Computer System Anomaly Detection Using Metric-to-Image Modeling

The patent segments the anomaly detection process into two distinct phases: an offline training phase where the deep learning model is trained using historical data, and an online detection phase where the trained model is deployed for real-time anomaly detection. This segmentation allows the computationally intensive training to be performed once offline, while the online phase requires minimal computational resources for real-time operation, thus resolving the contradiction between explainability and computational resource consumption.

The patent implements feedback mechanisms where the deep learning model's predictions are continuously monitored and evaluated. The model processes system metrics and performance data, generates anomaly predictions, and these predictions are fed back into the system for validation. This feedback loop allows the system to maintain high detection accuracy while providing explainable insights through the continuous evaluation and interpretation of model predictions, thus resolving the contradiction between detection accuracy and explainability.

The patent creates a virtual copy of the system's operational state by collecting and processing system metrics, performance data, and logs into a structured data representation. This copied data model allows the deep learning algorithm to analyze system behavior without directly complicating the actual system architecture. The virtual data copy enables sophisticated anomaly detection while keeping the physical system relatively simple, thus resolving the contradiction between system complexity and detection capability.

The patent performs preliminary action by training the deep learning model offline using extensive historical data before deployment. During this offline training phase, the model learns complex patterns and relationships in the data, achieving high detection accuracy. Once trained, the model is deployed for online detection where it requires minimal computational resources, thus resolving the contradiction between computational resource consumption and detection accuracy by performing the resource-intensive work in advance.