Hierarchical Anomaly Detection for Application Telemetry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The high volume and velocity of data from software application telemetry generate millions of anomalies, making traditional anomaly detection methods computationally expensive and inefficient, with many anomalies being non-actionable due to sheer volume.
Innovation Solution
A system and method for anomaly detection that uses a hierarchical structure to label and roll-up errors, identifying more anomalous pivots and providing actionable insights, thereby reducing the number of anomalies that need to be addressed, and conserving resources by automatically detecting anomalies using telemetry data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection methods are used to process high volume telemetry data, then comprehensive anomaly detection coverage is achieved, but computational resources and processing time increase significantly
Solution Approach 1:
The patent segments the monolithic anomaly detection process into multiple hierarchical levels (individual anomaly detection, pivot-based grouping, roll-up aggregation). This segmentation allows the system to process anomalies at different granularities, focusing computational resources on significant anomalies while aggregating less critical ones, thereby reducing overall computational load while maintaining detection coverage.
Solution Approach 2:
The patent extracts and removes non-actionable anomalies from the processing stream through the roll-up mechanism. By identifying anomalies that can be aggregated into broader pivot categories, the system extracts only the essential, actionable anomalies for further processing, significantly reducing the volume of anomalies requiring detailed analysis and resource consumption.
2Reliability
If all detected anomalies are processed and addressed, then complete problem resolution is achieved, but the sheer volume makes many anomalies non-actionable and resource consumption increases
Solution Approach 1:
The patent merges multiple individual anomalies into broader pivot categories through the roll-up process. Anomalies that share common characteristics (same pivot, similar severity) are combined into aggregate metrics, allowing the system to address root causes that affect multiple instances simultaneously rather than processing each anomaly separately, thereby improving productivity while maintaining complete problem resolution.
Solution Approach 2:
The patent applies partial action by focusing processing resources on anomalies that meet specific criteria (actionable anomalies at appropriate severity thresholds) rather than processing every detected anomaly with equal depth. The roll-up mechanism enables the system to take sufficient action on critical anomalies while aggregating less critical ones, achieving effective problem resolution without the excessive resource consumption of processing all anomalies individually.
3Loss of information
If hierarchical roll-up of anomalies is implemented, then actionable insights are improved and computational resources are conserved, but the complexity of the detection system increases
Solution Approach 1:
The patent introduces a hierarchical dimension to the anomaly detection system, organizing anomalies from individual instances up through pivots to aggregated roll-ups. This dimensional hierarchy transforms the flat, exhaustive anomaly list into a structured hierarchy that preserves actionable information at each level while enabling efficient aggregation, managing system complexity through organized structure rather than monolithic processing.
4Measurement precision
If high volume of telemetry data is processed, then detection accuracy is improved, but processing time and computational expense increase
Solution Approach 1:
The patent performs preliminary aggregation and filtering of anomalies through the pivot and roll-up mechanisms before final analysis. By pre-processing anomalies into grouped categories with aggregated metrics, the system reduces the volume of data requiring detailed examination while preserving detection accuracy through maintained associations between individual anomalies and their aggregate contexts, thereby reducing processing time without sacrificing precision.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
In one example, a system includes an electronic processor configured to receive telemetry data originating from a plurality of client applications. The telemetry data includes data points associated with errors associated with one or more operations. The electronic processor also classifies the telemetry data based a plurality of classes of data, converts the plurality of classes of data into one or more metrics based on a plurality of dimensions, and aggregates the metrics for the classes of data by all the dimensions. The electronic processor accesses a predictive scoring model for a stored metric associated with a dimension of interest, determines a prediction error associated with the dimension of interest, detects an anomaly based on an item selected from the group consisting of the prediction error and a static threshold, and transmits an alert message, generates a bug report, and stores the bug report in a database.