Dynamic Countermeasure Management for Anomaly Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing management systems for computer systems are limited in their ability to dynamically add new countermeasure candidates during operations, as proposed countermeasures are fixed based on general purpose and expansion rules, restricting adaptability and effectiveness.

Innovation Solution

A management apparatus and method that include an anomaly detection unit, an execution unit, and a countermeasure result information setting unit, which detect anomalies, decide and execute countermeasures, and evaluate their effectiveness, allowing for the addition of new countermeasure proposals and updating of countermeasure result tables based on operational data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If countermeasure rules are fixed based on general purpose and expansion rules, then the system maintains stability and reliability, but the system cannot dynamically add new countermeasure candidates during operations, reducing adaptability

Engineering Contradiction:

Improvestability of countermeasure rulesVSAvoidability to add new countermeasures

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements a dynamic countermeasure management system where the countermeasure result table can be updated during operations. The system transitions from static fixed rules to dynamic adaptable rules by allowing new countermeasure candidates to be added and evaluated in real-time based on operational data and anomaly detection results.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system establishes a feedback mechanism where countermeasure execution results are evaluated and recorded in the countermeasure result table. This feedback loop enables continuous improvement of countermeasure effectiveness by learning from actual operational outcomes, allowing the system to adapt while maintaining reliability through evidence-based updates.

Inventive Principle:

Principle #23Feedback

2Device complexity

If countermeasure rules are fixed in advance, then the system structure remains simple and manageable, but the system cannot update countermeasure strategies based on real-time operational data, reducing operational management effectiveness

Engineering Contradiction:

Improvesimplicity of rule managementVSAvoidoperational management efficiency

Core Design Contradiction:

Device complexityVSProductivity

Solution Approach 1:

The system implements self-service capabilities where the management apparatus automatically detects anomalies, evaluates countermeasure effectiveness, and updates the countermeasure result table without requiring manual intervention. This maintains simplicity while enabling continuous improvement of operational management efficiency through automated learning and adaptation.

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If new countermeasure candidates are added during operations, then the system becomes more adaptable and effective, but the system complexity increases and management becomes more difficult

Engineering Contradiction:

Improveability to add countermeasures dynamicallyVSAvoidcomplexity of rule management

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The feedback mechanism evaluates each new countermeasure candidate's effectiveness and records results in the countermeasure result table. This structured feedback approach manages complexity by providing systematic evaluation criteria and automated tracking, allowing dynamic addition of countermeasures without overwhelming manual management overhead.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent replaces manual rule management with automated information processing. The management apparatus automatically acquires operational data, detects anomalies, evaluates countermeasures, and updates the countermeasure result table, substituting mechanical manual management with automated computational processes that handle complexity efficiently.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11762729B2Apparatus and method for anomaly countermeasure decision, execution and evaluation

Publication Date: 2023.09.19 HITACHI VANTARA LTD

AI summary

A computer management apparatus including a plurality of nodes, each including a processor and a storage device, and stores a countermeasure result table including a plurality of combinations of an anomaly detection rule, a countermeasure rule which is a countermeasure against an anomaly, and an effect indicating effectiveness of these rules, and the management apparatus includes: an anomaly detection unit that detects an anomaly of the computer system based on information acquired from the computer system and the anomaly detection rule; an execution unit that decides a countermeasure, at which the anomaly has been detected by the anomaly detection unit, on the basis of the detected anomaly, the countermeasure rule, and the effect indicating the effectiveness, and executes the decided countermeasure; and a countermeasure result information setting unit that evaluates a result of the countermeasure and records the result in the effect indicating the effectiveness in the countermeasure result table.