Adaptive Rule Engine for Telemetry Data Event Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing HTTP telemetry data triaging tools lack flexibility, requiring software upgrades to add new capabilities, as they are based on fixed function implementations that cannot be changed without modifying and recompiling the code.
Innovation Solution
A flexible rule-engine based approach is introduced, where new HTTP telemetry data processing functions can be implemented by writing rules in a pre-defined syntax, allowing for different input processing and output without changing the code or recompiling, thereby enabling adaptive handling of various use cases such as security enforcement and performance monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fixed function implementations are used in telemetry data processing tools, then code stability and reliability are maintained, but adaptability and versatility are reduced
Solution Approach 1:
The patent implements a dynamic rule engine that allows the processing logic to change at runtime through configuration files and rule sets, rather than requiring code modifications. This enables the system to adapt to different telemetry data formats and processing requirements while maintaining the stability of the core engine architecture.
Solution Approach 2:
The system allows changing processing parameters and rules through configuration rather than code modification. Users can define different processing logic, filters, and transformations through configuration files, enabling adaptability to various scenarios without affecting the stable core codebase.
2Adaptability or versatility
If software upgrades are performed to add new capabilities, then adaptability is improved, but loss of time and complexity increase
Solution Approach 1:
The patent segments the processing logic into separate, modular rule sets that can be independently configured and loaded. This allows new capabilities to be added by deploying new rule configurations without upgrading the entire software system, thereby reducing the time and complexity associated with upgrades.
Solution Approach 2:
The rule engine acts as an intermediary layer between the stable core system and the variable processing requirements. New capabilities are implemented through intermediate rule configurations that can be loaded and removed without affecting the underlying stable codebase, enabling rapid adaptation without time-consuming software upgrades.
3Device complexity
If fixed function implementations are used, then device complexity is reduced, but ease of operation and flexibility are worsened
Solution Approach 1:
The system enables users to configure and modify processing logic independently through intuitive configuration files and rule editors, without requiring programming knowledge or system administrator intervention. This self-service capability maintains operational simplicity while providing extensive flexibility in processing configurations.
Data Source
AI summary
Embodiments determine event, e.g., security breach, etc., occurrence based on telemetry data. One such method receives telemetry data, e.g., data based on an HTTP transaction, and a rule associated with the telemetry data. The rule defines at least one perimeter filter and at least one deep filter for processing the telemetry data. In turn, a rule engine is modified in accordance with the received rule. The modified rule engine is configured to automatically switch between the at least one perimeter filter and the at least one deep filter. The received telemetry data is processed with the modified rule engine to determine event occurrence.