Event Analysis Apparatus Using Decision Tree Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In complex systems like computer networks, the large number of event occurrences logged daily makes sequential review time-consuming, and it is challenging for system managers to quickly identify significant events amidst insignificant ones, leading to potential delays in responsive actions.
Innovation Solution
An apparatus and method that quickly identify significant event occurrences by matching logged events with event rules using a multi-layer decision tree, normalizing data, and scoring them to prioritize analysis, facilitating quick review and responsive actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If sequential review of all logged event occurrences is performed, then complete coverage of all events is achieved, but review time becomes excessively long
Solution Approach 1:
The patent segments the event review process into multiple stages: initial filtering using decision trees to identify potentially significant events, followed by focused analysis only on those segmented events. This divides the overwhelming task of reviewing all events into manageable segments, achieving both completeness and efficiency.
Solution Approach 2:
The system performs preliminary actions by automatically filtering and scoring events before human review. Decision trees and scoring algorithms pre-process the event log to identify and prioritize significant events, so that when reviewers examine events, they are already pre-sorted and pre-analyzed, dramatically reducing review time while maintaining completeness.
2Reliability
If all logged event occurrences are analyzed in detail, then no significant events are missed, but the analysis process becomes time-consuming
Solution Approach 1:
The patent applies local quality by assigning different levels of analysis depth to different events based on their characteristics. Significant events identified by the decision tree receive detailed analysis, while insignificant events are quickly filtered out. This localized approach to analysis quality ensures reliable detection of important events without wasting time on trivial ones.
Solution Approach 2:
The system changes parameters dynamically by adjusting the threshold for detailed analysis based on event scores. Events above a certain score threshold undergo comprehensive analysis, while those below receive minimal processing. This parameter-based differentiation maintains detection reliability for critical events while improving overall analysis efficiency.
3Productivity
If automated filtering of event occurrences is implemented, then review speed increases, but the complexity of the system increases
Solution Approach 1:
The patent introduces intermediary components (decision trees, scoring algorithms, and filtering mechanisms) that mediate between the raw event log and human reviewers. These intermediaries automatically perform the complex filtering and scoring tasks, increasing review speed while managing system complexity through modular, rule-based approaches rather than requiring complex AI systems.
Data Source
AI summary
An apparatus and an associated method facilitate analysis of events associated with a network system. Event occurrence items are compared with event rules of an event rule set to determine whether the items are potentially significant. If considered to be potentially significant, a scorer assigns a score to the event occurrence item to provide a relative indication of the potential significance of the event occurrence item.