Enterprise Device Anomaly Detection with ML-Guided Counterfactual Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing enterprise device management systems reactively detect anomalous devices only after user experience is compromised, prolonging remediation and aggravating issues, lacking proactive detection and automatic remediation capabilities.
Innovation Solution
A supervised machine learning model combined with an automated counterfactual generator predicts device anomalies and generates recommended remedial actions, using both categorical and numerical device attributes, enabling proactive detection and customized remediation before user experience is affected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reactive device monitoring is used, then existing device management systems can detect anomalies, but detection occurs only after user experience is compromised and remediation is prolonged
Solution Approach 1:
The system performs preliminary actions by proactively predicting device anomalies before they manifest as user-experience-compromising issues. The machine learning model continuously monitors device attributes and identifies potential problems in advance, enabling remediation to be performed before the anomaly actually affects users, thus reducing remediation time and improving reliability.
Solution Approach 2:
The system implements feedback loops where device monitoring data is continuously fed into the machine learning model, which then provides predictions about potential anomalies. This feedback mechanism enables the system to learn from historical data and improve its predictive accuracy over time, allowing for earlier detection and faster remediation.
2Loss of time
If proactive anomaly prediction is implemented, then device issues can be detected early, but the system complexity increases due to machine learning models and counterfactual generation
Solution Approach 1:
The system uses counterfactual generation to create virtual copies of actual device states. By generating synthetic representations of what device attributes would need to be for the device to be considered healthy, the system simplifies the complexity of predictive modeling into more intuitive comparisons between actual and counterfactual states, making the complex ML logic more manageable and explainable.
Solution Approach 2:
The system transforms complex multi-dimensional device states into simplified parameter comparisons by generating counterfactual versions of device attributes. This parameter transformation approach reduces the complexity of analyzing multiple device characteristics simultaneously by focusing on the differences between actual and counterfactual parameter values.
3Productivity
If automated remediation actions are generated, then admin work is streamlined, but the system must accommodate enterprise-specific policies and constraints
Solution Approach 1:
The system implements dynamic adaptability by allowing remediation recommendations to be adjusted based on enterprise-specific policies and constraints. The counterfactual generation process can be configured to respect organizational rules, and the system can dynamically adapt its recommendations to match the specific policy framework of each enterprise, maintaining both productivity and policy compliance.
Data Source
AI summary
A computer-implemented method for proactively detecting and remediating anomalous devices includes accessing, via a network, device attributes corresponding to enterprise devices within an enterprise network, providing the device attributes to a supervised machine learning model, and predicting, via the supervised machine learning model, whether each enterprise device is healthy or anomalous, where the enterprise device is predicted to be healthy unless the supervised machine learning model determines that the probability of the enterprise device being anomalous exceeds a specified confidence threshold. The method includes, for each enterprise device that is predicted to be anomalous, perturbing a portion of the corresponding device attributes via an automated counterfactual generator to generate synthetic data representative of counterfactual healthy devices. The method includes generating recommended remedial action(s) that will cause each enterprise device to approximate each counterfactual healthy device and causing surfacing, via a user interface, of the recommended remedial action(s).