Anomaly Detection in Distributed Systems via Decision Tree Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The increasing complexity of distributed computing systems has led to management and administration challenges, including significant inefficiencies and computational overheads, making traditional approaches to automated management and administration impractical.

Innovation Solution

The use of distributed-computer-system metrics, call traces, and attribute values to identify attribute dimensions related to anomalous behaviors in distributed-computer-system components through decision-tree-related analyses, facilitating the resolution of these anomalies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Extent of automation

If traditional approaches to automated management and administration are used, then existing management functionalities can be maintained, but the system becomes increasingly complex and computationally overhead increases

Engineering Contradiction:

Improveautomated management and administrationVSAvoidmanagement complexity

Core Design Contradiction:

Extent of automationVSDevice complexity

Solution Approach 1:

The patent extracts anomaly detection and root cause analysis from the broader management system, creating a focused subsystem that processes only relevant metrics, traces, and attribute values. This extraction reduces the computational overhead of automated management by concentrating intelligence only where anomalies occur, rather than continuously monitoring all system components.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system introduces an intermediary layer of analysis that processes raw operational data into actionable insights. This intermediary processing layer filters and analyzes metrics, call traces, and attribute values to identify anomalies and their root causes, reducing the complexity of direct management by providing structured intermediate representations.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If comprehensive monitoring of all components is implemented, then anomaly detection capability improves, but computational overhead and management inefficiency increase

Engineering Contradiction:

Improveanomaly detection capabilityVSAvoidcomputational overhead

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The patent applies local quality by analyzing only the specific attributes and metrics relevant to each component type. Instead of uniformly monitoring all components with the same depth, the system tailors the monitoring and analysis intensity to the specific characteristics and failure modes of each component, reducing overall computational overhead while maintaining detection reliability.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system implements partial action by focusing analysis only on components and attributes that show signs of anomalous behavior. Rather than continuously analyzing all system attributes, the system applies intensive analysis only to subsets of data that indicate potential problems, reducing computational overhead while maintaining effective anomaly detection.

Inventive Principle:

Principle #16Partial or excessive action

3Measurement precision

If detailed analysis of all operational data is performed, then root cause identification improves, but time consumption and processing inefficiency increase

Engineering Contradiction:

Improveroot cause identification precisionVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent implements preliminary action by pre-defining the set of relevant attributes, metrics, and traces to be collected for each component type. This preliminary structuring of data collection criteria enables rapid analysis when anomalies occur, as the system only needs to retrieve and analyze pre-identified relevant data rather than searching through all operational data, thus reducing processing time while maintaining identification precision.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20210303438A1Methods and Systems that Identify Dimensions Related to Anomalies in System Components of Distributed Computer Systems using Traces, Metrics, and Component-Associated Attribute Values

Publication Date: 2021.09.30 VMWARE INC

AI summary

The current document is directed to methods and systems that employ distributed-computer-system metrics collected by one or more distributed-computer-system metrics-collection services, call traces collected by one or more call-trace services, and attribute values for distributed-computer-system components to identify attribute dimensions related to anomalous behavior of distributed-computer-system components. In a described implementation, nodes correspond to particular types of system components and node instances are individual components of the component type corresponding to a node. Node instances are associated with attribute values and node are associated with attribute-value spaces defined by attribute dimensions. Using attribute values and call traces, attribute dimensions that are likely related to particular anomalous behaviors of distributed-computer-system components are determined by decision-tree-related analyses and are reported to one or more computational entities to facilitate resolution of the anomalous behaviors.