Event Aggregation by Code Values to Cut Alert Overload
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing event monitoring systems burden administrators with indiscriminate notifications, leading to inefficient handling and potential oversight of critical events.
Innovation Solution
An event processing system that collects and groups events based on code values, regenerates them into single events, filters unnecessary events, and performs automatic actions, using predefined rules and machine learning models to streamline notifications and enhance efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If administrators are notified of all events indiscriminately, then complete event information is provided to administrators, but administrator workload increases and efficiency decreases
Solution Approach 1:
The patent segments events into different categories based on code values indicating originating service devices or services provided. Events are divided into groups that can be processed differently - some requiring administrator notification while others can be handled automatically or suppressed, thus reducing unnecessary notifications while maintaining information completeness for important events.
Solution Approach 2:
Different processing qualities are applied to different events based on their characteristics. Critical events receive full administrator notification while less important events undergo automatic processing or suppression. This local differentiation ensures important information is preserved while reducing overall notification burden on administrators.
2Reliability
If multiple events are processed individually, then each event receives appropriate attention, but notification frequency increases and administrator burden increases
Solution Approach 1:
Multiple events with the same code values indicating they originate from the same service device or service are merged into a single representative event. This combining approach reduces notification frequency while maintaining reliable processing of distinct event types, as each merged event still represents a unique category that requires attention.
3Reliability
If all events are notified to administrators, then no important events are overlooked, but unnecessary events consume administrator time and resources
Solution Approach 1:
The system performs preliminary classification of events based on code values before administrator notification. By pre-processing events to identify their origin and type, the system can automatically route appropriate events to administrators while handling others through automated processes, thus maintaining detection accuracy without overwhelming administrators with unnecessary notifications.
4Productivity
If events are grouped and regenerated into single events, then notification frequency is reduced, but event processing complexity increases
Solution Approach 1:
The system changes the parameter of event representation by regenerating multiple events into a single consolidated event with aggregated information. This parameter transformation reduces notification frequency while managing processing complexity through systematic rules for event consolidation, allowing efficient processing without excessive complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An event processing method performed by at least one computing device is provided. The method may include collecting a plurality of events; grouping at least some of the collected plurality of events based on code values respectively associated with the collected plurality of events, wherein the code values indicate at least one of originating service devices in which the plurality of events have occurred or services provided by the originating service devices; and regenerating the grouped events into a single event.