Closed-System Monitoring via Process and CPU Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems struggle to accurately monitor performance and security in open systems due to their flexibility, making it difficult to identify issues like memory overflow and processing overload, especially with increasing data production and complex machine learning models.
Innovation Solution
Implementing a computer-implemented method to monitor closed systems by determining process and thread counts within predetermined ranges and CPU usage, issuing alerts for deviations, using AI-based models to detect anomalies and malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If open systems are used to process data, then system flexibility and adaptability are improved, but monitoring precision and security detection capability deteriorate
Solution Approach 1:
The patent segments the monitoring function by separating security monitoring tasks from general system operations. It creates a dedicated security monitoring system that operates independently within the closed system architecture, allowing precise monitoring of specific security parameters (process counts, CPU usage, memory allocation) without being affected by the flexibility needs of the broader open system.
Solution Approach 2:
The patent introduces a security monitoring system as an intermediary layer between the open system and the monitoring function. This intermediary operates within the closed system boundaries, collecting security-relevant data from the open system while maintaining the flexibility of the open system architecture. The intermediary filters and analyzes data to provide precise security monitoring without compromising system adaptability.
2Productivity
If the number of programs and processes increases to handle data production, then processing capability is improved, but system complexity and difficulty of detecting anomalies increases
Solution Approach 1:
The patent applies partial monitoring by focusing security monitoring resources only on critical parameters (process counts, CPU usage, memory allocation) rather than monitoring every system detail. This selective monitoring approach maintains processing capability by allowing the system to run multiple programs while reducing the complexity burden on the monitoring system itself.
Solution Approach 2:
The patent implements feedback mechanisms that continuously monitor security parameters and provide real-time information about system state. The monitoring system collects data on process counts and resource usage, compares it against baseline values, and provides feedback alerts when anomalies are detected. This feedback loop enables the system to maintain high processing capability while managing complexity through automated detection and response.
3Ease of operation
If conventional monitoring products are used in open systems, then ease of operation is maintained, but reliability and security detection capability deteriorate
Solution Approach 1:
The patent changes the monitoring parameters from general system metrics to security-specific parameters (process counts, CPU usage, memory allocation). By focusing on these specific parameters, the monitoring system maintains ease of operation through simplified data collection while significantly improving security detection capability and reliability. The parameter change enables the system to operate easily while detecting security anomalies that conventional monitoring products miss.
Data Source
AI summary
A computer-implemented method, according to one approach, includes: determining a number of processes and threads for each of a plurality of programs currently running on a closed system. For each of the programs in the plurality of programs, a determination is made as to whether the respective number of processes and threads are in a first predetermined range. Moreover, for each of the programs determined as having a respective number of processes and threads that are in the first predetermined range, CPU usage associated with the respective programs is determined. A security alert is issued in response to determining that at least one of the programs include: a respective number of processes and threads that are outside the first predetermined range, and a combined CPU usage that is outside a second predetermined range.