Anomaly Service Edge Log Pattern Extraction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current anomaly detection in computing environments is hindered by the high volume of log data required for pattern extraction, leading to excessive bandwidth usage and computational overhead, making it prohibitively expensive and inefficient.

Innovation Solution

An anomaly service identifies dominant patterns in log data from edge nodes, extracts non-anomalous blocks, and generates anomaly vectors to detect deviations, allowing for efficient detection and prediction of anomalous conditions at the source with reduced bandwidth usage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If pattern extraction is performed on large volumes of log data to detect anomalies, then anomaly detection accuracy is improved, but bandwidth usage and computational overhead increase prohibitively

Engineering Contradiction:

Improveanomaly detection accuracyVSAvoidbandwidth usage and computational overhead

Core Design Contradiction:

Measurement precisionVSLoss of energy

Solution Approach 1:

The patent extracts and removes dominant non-anomalous patterns from log data before transmission to the central server. By taking out the majority normal patterns (e.g., routine operational logs), only the remaining anomalous or unusual patterns are transmitted, dramatically reducing bandwidth usage while maintaining anomaly detection capability

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments log data processing into two stages: local edge processing to identify and remove dominant patterns, and centralized processing only for the remaining anomalous segments. This segmentation allows each component to perform its specialized function efficiently, reducing overall computational overhead

Inventive Principle:

Principle #1Segmentation

2Reliability

If all log data is transmitted to centralized servers for pattern extraction, then comprehensive anomaly analysis is achieved, but operational costs and processing time increase significantly

Engineering Contradiction:

Improvecomprehensive anomaly analysisVSAvoidprocessing time and operational costs

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary action at the edge nodes by identifying and removing dominant patterns before data leaves the edge device. This preliminary processing ensures that only relevant anomalous data requires centralized processing, reducing both time and cost while maintaining comprehensive analysis capability

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary processing layer at the edge that acts as a filter between log generation and centralized analysis. This intermediary performs initial pattern removal, allowing the centralized server to focus resources on analyzing only the anomalous portions of log data

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11797411B2Block-based anomaly detection in computing environments

Publication Date: 2023.10.24 ORACLE INT CORP

AI summary

An anomaly service receives log data from nodes in a computing environment, which includes a sequence of information indicative of log messages produced by the nodes. The anomaly service identifies dominant patterns in the sequence of information that are representative of non-anomalous blocks of the log messages. Having identified the dominant patterns, the service is able to extract the non-anomalous blocks from the log data to reveal anomalous blocks that do not fit the dominant patterns. The service may then generate anomaly vectors based on the anomalous blocks, which can be distributed to the nodes to detect anomalies.