Auditor Microservice for Event-Based Business Process Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In event-based microservices environments, conventional system monitoring fails to adequately ensure data consistency and manage end-to-end auditing and failure management for long-running transactions, particularly due to the distributed architecture, which makes it difficult to detect and resolve data anomalies.
Innovation Solution
An independent auditor microservice is introduced to identify applications, subscribe to events, record and correlate published events, determine anomalies, and automatically publish compensating actions to resolve issues, utilizing event sourcing patterns and saga patterns for transaction management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional system monitoring is used in distributed microservices architecture, then system component issues can be monitored, but data consistency across microservices cannot be adequately monitored and end-to-end auditing is difficult
Solution Approach 1:
An independent auditor microservice is introduced as an intermediary component that subscribes to events from multiple microservices, correlates them using correlation identifiers, and performs comprehensive auditing. This mediator handles the complexity of cross-service monitoring centrally while allowing individual microservices to remain simple and focused on their core functions.
Solution Approach 2:
The auditor microservice performs multiple functions including event subscription, correlation, anomaly detection, and compensating action publishing through a single unified system. This multi-functional approach consolidates what would otherwise require multiple separate monitoring systems, reducing overall system complexity while maintaining comprehensive oversight.
2Adaptability or versatility
If distributed architecture is used for microservices, then system flexibility and scalability are improved, but end-to-end auditing and failure management become difficult
Solution Approach 1:
The auditor microservice implements continuous feedback by subscribing to event streams from multiple microservices, analyzing correlated events for anomalies, and publishing compensating actions when issues are detected. This feedback mechanism enables real-time anomaly detection and automatic correction while preserving the flexibility of distributed architecture.
Solution Approach 2:
The system performs preliminary actions by establishing event subscriptions and correlation rules in advance, and by publishing compensating actions proactively when anomalies are detected. This allows the system to prepare for and respond to potential failures before they propagate through the distributed system, making anomaly detection more effective.
3Measurement precision
If event sourcing pattern is implemented for comprehensive event recording, then auditing capability is improved, but system complexity and data storage requirements increase
Solution Approach 1:
The auditor microservice extracts and stores only the essential event data needed for auditing purposes from the distributed microservices system. By selectively capturing relevant events with their correlation identifiers rather than storing all system data, the system achieves comprehensive auditing capability while minimizing data storage requirements.
Data Source
AI summary
A method for facilitating an audit of an event-based business process is provided. The method includes identifying an application in the event-based business process; initiating a subscription with the identified application; recording a published event based on the subscription; correlating, by using a correlation identifier, the recorded published event with the event-based business process, the correlation identifier including a value that references an event chain; and storing, in a memory, the correlated published event based on an event sourcing pattern. The method further includes determining, by using the correlated published event, an anomaly in the event-based business process; and displaying, via a graphical user interface, a notification that includes information relating to the anomaly and a recommended compensating action.