Anomaly Detection Index Extraction for Data Storage Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information processing systems face challenges in maintaining anomaly detection accuracy while reducing data storage and processing loads, particularly in selecting relevant events for unknown anomalies without increasing data volume.
Innovation Solution
An information processing device that collects event data, determines if a predetermined index value exceeds a threshold, and instructs enhanced monitoring for specific events, identifying additional events to be monitored and managing communication bandwidth accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If more types of events or more pieces of data are stored to improve anomaly detection accuracy, then the accuracy of detecting and analyzing anomalies is improved, but the storage capacity and processing load of the information processing device increase
Solution Approach 1:
The system performs preliminary actions by pre-defining multiple types of index values that can be calculated from event data before anomalies occur. These index values represent various aspects of system behavior (frequency, timing, sequence, etc.) and are prepared in advance for efficient anomaly detection without storing all raw event data
Solution Approach 2:
The invention extracts only the essential features from event data by calculating specific index values (first index value, second index value, third index value) that capture different aspects of system behavior. Instead of storing all event data, the system extracts and stores only these computed index values, significantly reducing storage requirements while maintaining detection capability
Solution Approach 3:
The system changes parameters by using multiple different types of index values (first, second, third index values) that represent different characteristics of event data. By comparing these different parameter representations against threshold values, the system can detect anomalies from multiple perspectives without needing to store the complete raw event datasets
2Measurement precision
If more types of events or more pieces of data are stored to improve anomaly analysis accuracy, then the accuracy of analyzing anomalies is improved, but the processing load of the information processing device increases
Solution Approach 1:
The invention extracts only the essential features from event data by calculating specific index values (first index value, second index value, third index value) that capture different aspects of system behavior. Instead of storing all event data, the system extracts and stores only these computed index values, significantly reducing storage requirements while maintaining detection capability
Solution Approach 2:
The system changes parameters by using multiple different types of index values (first, second, third index values) that represent different characteristics of event data. By comparing these different parameter representations against threshold values, the system can detect anomalies from multiple perspectives without needing to store the complete raw event datasets
3Quantity of substance
If the number of events to be collected is reduced to decrease data storage, then the storage capacity requirement is reduced, but the accuracy of detecting unknown anomalies may deteriorate
Solution Approach 1:
The system performs preliminary actions by pre-defining multiple types of index values that can be calculated from event data before anomalies occur. These index values represent various aspects of system behavior (frequency, timing, sequence, etc.) and are prepared in advance for efficient anomaly detection without storing all raw event data
Solution Approach 2:
The system changes parameters by using multiple different types of index values (first, second, third index values) that represent different characteristics of event data. By comparing these different parameter representations against threshold values, the system can detect anomalies from multiple perspectives without needing to store the complete raw event datasets
Data Source
AI summary
Provided is an information processing device which is capable of suppressing a deterioration in accuracy of detecting an anomaly and accuracy of analyzing the anomaly, while suppressing an increase in an amount of data to be stored. The information processing system includes anomaly detection unit that collects event data indicating a predetermined event detected in a process of a device to be monitored, determines whether a predetermined index value related to the event exceeds a preset first threshold, and instructs enhanced monitoring of the device to be monitored and the process related to the event when the index value exceeds the first threshold, and collection instruction unit that determines an additional event being an event to be additionally monitored when the enhanced monitoring is instructed, and instructs the device to be monitored, which is subjected to the enhanced monitoring, to monitor the determined additional event.