Filter Rule Generation via Co-occurrence Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing monitoring systems face challenges in efficiently filtering messages from multiple information processing systems, leading to an overload of messages due to repeated or similar events, which hampers the ability to identify and handle critical events promptly.
Innovation Solution
A filter rule generation apparatus that analyzes co-occurrence probabilities among message logs from multiple systems, clusters systems based on similarity, and generates rules to aggregate or select messages, thereby reducing the volume of messages and improving filtering efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a monitoring system collects messages from multiple information processing systems, then the monitoring coverage is improved, but the message volume increases leading to operator overload
Solution Approach 1:
The patent merges message logs from multiple information processing systems into a unified dataset for co-occurrence analysis. By combining logs from different systems, the monitoring coverage is expanded while enabling the detection of cross-system message patterns, thereby addressing the contradiction between broader monitoring and manageable message volume.
Solution Approach 2:
The patent extracts co-occurrence relationships from the combined message logs to identify patterns where messages appear together across different systems. This extraction process separates the essential monitoring information (co-occurrence patterns) from the redundant raw message volume, allowing comprehensive monitoring with reduced operational burden.
2Measurement precision
If filter rules are generated based on co-occurrence probability, then the filtering accuracy is improved, but the computational complexity increases
Solution Approach 1:
The patent performs preliminary co-occurrence analysis on historical message logs before actual filtering operations. By pre-calculating co-occurrence probabilities and storing them as reference data, the system establishes filtering rules in advance, thereby achieving high filtering accuracy without computing complexity during real-time message processing.
Solution Approach 2:
The patent focuses computational resources on analyzing only the co-occurrence relationships between messages rather than processing every message individually. This partial action approach concentrates computational effort on the most critical pattern recognition task, achieving effective filtering with manageable computational complexity.
3Productivity
If messages are aggregated based on co-occurrence patterns, then the number of notifications is reduced, but the information detail is lost
Solution Approach 1:
The patent applies different levels of aggregation to different co-occurrence patterns. For frequently occurring message groups with high co-occurrence probability, aggressive aggregation is applied to reduce notifications. For less common patterns, more detailed reporting is maintained. This localized quality adjustment balances notification efficiency with information preservation based on the specific characteristics of each message pattern.
Data Source
AI summary
A filter rule generation apparatus includes a storage unit and a processor. The storage unit is configured to store instructions. The processor, in accordance with each of the instructions stored on the storage unit, executes a process that causes the filter rule generation apparatus to perform extracting a co-occurrence message group per system, based on a co-occurrence probability, from a plurality of logs in which messages are accumulated, the messages being generated within systems, first generating value information representing a degree of similarity in operation between the systems, based on the extracted co-occurrence message group, clustering the systems, based on the value information, and second generating a rule for extracting messages from the logs of the systems included in each cluster, based on the co-occurrence message group in the cluster generated by the clustering.