive retries when the service is unavailable. 2. (Low Priority) Add dedicated alerts: Set up new monitoring alerts for "Database Connection Pool Usage" to detect problems early before they escalate.

[0046] After the processing unit 1 generates the budget attribution report, the process proceeds to step S15.

[0047] In step S15, the processing unit 1 outputs the budget attribution report to the user-end electronic device 400.

[0048] However, in other embodiments, the processing unit 1 generates the budget attribution report by further comprising: the processing unit 1 establishing a correlation graph model based on the budget alarm data and the event log data, the correlation graph model including multiple event nodes corresponding to the event log data, indicator nodes corresponding to the budget alarm data, and multiple directed edges, the directed edges being used to represent the temporal or logical correlation between the event nodes and the indicator nodes; the processing unit 1 analyzing the correlation graph model using a graph theory algorithm to calculate a correlation score for each event node relative to the indicator node; the processing unit 1 sorting the event log data corresponding to the event nodes according to the magnitude of the correlation scores; and the processing unit 1 generating the budget attribution report using the pre-trained large-scale language model M based on the budget alarm data and the sorted event log data. The budget attribution report includes a root cause candidate list sorted by correlation score. Therefore, this project goes beyond the analysis of a single log source. Instead, it integrates various heterogeneous data sources, such as code version control system logs, continuous integration / continuous deployment (CI / CD) system logs, and feature switch change records. It also uses graph theory algorithms to build a cross-event relationship graph model and generates a budget attribution report based on the sorted event log data. This allows users to directly investigate potential problems from multiple upstream change events that are most likely to cause cost anomalies, effectively shortening the time required for problem localization and resolution.

[0049] Through this budget alarm attribution procedure, after receiving the budget alarm data from the budget alarm server, the processing unit 1 can automatically calculate the preset time interval before the alarm time point, and send a query request containing the project identification code and the preset time interval to the log database server 300 to receive the log data. Then, it uses the pre-trained large language model M to perform semantic integration and causal analysis on the budget alarm data and the log data, thereby generating a budget attribution report that includes a root cause summary, key evidence, and countermeasures.

[0050] Referring to Figures 1 and 3, the budget warning procedure of this budget overspending attribution method will be described below. In this embodiment, the storage unit 2 pre-stores historical cost data and a budget threshold value corresponding to the project identification code.

[0051] In step S21, the processing unit 1 generates a predicted cost curve corresponding to the project identification code based on the historical cost data using a time series prediction algorithm. The predicted cost curve includes multiple predicted cost values ​​corresponding to multiple future time points. In this embodiment, the time series prediction algorithm is, for example, a Long Short-Term Memory (LSTM) model, an Autoregressive Integrated Moving Average (ARIMA) model, and / or a time series prediction model, Prophet (Facebook Prophet), but is not limited thereto.

[0052] In step S22, the processing unit 1 determines whether any of the predicted cost values ​​is greater than the budget threshold. If the determination result is yes, the process proceeds to step S23; if the determination result is no, the process ends.

[0053] In step S23, the processing unit 1 outputs an early warning notification to the user-end electronic device 400.

[0054] Through this budget warning program, the processing unit 1 can output an early warning notification when it determines that any of the predicted cost values ​​exceeds the budget threshold, so as to warn users of potential future cost anomalies, allowing users to investigate potential problems, optimize resources, or apply for temporary budgets in advance, thus achieving the effect of prevention.

[0055] The above is an example of how the budget overspending attribution system 100 in this embodiment implements the budget overspending attribution method.

[0056] It should be noted that steps S11 to S15, steps S21 to S23, and the flowcharts of Figures 2 and 3 in this embodiment are merely illustrative of one possible implementation of the novel budget overrun attribution system 100. It should be understood that even if steps S11 to S15 and steps S21 to S23 are combined, split, or rearranged in order, if the resulting process performs similar functions and yields similar results compared to this embodiment, it still falls under the implementable state of the novel budget overrun attribution system 100. Therefore, steps S11 to S15, steps S21 to S23, and the flowcharts of Figures 2 and 3 in this embodiment are not intended to limit the scope of implementation of this invention.

[0057] In summary, the budget overspending attribution system 100, upon receiving budget alarm data from the budget alarm server, automatically calculates the preset time interval preceding the alarm time. It then sends a query request containing the project identifier and the preset time interval to the log database server 300 to receive the log data. Finally, it utilizes a pre-trained large-scale language model M to perform semantic integration and causal analysis on the budget alarm data and the log data, generating a budget attribution report that includes a root cause summary, key evidence, and corresponding countermeasures. Furthermore, the budget overspending attribution system 100 can output an early warning notification when any predicted cost value exceeds the budget threshold, alerting users to potential future cost anomalies and allowing them to proactively investigate potential problems, optimize resources, or apply for temporary budgets, thus achieving preventative measures. Therefore, this case can integrate the budget alert mechanism with the log analysis process. Upon receiving an abnormal expense event, it can automatically trigger subsequent log retrieval and attribution analysis procedures to generate a budget attribution report that includes a summary of the root cause, key evidence, and countermeasures. This avoids the time spent manually searching and comparing log information one by one, allowing users to directly grasp the possible causes of expense anomalies, thus effectively achieving the purpose of this novel approach.

[0058] However, the above description is merely an embodiment of this invention and should not be construed as limiting the scope of implementation of this invention. Any simple equivalent changes and modifications made in accordance with the scope of the patent application and the contents of the patent specification shall still fall within the scope of this invention.

[0059] 100: Budget Overrun Attribution System 1: Processing Unit 2: Storage Unit 200: Budget Alarm Receiving Server 300: Log Database Server 400: End-user electronic device M: Pre-trained large language model S11~S15: Steps S21~S23: Steps

Claims

1. A budget overspending attribution system, suitable for communicating with a budget alarm receiving server, a log database server, and a user electronic device; the budget overspending attribution system comprising: a processing unit; a storage unit electrically connected to the processing unit; the processing unit receiving budget alarm data from the budget alarm server, the budget alarm data including a project identification code; the processing unit transmitting a query request containing the project identification code to the log database server, and receiving multiple log data corresponding to the query request returned by the log database server; the processing unit generating a budget attribution report based on the budget alarm data and the log data, the budget attribution report including a root cause summary; and the processing unit outputting the budget attribution report to the user electronic device.

2. The budget overrun attribution system as described in claim 1, wherein the log data includes multiple event log data; the processing unit establishes a correlation graph model based on the budget alarm data and the event log data, the correlation graph model including multiple event nodes corresponding to the event log data, an indicator node corresponding to the budget alarm data, and multiple directed edges, the directed edges being used to represent the temporal or logical correlation between the event nodes and the indicator nodes; the processing unit analyzes the correlation graph model using a graph theory algorithm to calculate a correlation score for each event node relative to the indicator node; the processing unit sorts the event log data corresponding to the event nodes corresponding to the correlation scores according to the magnitude of the correlation scores; the processing unit generates the budget attribution report based on the budget alarm data and the sorted event log data.

3. The budget overrun attribution system as described in claim 1, wherein the storage unit further stores historical cost data corresponding to the project identification code and a budget threshold value; the processing unit generates a predicted cost curve corresponding to the project identification code based on the historical cost data using a time series prediction algorithm, the predicted cost curve including multiple predicted cost values ​​corresponding to multiple future time points; the processing unit determines whether any of the predicted cost values ​​is greater than the budget threshold value; when it is determined that any of the predicted cost values ​​is greater than the budget threshold value, the processing unit outputs an early warning notification to the user-end electronic device.

4. The budget overrun attribution system as described in claim 1, wherein the log data contains a variety of characteristic information, including at least one of identity and access characteristics, time and behavior sequence characteristics, request and response content characteristics, and system and environment status characteristics.

Images