Graph-Based Anomaly Detection for Complex-System Root Cause Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Determining the cause of anomalies in complex systems, such as spikes in memory utilization or software crashes, is difficult due to the complexity of these systems.
Innovation Solution
A data analysis system that generates observed and anticipated graphs from timeseries data, using eigenvector analysis and Bayesian methods to identify contributing nodes and determine the root cause of anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If complex systems are analyzed to determine the cause of anomalies, then the accuracy of root cause identification is improved, but the complexity of the analysis process increases
Solution Approach 1:
The patent segments the complex system into multiple hierarchical levels (e.g., infrastructure level, platform level, application level). Each level is analyzed separately using graph representations, breaking down the overwhelming complexity into manageable segments that can be processed independently while maintaining overall system context.
Solution Approach 2:
The patent introduces a new dimension of analysis by representing system metrics as graphs with nodes and edges, rather than traditional time-series plots. This dimensional transformation allows for visual and computational analysis of system relationships and anomaly propagation paths that are not apparent in conventional metric representations.
2Ease of operation
If traditional anomaly detection methods are used, then the simplicity of the detection process is maintained, but the ability to identify contributing causes in complex systems deteriorates
Solution Approach 1:
The patent introduces graph representations as an intermediary layer between raw metric data and anomaly analysis. These graphs serve as a mediator that preserves rich system relationship information while providing a structured format that enables effective anomaly detection and root cause identification without requiring direct complex system analysis.
3Loss of information
If detailed analysis of all system metrics is performed, then the completeness of anomaly investigation is improved, but the time required for analysis increases
Solution Approach 1:
The patent performs preliminary actions by pre-processing metric data into graph representations that capture system relationships and dependencies before anomaly detection is needed. This preliminary structuring of data enables faster anomaly investigation because the heavy lifting of data organization and relationship mapping is already completed, allowing analysts to focus on identifying and resolving anomalies without starting from raw metrics.
Data Source
AI summary
A method of identifying a contributing cause of an anomaly including receiving a set of timeseries data representing metric values over time, wherein the timeseries data has at least two dimensions, for each of two or more of the timestamps in the set of timeseries data, generating a first and second graph representing (i) the metric values at that timestamp, (ii) the at least two dimensions at that timestamp, and (iii) associations between the metric values at that timestamp, analyzing the first and second graphs associated with each timestamp to identify a particular timestamp including an anomaly, and analyzing the first and second graphs associated with the identified particular timestamp to identify a node that contributed in causing the anomaly.