Diagnosis Device Using Dynamic Progression Degree Weights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing diagnosis devices for information processing systems face challenges in accurately detecting abnormalities due to weights not reflecting cause transitions, classification-based values not indicating abnormality causes, and malware detection relying solely on communication frequency, leading to difficulties in accurately identifying system abnormalities.
Innovation Solution
A diagnosis device with progression-degree specifying, determining, and updating means to assess the abnormality degree based on device information, using progression-degree information to associate detection device identifiers with their respective abnormality levels, enabling accurate detection by considering the order of detection events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If weights are calculated based on predetermined operation processing, then the calculation is systematic and reproducible, but the weights do not reflect transitions between causes producing an abnormality, reducing detection accuracy
Solution Approach 1:
The weight calculation method transitions from static predetermined weights to dynamic weights that are updated based on the temporal sequence of detection events. The weight of each detection device is adjusted according to when it detected the abnormality relative to other detection devices, making the weight calculation adaptive to the specific abnormality progression pattern rather than relying on fixed predetermined values.
Solution Approach 2:
The system implements feedback by using the temporal order of detection results to adjust the weights of detection devices. The calculation unit receives detection results with timing information, determines the sequence of detections, and uses this feedback to dynamically adjust weights that better reflect the actual cause transitions of the abnormality, improving both reliability and measurement precision.
2Productivity
If determination processing is performed based on communication frequency thresholds, then the detection method is simple and fast, but it cannot detect abnormalities related to values other than communication frequency
Solution Approach 1:
The diagnosis device is designed to handle multiple types of detection results from various detection devices, not limited to communication frequency monitoring. The system can process diverse abnormality indicators including file access patterns, process behaviors, and other system parameters, making it universally applicable to different abnormality types while maintaining fast determination through the progression degree framework.
Solution Approach 2:
The system changes from monitoring a single parameter (communication frequency) to monitoring multiple parameters representing different aspects of system behavior. By collecting detection results from multiple detection devices that monitor different parameters, the system can detect various types of abnormalities while maintaining efficient processing through the standardized progression degree calculation.
3Measurement precision
If progression degree calculation considers the order of detection events, then the abnormality assessment becomes more accurate, but the processing complexity increases
Solution Approach 1:
The complex task of abnormality assessment is segmented into distinct functional units: detection devices that collect data, a determination unit that establishes temporal order of detections, and a calculation unit that computes progression degrees. This segmentation allows each component to perform its specific function efficiently, reducing overall processing complexity while maintaining high measurement precision through the sequential processing of detection events.
Data Source
AI summary
The diagnosis device specifies a progression degree relating to a first information processing device for output information output by a first detection device at a first timing with respect to the first information processing device, based on device information indicates a progression degree that represents a degree to which the information processing device is abnormal with respect to the information processing device, determines whether or not information in which a first detection device identifier of the first detection device and the specified progression degree are associated with each other is included in progression-degree information in which a detection device identifier capable of identifying a detection device and the progression degree are associated with each other; and calculates the progression degree relating to the first information processing device according to the specified progression degree when the information is determined to be included in the progression-degree information.