Event Aggregation for Reducing Operator Workload
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Event detection systems face challenges in distinguishing between relevant and benign events, leading to 'constant red' issues due to event overflow, where numerous events overwhelm operators and obscure genuine issues.
Innovation Solution
An aggregation-based event identification apparatus and method that uses machine learning to cluster events, assign weights based on severity, abnormal behavior, and tagging, and prioritize events, reducing the number of source events and identifying unique, relevant ones through an event weighting module.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If event detection systems track and analyze all streams of information to detect events, then event detection completeness is improved, but event overflow occurs causing 'constant red' issues that overwhelm operators
Solution Approach 1:
The patent extracts and removes benign events from the event stream by comparing events against a library of known benign event patterns. The system identifies and filters out these non-critical events, keeping only the relevant ones that require operator attention, thereby resolving the event overflow problem while maintaining detection completeness for important events.
Solution Approach 2:
The patent changes the parameter of event evaluation by introducing a weighting mechanism that assigns different significance levels to different events. By transforming events into weighted scores based on their relevance, severity, and novelty, the system can prioritize and filter events effectively, preventing overflow while maintaining reliable detection of critical events.
2Measurement precision
If operators review all detected events to identify genuine issues, then event analysis thoroughness is improved, but operator workload increases due to event overflow
Solution Approach 1:
The patent introduces an automated event filtering and weighting system as an intermediary between event detection and operator review. This intermediary process pre-analyzes events, assigns relevance weights, and prioritizes them, so operators only need to review the filtered, high-priority events rather than all detected events, thereby reducing workload while maintaining analysis thoroughness.
Solution Approach 2:
The patent performs preliminary filtering and weighting of events before they reach operators. By pre-processing the event stream to identify and prioritize relevant events, the system prepares the data in advance, allowing operators to focus their attention only on the most important events without having to manually filter through all of them.
3Productivity
If the system reduces the number of events presented to operators, then operator efficiency is improved, but risk of missing relevant events increases
Solution Approach 1:
The patent transforms events into weighted scores by changing the parameter representation from binary event detection to continuous relevance scoring. This allows the system to reduce the number of events presented to operators while maintaining reliability, as the weighted scoring ensures that only events with sufficient relevance thresholds are shown, preventing important events from being filtered out.
Solution Approach 2:
The patent implements a feedback mechanism where the system continuously learns from operator interactions with filtered events. By monitoring which filtered events operators do review and adjusting the filtering and weighting parameters accordingly, the system improves its ability to identify relevant events, maintaining high identification accuracy even as the number of presented events is reduced.
Data Source
AI summary
According to an example, aggregation based event identification may include aggregating each of a plurality of source events by an event type of event types that represent dusters of the source events and/or a host of a source event of the source events to generate a reduced number of the source events. Aggregation based event identification may further include analyzing a characteristic for each of the reduced number of the source events, and assigning, based on the analysis of the characteristic for each of the reduced number of the source events, a characteristic weight to each of the reduced number of the source events. Further, aggregation based event identification may include aggregating the characteristic weights for each of the reduced number of the source events to determine an aggregated event issue weight for each of the reduced number of the source events.