Event Data Summarization for Accurate Anomaly Query Response

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for identifying anomalous network activity require large storage space and can result in missed or inaccurate results due to sampling data, leading to inefficient storage and processing of event data.

Innovation Solution

A processor implements a query on tracked event data without sampling, filtering and summarizing event data to match defined criteria, reducing file size and improving efficiency in storage and bandwidth usage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If sampling data is used to identify anomalous network activity, then processing speed is improved, but measurement precision deteriorates leading to missed or inaccurate results

Engineering Contradiction:

Improveprocessing speedVSAvoidaccuracy of anomaly detection

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system performs preliminary filtering and summarization of event data before anomaly detection, pre-processing the data to extract relevant features and patterns. This preliminary action reduces the data volume that requires detailed analysis while preserving the information needed for accurate anomaly detection, thus improving processing speed without sacrificing measurement precision.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If all event data is stored and processed without summarization, then measurement precision is improved, but loss of substance worsens due to excessive storage requirements

Engineering Contradiction:

Improveaccuracy of analysisVSAvoidstorage space consumption

Core Design Contradiction:

Measurement precisionVSLoss of substance

Solution Approach 1:

The system extracts only the essential features and patterns from the complete event data through summarization, separating the critical information needed for anomaly detection from the redundant data. This extraction process maintains measurement precision by preserving the key characteristics while significantly reducing storage space consumption by eliminating unnecessary data.

Inventive Principle:

Principle #2Taking out (Extraction)

3Loss of substance

If summarized event data is generated, then loss of substance is reduced through smaller file sizes, but loss of information may occur if summarization is too aggressive

Engineering Contradiction:

Improvefile size reductionVSAvoiddata completeness

Core Design Contradiction:

Loss of substanceVSLoss of information

Solution Approach 1:

The system changes the parameters of event data representation through controlled summarization, transforming detailed event records into condensed summaries that retain essential characteristics. By carefully adjusting the summarization parameters to preserve anomaly-relevant features while reducing file size, the system achieves compression without significant information loss.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentEP4014112B1Summarized event data responsive to a query

Publication Date: 2026.02.11 MICROSOFT TECHNOLOGY LICENSING LLC

Figure 1
Figure 2
Figure 3

AI summary

According to examples, an apparatus may include a processor and a computer readable medium on which is stored machine readable instructions that may cause the processor to receive a query, in which the query may define an event pertaining to the apparatus to be identified and summarization instructions. The processor may also implement the query on tracked events pertaining to the apparatus to identify event data pertaining to the apparatus that matches the event defined in the query and summarize the identified event data according to the summarization instructions to generate summarized event data responsive to the query. The processor may further output the summarized event data.