Anomaly Detection Using Dynamic Correlation Model Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operation management systems struggle to accurately determine whether a continuously detected anomaly in a monitored system is actually occurring, as they fail to consider temporal changes and may incorrectly identify anomalies due to differences in system states between correlation model creation and application, or changes in configuration.
Innovation Solution
An operation management apparatus that acquires and stores measured values for performance indicators, detects failure information using a correlation model, and calculates an anomaly score based on temporal continuity and comparison with other combinations, to determine the actual occurrence of anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a correlation model is used to detect anomalies by comparing estimated and observed values, then anomaly detection capability is improved, but false anomalies may be detected due to differences in system states between model creation and application
Solution Approach 1:
The patent dynamically adjusts the anomaly detection approach by determining whether to use a correlation model or statistical processing based on the continuity of the observed value. When the observed value changes continuously, statistical processing is used instead of correlation model comparison, preventing false anomalies caused by system state differences between model creation and application.
Solution Approach 2:
The patent changes the detection parameter dynamically: using correlation-based anomaly scores when values are discontinuous, and statistical processing results when values are continuous. This parameter switching resolves the contradiction by adapting the detection method to the current system state.
2Loss of information
If anomaly detection is performed continuously over time, then temporal anomaly patterns are captured, but computational complexity and false detections increase
Solution Approach 1:
The patent applies partial action by selectively using correlation model-based detection only when necessary (when observed values are discontinuous), rather than continuously applying it. This reduces computational complexity while still capturing important temporal anomaly patterns through statistical processing for continuous values.
3Measurement precision
If correlation models are regenerated after configuration changes, then detection accuracy is maintained, but system response time and operational efficiency decrease
Solution Approach 1:
The patent prepares multiple detection approaches (correlation model and statistical processing) in advance, allowing immediate switching based on observed value continuity without requiring model regeneration. This preliminary preparation of alternative methods maintains detection accuracy while improving response efficiency after configuration changes.
Data Source
AI summary
An operation management apparatus that is capable of detecting an anomaly is provided. The operation management apparatus is configured to execute processing of: acquiring a measured value for a performance indicator with regard to a monitored system, and detecting failure information indicating a failure with regard to a combination of two different performance indicators, by using a correlation model representing a relationship between the two different performance indicators; storing the detected failure information in time series; determining, based on the failure information, whether or not the failure information is continuously detected with regard to the combination including a particular performance indicator, and calculating an anomaly score representing degree of an anomaly with regard to the performance indicator, based on information about one or more second combinations among one or more first combinations, and information about the other combinations including the particular performance indicator; and providing the anomaly score being calculated.