Cloud Behavioral Data Filtering for Anomaly Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing environments, computer-executable models trained on noisy data may incorrectly identify recent behavioral data as anomalous, leading to false alarms and customer indifference due to repeated false notifications.

Innovation Solution

The cloud computing environment analyzes recent behavioral data before providing it to the computer-executable model, assessing its suitability using time-series data and metric values computed from confidence, trend, and weight values, thereby filtering out noisy data that may cause false positives.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the computer-executable model is trained on noisy behavioral data, then the model can detect anomalous behavior, but the model generates false positives and sends false alarms to customers

Engineering Contradiction:

Improveaccuracy of anomalous behavior detectionVSAvoidfalse alarms to customers

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The system performs preliminary analysis of behavioral data before it is provided to the computer-executable model. A data analysis module pre-processes the data, computing metrics and determining suitability in advance, thereby preventing noisy data from causing false positives while maintaining accurate anomaly detection

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A data analysis module is introduced as an intermediary between the data collection system and the computer-executable model. This intermediary module filters and prepares the behavioral data, computing metrics and determining suitability before the data reaches the model, thus eliminating false alarms while preserving detection accuracy

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the computer-executable model is repeatedly retrained to adapt to continuous behavioral data, then the model can maintain accuracy, but the process is impractical and time-consuming

Engineering Contradiction:

Improveaccuracy of anomaly detectionVSAvoidtime required for model retraining

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary analysis and metric computation on behavioral data before it is provided to the model. This pre-processing approach eliminates the need for repeated model retraining by preparing data in advance, thereby maintaining detection accuracy without the time cost of continuous retraining

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The data analysis module autonomously analyzes behavioral data, computes metrics, and determines suitability without requiring model retraining. The system serves itself by pre-processing data independently, eliminating the need for time-consuming retraining operations while maintaining model accuracy

Inventive Principle:

Principle #25Self-service

3Productivity

If the cloud computing environment provides numerous false alarms to customers, then the system appears to be actively monitoring, but customers begin to ignore the alarms

Engineering Contradiction:

Improvealert generation rateVSAvoidcustomer trust in alerts

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system extracts and removes noisy, unsuitable behavioral data from the input to the computer-executable model through preliminary analysis. By taking out only the relevant, high-quality data, the system maintains appropriate alert generation while eliminating false alarms that would cause customer indifference

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system changes the parameter of data suitability by computing metrics that evaluate whether behavioral data meets quality thresholds. This parameter change filters out noisy data while preserving actionable information, thereby maintaining customer trust through reliable alerts without reducing monitoring activity

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20250156207A1Detecting anomalous behavior in a cloud computing environment

Publication Date: 2025.05.15 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Described herein are technologies related to analyzing behavioral data of an entity in a cloud computing environment and determining suitability of providing the behavioral data to a computer-executable model that is configured to identify anomalous behavior of the entity. The technologies described herein improve performance of computer-executable models that are configured to detect anomalous behavior in a cloud computing environment.