Dynamic Prediction Range Adjustment for Network Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network assurance systems face challenges in accurately detecting relevant anomalies due to high false positive rates from sensitive anomaly detection functions, which can lead to unnecessary alerts, and conservatively set detection thresholds may miss actual issues, resulting in false negatives.
Innovation Solution
A network assurance service dynamically adjusts the rescaling factor and quantile parameter of anomaly detectors using ranking feedback from anomaly rankers, applying an objective function to optimize these parameters and filter out irrelevant anomalies, thereby improving the relevance of reported issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly detection functions are set to be sensitive to detect more anomalies, then true positives increase, but false positives also increase leading to unnecessary alerts
Solution Approach 1:
The patent implements dynamic adjustment of prediction ranges for anomaly detectors based on feedback from anomaly rankers. The system continuously learns from ranked anomaly data and adapts the prediction ranges over time, transforming static detection thresholds into dynamic ones that optimize the balance between detecting true anomalies and filtering false positives.
Solution Approach 2:
The system incorporates feedback loops where anomaly rankers evaluate detected anomalies and provide ranking information back to the anomaly detectors. This feedback is used to recalibrate prediction ranges and detection sensitivity, creating a closed-loop system that continuously improves detection accuracy while reducing false positives.
2Object-generated harmful factors
If detection thresholds are set conservatively to reduce false positives, then unnecessary alerts decrease, but true anomalies are missed resulting in false negatives
Solution Approach 1:
Instead of using fixed conservative thresholds, the system dynamically adjusts detection sensitivity based on learned patterns from ranked anomaly data. The prediction ranges adapt to the specific characteristics of the network being monitored, allowing the system to maintain high detection accuracy without relying on overly conservative static thresholds.
Solution Approach 2:
The system changes the parameters of anomaly detectors (specifically prediction ranges and sensitivity thresholds) based on feedback from rankers. By adjusting these parameters dynamically rather than using fixed conservative values, the system achieves both reduced false positives and maintained detection accuracy.
3Reliability
If multiple anomaly detectors are deployed to improve detection coverage, then detection capability increases, but system complexity increases
Solution Approach 1:
The patent combines multiple anomaly detectors into a unified system that shares common infrastructure for feedback processing and parameter adjustment. By merging the detection functions and using a centralized feedback mechanism, the system achieves comprehensive detection coverage while avoiding the complexity of fully independent detector systems.
Solution Approach 2:
The feedback mechanism and parameter adjustment system serve multiple anomaly detectors simultaneously, making the system multi-functional. A single feedback processing pipeline calibrates multiple detectors, reducing overall system complexity compared to having separate adjustment mechanisms for each detector.
Data Source
AI summary
In one embodiment, a network assurance service that monitors a network detects anomalies in the network by applying one or more machine learning-based anomaly detectors to telemetry data from the network. The network assurance service receives ranking feedback from a plurality of anomaly rankers regarding relevancy of the detected anomalies. The network assurance service calculates a rescaling factor and quantile parameter by applying an objective function to the ranking feedback, in order to optimize the rescaling factor and quantile parameter of the one or more anomaly detectors. The network assurance service adjusts the rescaling factor and quantile parameter of the one or more anomaly detectors using the calculated rescaling factor and quantile parameter.