Anomaly Severity Computation via Causal Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data analysis technologies continuously monitor computer systems for anomalies but fail to differentiate between anomalies based on their impact, leading to inefficient resource allocation and optimization.
Innovation Solution
The system identifies data logs, generates a data model using time series analysis, constructs a causal graph to compute anomaly severity, and assigns anomalies to classifications based on their impact, allowing for holistic investigation and resource optimization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If continuous anomaly detection is performed on all detected anomalies, then anomaly detection completeness is improved, but resource allocation efficiency deteriorates
Solution Approach 1:
The patent segments anomalies into different severity levels (critical, high, medium, low) based on their impact on system functionality. This segmentation allows the system to prioritize investigation resources on critical anomalies while maintaining comprehensive detection coverage, thereby resolving the contradiction between detection completeness and resource allocation efficiency.
Solution Approach 2:
The patent changes the parameter of anomaly prioritization by introducing severity scoring based on causal graph analysis. Instead of treating all anomalies equally, the system dynamically adjusts investigation priority based on computed severity values, enabling efficient resource allocation while maintaining complete anomaly detection.
2Measurement precision
If detailed analysis is performed on all anomalies, then anomaly investigation quality is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary severity assessment using causal graph analysis before detailed investigation. By pre-computing anomaly severity based on causal relationships and system impact, the system prepares prioritization information in advance, allowing investigators to focus detailed analysis on high-severity anomalies and reduce overall processing time.
Solution Approach 2:
The patent applies different levels of investigation quality to different anomalies based on their severity. Critical anomalies receive comprehensive detailed analysis while low-severity anomalies receive streamlined processing. This local differentiation of investigation quality maintains high investigation quality for important anomalies while reducing processing time for the overall anomaly set.
3Reliability
If comprehensive anomaly monitoring is implemented, then system reliability is improved, but system complexity increases
Solution Approach 1:
The patent introduces a causal graph as an intermediary structure that models relationships between system components and anomalies. This causal graph serves as a mediator that organizes complex anomaly data and relationships in a structured manner, enabling comprehensive monitoring while managing system complexity through systematic representation.
Solution Approach 2:
The patent creates a universal severity computation framework that can be applied to multiple anomaly types and system configurations. The causal graph approach and severity scoring mechanism provide a multi-functional solution that handles diverse anomalies through a unified methodology, reducing overall system complexity by avoiding separate specialized systems for each anomaly type.
Data Source
AI summary
Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.