Anomaly Detection Impact Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anomaly detection systems in computer systems often generate false positives due to broad detection constraints and inconsistent data sources, leading to resource wastage and difficulty in identifying anomalies with significant impact, as they fail to assess the impact of anomalies on related objects effectively.
Innovation Solution
A method for anomaly detection with impact assessment that determines an importance classification of objects and their relationships within a computer system, using a relationship graph to calculate an impact score for anomalies, which filters out lower-impact issues and prioritizes higher-impact anomalies for investigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If broad detection constraints are used in anomaly detection systems, then more anomalies can be detected, but false positives increase and resource wastage occurs
Solution Approach 1:
The patent applies local quality by differentiating anomaly impact levels and treating detected anomalies differently based on their specific characteristics. Instead of uniform treatment, the system classifies anomalies into impact levels (e.g., high, medium, low) and applies selective filtering and notification strategies accordingly, reducing false positives for low-impact anomalies while maintaining detection coverage for high-impact ones
Solution Approach 2:
The system changes the parameter of anomaly impact assessment by introducing impact level classification as a new dimension for anomaly evaluation. This parameter transformation enables the system to adjust detection sensitivity and resource allocation dynamically, filtering out low-impact false positives while maintaining high-impact anomaly detection
2Reliability
If anomaly detection systems analyze all detected anomalies, then comprehensive coverage is achieved, but resource wastage increases due to low-impact issues
Solution Approach 1:
The patent extracts and separates low-impact anomalies from high-impact anomalies based on impact assessment. By taking out low-impact anomalies for filtered treatment, the system reduces resource consumption on unnecessary investigations while maintaining comprehensive detection through selective monitoring of high-impact anomalies that require actionable responses
Solution Approach 2:
The system applies partial action by investigating and responding only to anomalies above a certain impact threshold, rather than treating all anomalies equally. This partial investigation strategy reduces resource wastage on low-impact issues while maintaining sufficient detection coverage for critical anomalies that could cause significant damage
3Measurement precision
If impact assessment is performed for all objects, then accurate anomaly prioritization is achieved, but system complexity increases
Solution Approach 1:
The patent segments the complex impact assessment task into manageable components by classifying objects into impact levels based on predefined criteria (e.g., criticality, dependency relationships). This segmentation simplifies the assessment process by applying different evaluation rules to different object categories, achieving accurate prioritization without proportionally increasing system complexity
Data Source
AI summary
Examples described herein provide a computer-implemented method that includes detecting an anomaly associated with an object of a computer system and determining an importance classification of the object. An object relationship of the object is determined with respect to one or more other objects of the computer system. An impact score of the anomaly is determined based on the importance classification and the object relationship. An anomaly report is output with the impact score.