Anomaly Detection Voting System for Alert Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern anomaly detection methods generate excessive alerts due to statistical chance, overwhelming operations teams and causing them to miss critical events, as they treat single stream, single object, single component, single metrics scenarios, leading to numerous false alarms.
Innovation Solution
A system and method that utilize multiple models to monitor data streams, generate smart alerts based on voting, and prioritize alerts using z-score, median-based, dynamic quantile, or exponential decay models to identify significant anomalies across multiple streams, reducing false positives by focusing on concentrated and persistent anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection methods are used to monitor data streams, then anomalies can be detected, but the number of alerts becomes excessive due to statistical chance, overwhelming operations teams
Solution Approach 1:
The patent combines multiple anomaly detection models (z-score, median-based, dynamic quantile, exponential decay) into a unified voting system. Multiple models vote on whether to generate an alert, and alerts are only generated when a threshold number of models agree. This merging approach maintains reliable anomaly detection while reducing the quantity of alerts by eliminating redundant detections from individual models.
Solution Approach 2:
The system implements a multi-functional alert generation mechanism that handles multiple data streams, multiple objects, multiple components, and multiple metrics through a single unified approach. The voting model framework can accommodate various anomaly detection strategies and adapts to different monitoring scenarios, providing universal applicability across complex monitoring environments.
2Measurement precision
If traditional anomaly detection methods issue alerts for statistical chance occurrences, then sensitivity is high, but operations teams are overwhelmed and ignore alerts, missing critical events
Solution Approach 1:
The system incorporates feedback mechanisms where the voting models continuously learn from historical data and adjust their thresholds. The dynamic quantile model adapts to changing data distributions, and the exponential decay model weights recent anomalies higher. This feedback loop maintains high sensitivity for critical events while automatically adjusting to reduce false alarms from statistical chance, making the system more manageable for operations teams.
Solution Approach 2:
The patent changes the parameters of alert generation by introducing multiple voting thresholds and dynamic threshold adjustment. Instead of using a fixed threshold, the system adjusts parameters based on data characteristics, time patterns, and model confidence levels. This allows the system to maintain sensitivity for true anomalies while reducing the volume of alerts to a manageable level for operations teams.
3Device complexity
If single stream, single object, single component, single metric monitoring is used, then detection simplicity is maintained, but the system cannot handle modern multi-dimensional anomaly detection scenarios
Solution Approach 1:
The voting model framework is designed to be universally applicable across multiple data streams, objects, components, and metrics. Each model can process different types of data independently, but they all vote within a unified system. This architecture maintains simplicity in individual model implementation while achieving multi-dimensional detection capability through the collective voting of specialized models.
Solution Approach 2:
The system segments the anomaly detection function into multiple specialized models, each optimized for specific patterns or data types. The z-score model handles normal distribution-based anomalies, the median-based model handles skewed distributions, the dynamic quantile model handles evolving patterns, and the exponential decay model handles time-sensitive anomalies. This segmentation allows each component to remain simple while the combined system achieves high versatility.
Data Source
AI summary
Aspects of the subject disclosure may include, for example, a device having a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations including monitoring, by a plurality of models implemented by the executable instructions, a plurality of data streams comprising super alerts; and generating a smart alert based on voting on the super alerts by the plurality of models. Other embodiments are disclosed.