Anomaly Detection via Discriminative Parameter Flow Graphs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current systems fail to accurately detect system anomalies due to the large volume and changing nature of parameters in system logs, which makes it difficult to capture and utilize discriminative parameters that could identify flow between templates in control flow graphs.

Innovation Solution

The method involves mining discriminative parameters from system logs, generating control flow graphs, annotating edges with parameter values, and using these annotated graphs to identify execution traces and detect system anomalies by comparing them to expected execution flows.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If all parameters from system logs are used for anomaly detection, then the detection comprehensiveness is improved, but the false positive rate increases and processing complexity increases

Engineering Contradiction:

Improveanomaly detection accuracyVSAvoidparameter processing complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts only the discriminative parameters from the loglines that are relevant to template flow identification, rather than processing all parameters. This extraction process filters out irrelevant parameters, reducing complexity while maintaining detection accuracy by focusing only on parameters that distinguish between different template execution flows.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies different processing treatments to different parameters based on their discriminative value. Discriminative parameters are extracted and used for flow identification, while non-discriminative parameters are discarded. This localized quality approach optimizes the detection process by applying appropriate processing only where needed.

Inventive Principle:

Principle #3Local quality

2Reliability

If all parameters from system logs are used for anomaly detection, then the detection comprehensiveness is improved, but the false negative rate increases

Engineering Contradiction:

Improveanomaly detection accuracyVSAvoidsignal noise

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

Inventive Principle:

Principle #2Taking out (Extraction)

3Measurement precision

If discriminative parameters are mined and used, then the detection precision is improved, but the parameter mining complexity increases

Engineering Contradiction:

Improveparameter discrimination precisionVSAvoidparameter mining complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent performs preliminary mining of discriminative parameters and their positions within templates before the actual anomaly detection process. This preliminary action identifies which parameters are discriminative and where they appear in templates, storing this information for efficient reuse during detection, thereby reducing the complexity of the main detection process.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent focuses on mining only the necessary discriminative parameters rather than analyzing all possible parameters exhaustively. By identifying and using only the parameters that are sufficient for template flow discrimination, the system achieves good detection precision without the excessive complexity of comprehensive parameter analysis.

Inventive Principle:

Principle #16Partial or excessive action

4Productivity

If conventional anomaly detection methods are used, then the processing speed is maintained, but the anomaly detection accuracy deteriorates

Engineering Contradiction:

Improveprocessing speedVSAvoidanomaly detection accuracy

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent segments the anomaly detection process into distinct phases: (1) mining discriminative parameters and their positions from loglines, (2) generating control flow graphs with annotated edges representing template flows, and (3) comparing actual execution traces against expected flows. This segmentation allows efficient processing in each phase while achieving high overall detection accuracy through the use of discriminative parameters.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS10523520B2System anomaly detection using parameter flows

Publication Date: 2019.12.31 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

One embodiment provides a method, including: receiving a plurality of loglines from a system execution log; generating at least one control flow graph by mining (i) a plurality of templates and (ii) a sequence of the plurality of templates defined by an order encountered during execution from the system execution log, wherein the control flow graph identifies flows between templates during execution; mining (i) discriminative parameters, (ii) a position for each of the mined discriminative parameters within a template, and (iii) a value of each of the mined discriminative parameters; annotating edges of the at least one control flow graph with the values of the mined discriminative parameters within the control flow graph; identifying execution traces from the system execution log using the values of the mined discriminative parameters; and detecting system anomalies in the identified execution traces by comparing one of the execution traces to an expected execution.