Real-Time Anomaly Detection via Event Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems in electronic devices face challenges in real-time processing due to the sheer volume of event data, leading to increased processing time, storage requirements, and network usage.
Innovation Solution
A central computer system that receives only abnormal event records from client devices, reducing the processing load by identifying and aggregating identical event sets, and sending alerts only when a predefined threshold is exceeded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all event records are sent to the central computer system for processing, then complete anomaly detection can be achieved, but processing time increases and system scalability deteriorates
Solution Approach 1:
The system divides the anomaly detection process into two segments: client devices perform local filtering to identify abnormal event sets before transmission, while the central computer system focuses on aggregating and analyzing these pre-filtered records. This segmentation reduces the processing burden on the central system and improves overall detection efficiency.
Solution Approach 2:
Client devices perform preliminary filtering of event records locally, identifying and marking abnormal event sets before transmission to the central computer system. This preliminary action reduces the volume of data requiring central processing and enables faster anomaly detection.
2Reliability
If all event records are transmitted to the central computer system, then comprehensive analysis is possible, but network usage increases
Solution Approach 1:
The system extracts only the abnormal event sets from the complete event data at the client level, transmitting only these filtered records to the central computer system. This extraction principle significantly reduces network bandwidth consumption while preserving the essential information needed for anomaly detection.
3Reliability
If all event records are stored centrally, then complete data availability is achieved, but storage requirements increase
Solution Approach 1:
The system extracts and stores only the abnormal event sets at the central computer system, rather than storing complete event records from all devices. This approach maintains data availability for anomaly detection while dramatically reducing the storage capacity required at the central level.
4Reliability
If the central computer system processes all event records, then thorough anomaly detection is achieved, but device complexity increases
Solution Approach 1:
The system architecture is segmented into client devices that perform local filtering and a central computer system that performs aggregation and analysis. This segmentation distributes computational complexity across multiple levels, reducing the burden on any single component while maintaining detection accuracy.
Data Source
AI summary
A central computer system receives a first plurality of event records, each event record identifying one or more events that have occurred in a device of a plurality of different devices. The central computer system identifies, from the first plurality of event records, a first group of event records that identify a same first set of one or more events that occurred on a first subset of the devices. The central computer system determines that a total number of the event records in the first group of event records exceeds a first threshold criterion. In response to determining that the total number of the event records in the first group of event records exceeds the first threshold criterion, the central computer system sends to a destination, information about the first set of one or more events.