Causality Graph Log Selection for Faster Incident Cause Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently identifying the cause of incidents in control systems due to limited and unutilized log information, leading to inefficient analysis and storage capacity issues.
Innovation Solution
An incident event cause identification system that includes a device log information holding unit, causality graph holding unit, incident detection processing unit, necessary log information determination processing unit, necessary log information collection unit, cause analysis processing unit, and output unit to efficiently identify the cause of incidents by utilizing only necessary log information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all device log information is collected and analyzed, then the accuracy of cause identification is improved, but the scrutiny time and storage capacity requirements increase
Solution Approach 1:
The system performs preliminary actions by pre-defining causality graphs that map relationships between incident events and their potential causes. When an incident is detected, the system extracts only the necessary log information corresponding to relevant cause nodes from the pre-established causality graph, rather than analyzing all available logs. This preliminary structuring of causal relationships enables rapid, accurate cause identification without exhaustive log scrutiny.
Solution Approach 2:
The system extracts only the necessary subset of log information required for cause identification by referencing the causality graph. Instead of processing all device logs, the system selectively extracts logs corresponding to specific cause nodes relevant to the detected incident type, significantly reducing the volume of information that requires analysis while maintaining identification accuracy.
2Loss of information
If all device log information is collected and stored, then the completeness of analysis data is improved, but the information storage capacity requirements increase
Solution Approach 1:
The system extracts only the necessary log information required for cause identification by referencing the causality graph structure. For each detected incident, the system identifies relevant cause nodes and extracts only the log data associated with those specific nodes, rather than storing or processing all available device logs. This selective extraction maintains analytical completeness for the specific incident while minimizing storage requirements.
Solution Approach 2:
The system segments the complete set of device logs into organized groups corresponding to different cause nodes in the causality graph. Each log type is associated with specific potential causes, allowing the system to retrieve only the relevant segmented portions needed for analysis rather than handling the entire log dataset, thus reducing storage and processing overhead.
3Productivity
If pre-defined chain relationships of alerts are used for incident classification, then the incident classification speed is improved, but the system cannot handle systems with limited or insufficient alert types
Solution Approach 1:
The system transitions from a one-dimensional approach (pre-defined alert chains) to a two-dimensional framework by introducing causality graphs that map relationships between incident events and their potential causes. This graphical model allows the system to handle systems with limited alert types by establishing causal relationships between available logs and incident causes, providing adaptability across diverse systems while maintaining efficient classification through the structured graph relationships.
Solution Approach 2:
The causality graph framework provides a universal approach that can be applied to any system regardless of the number or types of alerts available. By defining general cause nodes and their relationships to incident events, the system can adapt to different control systems, whether they have numerous alert types or limited monitoring capabilities, making the incident classification mechanism versatile and system-agnostic.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An incident event cause identification system includes a device log information holding unit that holds log information of a target device, a causality graph holding unit that holds a causality graph in which a relationship between an incident event and a cause thereof is associated, an incident detection processing unit that detects an incident in the target device, a necessary log information determination processing unit that extracts a causality graph of an associated type for the incident event detected by the incident detection processing unit and determines device log information necessary for cause identification on the basis of the extracted causality graph, a necessary log information collection processing unit that collects the device log information determined by the necessary log information determination processing unit, and a cause analysis processing unit that identifies a cause of the incident event by using the device log information collected by the necessary log information collection processing unit and the causality graph.