Alert Rationalization via Correlation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing incident handling approaches in cloud environments are inefficient due to the suppression of low and medium criticality alerts, lack of consistency in free text data, and reliance on coincidental grouping of alerts, leading to underutilization of critical data and increased alert fatigue.
Innovation Solution
A system and method that leverage low and medium criticality alerts by grouping them based on their relatedness using incident and alert data, determining cause-effect or peer relationships between alert categories, and establishing grouping rules for real-time alert correlation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If low and medium criticality alerts are suppressed to reduce alert volume, then alert fatigue is reduced, but valuable incident data is lost and alert value decreases
Solution Approach 1:
The patent merges low and medium criticality alerts with high criticality alerts into unified incident groups based on correlation analysis. By combining these alert types that were previously handled separately or suppressed, the system preserves valuable data from all alert levels while presenting a consolidated view that reduces fatigue. The merging is achieved through correlation metrics that identify related alerts across different criticality levels, allowing them to be grouped and analyzed together rather than treating them as isolated events.
Solution Approach 2:
The patent converts the previously harmful effect of high-volume low and medium criticality alerts (which caused alert fatigue) into a beneficial data source. By analyzing and correlating these alerts, the system transforms them from noise into valuable incident information that improves detection accuracy. The high volume of these alerts, once considered a problem, becomes the foundation for building robust correlation models and improving overall incident detection capability.
2Productivity
If coincidental grouping of alerts is used regardless of relatedness, then alert volume is reduced, but correlation accuracy decreases and false positives increase
Solution Approach 1:
The patent implements feedback mechanisms where correlation accuracy is continuously improved based on incident resolution outcomes. The system learns from whether grouped alerts actually share common causes, adjusting correlation metrics and grouping strategies accordingly. This feedback loop allows the system to refine its correlation accuracy over time, reducing false positives while maintaining efficient alert processing. The feedback comes from analyzing the relationship between grouped alerts and their actual underlying causes as determined during incident resolution.
Solution Approach 2:
The patent changes the parameters used for alert grouping from simple temporal coincidence to multi-dimensional correlation metrics. These parameters include alert relatedness scores, common cause probability, and contextual similarity measures. By changing the grouping parameters from coarse temporal buckets to fine-grained correlation-based grouping, the system maintains productivity by still consolidating alerts while dramatically improving correlation accuracy and reducing false positives through more sophisticated parameter analysis.
3Adaptability or versatility
If manual text data entry is used for incident resolution, then flexibility is maintained, but data consistency decreases and data utilization is suboptimal
Solution Approach 1:
The patent implements self-service automation where the system automatically extracts, structures, and populates incident data from multiple sources including alerts, logs, and monitoring tools. Rather than requiring manual text entry, the system serves itself by automatically gathering relevant information, correlating it with incident data, and populating structured fields. This self-service approach maintains flexibility by adapting to different data sources while ensuring consistency through automated extraction and validation processes that standardize data formatting and structure.
4Ease of manufacture
If heuristics are used for alert grouping, then implementation is simpler, but correlation accuracy is reduced and false positives increase
Solution Approach 1:
The patent replaces mechanical heuristic-based alert grouping with an automated correlation analysis system that uses computational algorithms to determine alert relationships. Instead of relying on manually crafted heuristic rules, the system substitutes a automated correlation engine that calculates relationship metrics between alerts based on multiple dimensions including temporal patterns, contextual similarity, and causal relationships. This substitution maintains implementation feasibility through automated processing while dramatically improving correlation accuracy by using data-driven algorithms rather than simplistic mechanical rules.
Data Source
AI summary
A computer-implemented method for incident management includes determining a plurality of groups of alert categories from an input of a plurality of alerts. A correlation for a pair of alert categories in at least one group from the plurality of groups of alert categories is determined. A cause-effect relationship or a peer relationship in the pair of alert categories is determined. A grouping rule is established based on the determined correlation, the determined cause-effect relationship, or the determined peer relationship.