Hierarchical Cloud Node Anomaly Detection With Polygraph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack effective methods for detecting anomalous behavior in hierarchical cloud deployments, which can compromise security and compliance in complex network environments.
Innovation Solution
A data platform with data ingestion, processing, and user interface resources monitors cloud environments using agents that collect and report detailed activity data, generating polygraphs to identify anomalies and provide real-time insights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If detailed activity data is collected and processed in real-time, then anomaly detection capability is improved, but system complexity and resource consumption increase
Solution Approach 1:
The system segments the cloud environment into hierarchical levels (e.g., cloud provider level, cloud account level, resource group level, resource level) and collects activity data at each level separately. This segmentation allows the system to process and analyze data in manageable portions, reducing overall system complexity while maintaining comprehensive anomaly detection capability across the entire hierarchy.
Solution Approach 2:
The patent introduces an intermediary processing layer that aggregates activity data from multiple sources and hierarchical levels before final analysis. This intermediary layer consolidates raw data into structured representations, reducing the complexity of processing while preserving the essential information needed for anomaly detection.
2Reliability
If real-time monitoring and data processing is implemented, then security and compliance are improved, but network exposure and data transmission requirements increase
Solution Approach 1:
The system implements local quality by processing and analyzing activity data at the local hierarchical level before transmitting to higher levels. Each hierarchical level processes its own data locally, reducing the volume of data that needs to be transmitted over the network. This local processing minimizes network exposure while maintaining comprehensive security and compliance monitoring capabilities.
Solution Approach 2:
The patent extracts and processes only the essential activity data needed for anomaly detection at each hierarchical level, rather than transmitting all raw data throughout the entire hierarchy. This extraction approach reduces network bandwidth requirements and minimizes network exposure while preserving the critical information for security monitoring.
3Measurement precision
If comprehensive activity data is aggregated from multiple sources, then detection precision is improved, but data processing time and computational resources increase
Solution Approach 1:
The system segments data processing by hierarchical level, where each level processes and aggregates data from its specific scope before passing to the next level. This segmentation enables parallel processing across different hierarchical levels, reducing overall processing time while maintaining the precision needed for accurate anomaly detection through comprehensive data aggregation.
Solution Approach 2:
The patent implements preliminary action by pre-aggregating and pre-processing activity data at lower hierarchical levels before final anomaly detection at higher levels. This preliminary processing reduces the computational burden on upper levels and accelerates the overall detection process while maintaining detection precision through comprehensive data aggregation.
Data Source
AI summary
Detecting anomalous behavior of nodes in a hierarchical cloud deployment, including: gathering data describing a cloud deployment as a hierarchy of a plurality of nodes; presenting a graph depicting behavior at a particular hierarchical level of at least a subset of the plurality of nodes; and determining whether behavior associated with a particular node deviates from normal behavior based on a hierarchical portion of plurality of nodes including the particular node.