Event Analysis System Using Meta-Content Segmentation for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer system monitoring solutions are niche, definition-based, and reliant on user input, leading to false positives and negatives, limited detection capability, and high operational costs due to manual maintenance and lack of real-time analysis.
Innovation Solution
A method and apparatus that split events into meta and content parts, comparing meta parts to determine newness and storing both for analysis, allowing for real-time identification of deviations and root-cause analysis without pre-defined structures or formats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If definition-based approaches are used for event monitoring, then specific problems can be detected, but false positives and false negatives increase
Solution Approach 1:
The event is divided into a meta part (structure/format) and a content part (actual data). This segmentation allows the system to separately analyze the structure against learned patterns and the content against specific definitions, improving detection accuracy while reducing false positives by not requiring perfect matches on all fields.
Solution Approach 2:
The system performs preliminary learning of event structures and patterns before actual monitoring begins. By pre-learning what normal event structures look like across different sources, the system establishes a baseline that reduces false positives during operational monitoring without requiring complex real-time analysis.
2Adaptability or versatility
If multiple niche monitoring solutions are adopted to cover specific problems, then specific detection capabilities are improved, but gaps and blind spots remain
Solution Approach 1:
The system is designed to handle multiple event types and sources through a single unified platform. By learning the structure of different event types during the learning phase and using source-agnostic processing, one system can replace multiple niche solutions while maintaining comprehensive detection coverage across infrastructure, security, and application events.
Solution Approach 2:
The system adds a structural analysis dimension to traditional content-based monitoring. By analyzing both the meta structure and content of events simultaneously, the system detects patterns that span across different event types and sources, eliminating blind spots that single-purpose tools cannot see.
3Productivity
If real-time analysis is implemented, then incident detection speed is improved, but computational resources and costs increase
Solution Approach 1:
The system performs computationally intensive learning and pattern recognition during offline training phases, building models of normal event structures and patterns. During real-time operation, it only needs to compare incoming events against these pre-built models, dramatically reducing computational costs while maintaining fast detection speeds.
Solution Approach 2:
By segmenting events into meta and content parts, the system can efficiently process the structured meta part through fast pattern matching algorithms while applying more intensive analysis only to the content part when necessary, optimizing the balance between real-time performance and computational resource usage.
Data Source
AI summary
A method, an apparatus and computer program for analyzing events in a computer system, the method comprises receiving an event, splitting the event into a meta part and a content part. The method further comprises comparing the meta part by matching the meta part with meta parts from previous events. The method further comprises determining that the meta part is new, and when the meta part is determined new storing the meta part and the content part. The method further comprises wherein when the meta part is determined not new, comparing the content part by matching with previous content parts with the same meta part. The method further comprises determining that the content part is new, and when the content part is determined new, storing the content part, thereby enabling analyzing events in a computer system and presenting events as new.