Confidence-Based Event Group Management for Context-Aware Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing event detection systems in computing environments are prone to false positives, and existing solutions like filters or deactivation of rules are inadequate for machine learning-based tools, leading to the potential loss of contextually important events and inefficiencies in detecting anomalous behavior.
Innovation Solution
A method that groups events together and calculates a group confidence level based on event attributes and relationships, allowing for more accurate representation of the confidence level by considering contextual information, and initiates workflows to gather additional information when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If filters or de-duplication of events are used to address false positives, then the number of false positive events is reduced, but contextually important events may be filtered out and lost
Solution Approach 1:
The patent merges multiple events into event groups based on their contextual relationships and attributes. Instead of filtering individual events, the system aggregates related events (e.g., multiple login failures, multiple resource failures) into groups and evaluates the group as a whole. This allows the system to distinguish between isolated false positives and patterns indicating real issues, reducing false positives while preserving contextually important events that form meaningful groups.
Solution Approach 2:
The patent creates a representation of event groups that captures the collective confidence level of multiple events. By copying and aggregating the confidence attributes of individual events into a group-level confidence metric, the system can evaluate whether a group of events collectively indicates a real issue, thereby reducing false positives without discarding the contextual information contained in individual events.
2Reliability
If individual rules driving event generation are deactivated to reduce false positives, then false positive events are reduced, but manual intervention is required and machine learning-based tools cannot selectively disable rules
Solution Approach 1:
The patent implements self-service by automatically evaluating event groups based on their collective confidence levels and attributes. The system autonomously determines which event groups warrant attention and which can be filtered, eliminating the need for manual rule configuration or deactivation. Machine learning-based tools can leverage this by having the system automatically learn patterns and adjust confidence thresholds without human intervention.
Solution Approach 2:
The patent changes the parameter of evaluation from individual event rules to group-level confidence metrics. Instead of manually adjusting or deactivating individual detection rules, the system aggregates events into groups and evaluates them based on their collective attributes and confidence levels. This parameter transformation allows automated, rule-free false positive reduction while maintaining operational simplicity.
3Speed
If events are processed individually to detect anomalies, then detection speed is maintained, but contextual information from related events is not utilized
Solution Approach 1:
The patent segments events into meaningful groups based on their contextual relationships, attributes, and confidence levels. By organizing events into groups (e.g., by source, type, or temporal proximity) while maintaining the ability to process each group efficiently, the system preserves detection speed while unlocking contextual information that would be lost in individual event processing. The segmentation allows parallel processing of multiple event groups simultaneously.
Data Source
AI summary
Confidence-based event group management, workflow exploitation and anomaly detection, including: detecting an event in a computing system; adding the event to an event group; and calculating a group confidence level for the event group based on an event confidence level for the event and at least one of: one or more attributes of the event or one or more relationships between a source of the event and sources of events in the event group.