Anomaly Detection System for Application Threads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to effectively detect anomalies during the development and testing phases of applications, leading to unnoticed exceptions that can cause disastrous issues in production environments due to large log sizes and overlooked errors.
Innovation Solution
A processor-implemented method and system for anomaly detection that captures and arranges metrics associated with application threads and methods in a data structure, identifying anomalies such as un-exited, exception, and user-defined anomalies based on predetermined conditions, enabling corrective actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If developers log anomalies in log files for tracking purposes, then anomaly detection capability is improved, but log sizes become huge making it difficult to identify anomalies
Solution Approach 1:
The patent extracts only the essential anomaly information from the application runtime and stores it in a structured data structure, rather than logging all runtime details. This selective extraction maintains anomaly detection capability while avoiding the accumulation of huge log files that make identification difficult.
Solution Approach 2:
The patent transforms anomaly data from a flat log file format into a multi-dimensional data structure with organized hierarchies (application-level, module-level, method-level anomalies). This dimensional reorganization enables efficient querying and identification of anomalies without requiring developers to search through massive log files.
2Measurement precision
If developers manually track anomalies in log files, then anomaly identification is possible, but time consumption increases and anomalies may be overlooked
Solution Approach 1:
The system automatically detects, classifies, and organizes anomalies into a structured data structure during application runtime, eliminating the need for manual log analysis. The anomaly detection mechanism serves itself by continuously monitoring and recording anomalies without requiring developer intervention, thus improving identification accuracy while reducing time consumption.
Solution Approach 2:
The patent implements a feedback mechanism where the system continuously monitors application runtime, compares actual behavior against expected patterns, and automatically identifies deviations as anomalies. This automated feedback loop enables real-time anomaly detection without manual intervention, significantly reducing analysis time while maintaining high identification accuracy.
3Reliability
If comprehensive logging is performed to capture all anomalies, then detection coverage is improved, but system complexity increases
Solution Approach 1:
The patent segments the anomaly detection system into distinct hierarchical levels (application-level, module-level, method-level), with each level having its own structured data storage. This segmentation enables comprehensive anomaly coverage across all levels while keeping each segment's complexity manageable through organized, modular data structures.
4Ease of manufacture
If log files are used for anomaly tracking, then anomaly recording is simple, but incomplete execution of modules may go unnoticed
Solution Approach 1:
The system automatically instruments application modules to self-report their execution status and anomalies to the structured data structure. This self-service mechanism ensures that even incomplete or erroneous module executions are captured and recorded, maintaining reliability while requiring minimal changes to the original application code.
Data Source
AI summary
This disclosure relates generally to anomaly detection, and more particularly to system and method for detecting anomalies. In one embodiment, the method includes executing at least one thread associated with the application. Executing the at least one thread results in invoking one or more methods associated with the at least one thread. During the execution metrics associated with the one or more methods are captured. The metrics are systematically arranged in a data structure to represent a plurality of thread-method pairs and the metrics corresponding to each of the plurality of thread-method pairs. One or more anomalies associated with the one or more methods are identified from the data structure based on a detection of at least one predetermined condition in the data structure. An anomaly of the one or more anomalies includes one of un-exited anomaly, an exception anomaly and a user-defined anomaly.