Arbitration Engine for Weighted Multi-Model Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods in enterprise systems often fail to balance accuracy with consideration of seasonal variations and may not provide a unified, efficient, and scalable solution for detecting and mitigating system anomalies.
Innovation Solution
A computing platform trains multiple anomaly detection engines using historical system status information, generates weighted averages of confidence levels and binary values from these engines, and executes corrective actions when anomalies are detected, utilizing an arbitration engine to consolidate the results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple anomaly detection engines are used to improve accuracy, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system segments the anomaly detection task into multiple specialized detection engines, each trained on different historical system status information and optimized for specific types of anomalies. This segmentation allows each engine to focus on particular patterns while the arbitration engine coordinates their outputs, resolving the contradiction by dividing complexity into manageable specialized components rather than using a single complex system.
Solution Approach 2:
The arbitration engine merges the outputs from multiple anomaly detection engines by generating a weighted average of their confidence levels and binary values. This merging process consolidates the results from multiple engines into a unified anomaly detection decision, maintaining high accuracy while managing system complexity through a centralized coordination mechanism.
2Adaptability or versatility
If multiple anomaly detection engines are deployed to detect various types of anomalies, then detection coverage is improved, but computational resources are consumed
Solution Approach 1:
The system employs partial action by having multiple anomaly detection engines operate in parallel, where each engine processes system status information independently. The arbitration engine then selectively combines their results, allowing the system to achieve comprehensive anomaly detection coverage while optimizing computational resource usage by not requiring all engines to fully process every input in all conditions.
3Reliability
If real-time anomaly detection is implemented to enable immediate corrective actions, then system reliability is improved, but processing time requirements increase
Solution Approach 1:
The anomaly detection engines are trained in advance using historical system status information, performing preliminary learning of anomaly patterns before actual detection is needed. This preliminary training allows the engines to quickly evaluate new system status inputs in real-time without extensive computation during the actual detection phase, enabling immediate corrective actions while maintaining high reliability.
Data Source
AI summary
A computing platform may train, using historical system status information, a plurality of anomaly detection engines, each comprising a different machine learning model. The computing platform may monitor a system to collect system status information. The computing platform may input the system status information into each of the plurality of anomaly detection engines, where each of the plurality of anomaly detection engines may output, based on the system status information, a corresponding binary value indicating whether the system status information is anomalous according the given anomaly detection engine, and a corresponding confidence level associated with corresponding binary value. The computing platform may input the binary values and the corresponding confidence levels into an arbitration engine to generate a weighted average of the corresponding confidence levels and binary values. Based on identifying that the weighted average meets or exceeds a predetermined threshold value, label the system as experiencing anomalous behavior.