Event Analysis System Outlier Visualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in timely detection and analysis of outliers in continuous data streams, which can lead to delayed response and potential false alarms, due to the large data size, continuous nature, and evolving data, making it difficult to identify system outages and performance degradation.
Innovation Solution
An event analysis system that monitors data streams to detect outliers by determining alert threshold values from historical data, generating a system health score, and visualizing correlations between event types to assist in identifying and investigating potential system outages, using modules for event intake, threshold modeling, outlier alerting, and visualization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional outlier detection methods are used on continuous data streams, then detection capability is limited, but data processing time increases and response delay occurs
Solution Approach 1:
The patent segments continuous data streams into discrete time windows or batches, allowing parallel processing of multiple segments. This enables the system to process large volumes of data efficiently while maintaining timely detection of outliers, resolving the contradiction between detection accuracy and response delay.
Solution Approach 2:
The system performs preliminary analysis by establishing baseline metrics and detection thresholds before actual outlier detection occurs. Historical data is pre-processed to create reference models, enabling faster real-time detection without compromising accuracy, thus reducing response delay while maintaining detection precision.
2Measurement precision
If comprehensive analysis of all outliers is performed, then detection accuracy improves, but false alarms increase
Solution Approach 1:
The system implements feedback mechanisms where detected outliers are analyzed in context of system state and historical patterns. The feedback loop allows the system to learn from false alarms and adjust detection sensitivity, maintaining high identification accuracy while reducing false positive rates through iterative optimization.
Solution Approach 2:
The patent dynamically adjusts detection parameters such as sensitivity thresholds and confidence levels based on system conditions and historical performance. By changing these parameters adaptively, the system maintains accurate outlier identification while minimizing false alarms under different operating conditions.
3Measurement precision
If detailed monitoring of all event types is implemented, then system health assessment accuracy improves, but system complexity increases
Solution Approach 1:
The system extracts and focuses on the most critical event types and metrics that have the greatest impact on system health. By taking out only the essential indicators for monitoring, the system maintains accurate health assessment while avoiding the complexity of analyzing every single event type in detail.
Solution Approach 2:
The patent creates a universal analysis framework that handles multiple event types through common processing logic and standardized metrics. This multi-functional approach allows detailed monitoring of diverse events without proportionally increasing system complexity, as the same core mechanisms serve multiple monitoring purposes.
Data Source
AI summary
An event analysis system receives events in a time-series from a set of monitored systems and identifies a set of alert threshold values for each of the types of events to identify outliers in the time-series at an evaluated time. Portions of historic event data is selected to identify windows of event data near the evaluated time at a set of seasonally-adjusted times to predict the value of the event type. The alert threshold value may also account for a prediction based on recent, higher-frequency events. Using the alert threshold values for a plurality of event types, the event data is compared with the alert threshold values to determine an alert level for the data. The event data types are also clustered and displayed with the alert levels to provide a visualization of the event data and identify outliers when the new event data is received.