Alert Correlation Using Deep Learning Sequence Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In complex hybrid cloud IT environments, system element failures or application downtimes trigger numerous alerts, causing chaos and resource consumption, making it challenging to cluster related alerts and identify root causes efficiently.
Innovation Solution
A method utilizing a deep learning model trained to generate alert sequences, combined with topology reinforcement to discover connections among infrastructure and software applications, enables automatic clustering of alerts and identification of their root causes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If traditional manual clustering approach is used, then alert correlation can be performed, but it requires tedious manual configuration and cannot automatically adjust to changing environment
Solution Approach 1:
The system performs self-service by automatically learning alert patterns and correlations without manual configuration. The machine learning model autonomously analyzes alert data, identifies relationships, and adapts to changing environments, eliminating the need for manual clustering rules and configuration maintenance.
Solution Approach 2:
The patent replaces manual mechanical clustering operations with automated machine learning-based alert correlation. Instead of human operators manually configuring and adjusting clustering rules, an intelligent system uses algorithms to automatically perform alert correlation, transforming a manual process into an automated intelligent one.
2Loss of information
If more alerts are monitored in hybrid cloud environment, then system visibility is improved, but alert chaos and resource consumption increase
Solution Approach 1:
The system extracts and focuses only on the most relevant alert information by using machine learning to identify correlated alerts and root causes. Instead of presenting all alerts equally, it extracts the essential patterns and relationships, filtering out noise and reducing the cognitive load on operators while maintaining comprehensive system visibility.
Solution Approach 2:
The patent merges multiple related alerts into unified correlation groups based on learned patterns and relationships. By combining alerts that are temporally or causally related, the system reduces the total number of discrete alerts operators must process, thereby reducing resource consumption and alert chaos while preserving complete system visibility.
3Productivity
If alert clustering is performed manually, then some correlation can be achieved, but it is time consuming and challenging due to environment complexity
Solution Approach 1:
The system implements feedback mechanisms where the machine learning model continuously learns from alert patterns and correlation outcomes. The model receives feedback from the changing hybrid cloud environment and adjusts its correlation logic accordingly, improving both the speed and accuracy of alert clustering over time as it adapts to new patterns and relationships.
Solution Approach 2:
The patent dynamically changes correlation parameters and thresholds based on learned patterns from the environment. Instead of using fixed clustering criteria, the system adjusts its detection parameters adaptively, allowing it to quickly identify correlations while maintaining high accuracy even as the hybrid cloud environment evolves and changes.
Data Source
AI summary
Alert correlation helps reduce the number of alerts that IT staff have to act upon. Methods include a computer program product that applies a machine driven deep learning model to effectively correlate alerts caused by a common root cause. The methods of correlation provide the user the context of the root cause for the alerts. Therefore, it helps the user to quickly identify, understand and resolve the problem thereby reducing the mean time to identification and resolution. Alerts caused by the same root cause therefor come together.