Anomaly Ranking System for Data Center Alert Prioritization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data center administrators face challenges in efficiently monitoring and addressing anomalies due to the high volume of notifications and the lack of intelligence in existing management systems, leading to overwhelmed administrators and potential system failures.
Innovation Solution
A system that ranks detected anomalies based on predefined rules, using a graph-based approach to prioritize alerts by computing importance values and influence, combining domain-specific knowledge with anomaly detection to reduce noise and improve alert relevance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Area of stationary object
If data center size grows, then monitoring coverage and resource visibility are improved, but notification volume increases and administrator workload increases
Solution Approach 1:
The patent extracts only the most critical anomaly information from the vast amount of notifications by ranking anomalies based on predefined rules that identify critical resources and patterns. This extraction mechanism filters out noise and presents only the top prioritized anomalies to administrators, reducing notification volume impact while maintaining monitoring coverage.
Solution Approach 2:
The system performs preliminary ranking and triage of anomalies before they reach administrators. By pre-processing notifications through rule-based scoring and prioritization, the system prepares and orders the information in advance, so that when administrators receive alerts, they are already organized by importance and urgency, reducing the time and effort needed to respond.
2Reliability
If notification volume increases, then system monitoring coverage is improved, but administrator productivity decreases
Solution Approach 1:
The patent segments the notification stream into prioritized categories based on anomaly severity, resource criticality, and detected patterns. By dividing the monolithic notification list into segmented, prioritized groups, administrators can focus on critical issues first without losing awareness of other system states, thus maintaining monitoring coverage while improving productivity.
Solution Approach 2:
The system incorporates feedback mechanisms where administrators can mark anomalies as false positives or provide corrections, which then refines the ranking rules over time. This feedback loop continuously improves the prioritization algorithm, making it more accurate and reducing the time administrators spend reviewing notifications while maintaining comprehensive monitoring.
3Device complexity
If management systems lack intelligence, then system simplicity is maintained, but anomaly identification accuracy decreases
Solution Approach 1:
The patent changes the parameters of anomaly detection by introducing rule-based scoring weights, pattern recognition thresholds, and prioritization metrics. These parameter changes enable the system to accurately identify and rank anomalies without requiring complex machine learning models, maintaining relative simplicity while significantly improving identification accuracy through configurable parameters.
Solution Approach 2:
The system introduces an intermediary layer of rule-based processing between raw notifications and administrator decision-making. This intermediary layer of prioritization and triage logic acts as a bridge, transforming raw data into actionable insights without requiring the administrator to directly analyze complex patterns, thus maintaining simplicity while improving accuracy.
Data Source
AI summary
A method for ranking detected anomalies is disclosed. The method includes generating a graph based on a plurality of rules, wherein the graph comprises nodes representing metrics identified in the rules, edges connecting nodes where metrics associated with connected nodes are identified in a given rule, and edge weights of the edges each representing a severity level assigned to the given rule. The method further includes ranking nodes of the graph based on the edge weights. The method further includes ranking detected anomalies based on the ranking of the nodes corresponding to the metrics associated with the detected anomalies.