Hierarchical Anomaly Score Computation for Network Sub-Components
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anomaly detection methods fail to accurately and explainably detect anomalies in hierarchical systems due to equal weighting of all input signals, leading to undetected incidents and difficulty in identifying responsible sub-components.
Innovation Solution
A hierarchical evaluation approach using a tree-like topological structure to compute anomaly scores, where each node represents a sub-component, with weights assigned based on topology and recursive aggregation functions to produce a system-wide anomaly score, allowing for real-time or offline detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If equal weighting is applied to all input signals in anomaly detection, then the computation is simple, but the accuracy deteriorates because devices with more signals unduly influence the final anomaly score
Solution Approach 1:
The patent applies local quality by assigning different weights to different child nodes based on their specific characteristics (number of signals, importance) rather than treating all nodes uniformly. This allows each local component to contribute proportionally to the parent node's anomaly score, resolving the contradiction between computational simplicity and accuracy.
2Ease of operation
If a single system-level anomaly score is computed, then the evaluation is straightforward, but the explainability deteriorates because it is hard to understand which sub-components are responsible for the anomaly
Solution Approach 1:
The patent segments the anomaly detection process into hierarchical levels, computing anomaly scores for each child node separately before aggregating them to the parent node. This segmentation preserves information about which specific sub-components contribute to the overall anomaly, maintaining explainability while keeping the evaluation process straightforward through the hierarchical structure.
Solution Approach 2:
The patent implements a nested hierarchical structure where anomaly scores are computed at multiple levels (child nodes within parent nodes, which are within the system root). Each level contains and contributes to the anomaly information of higher levels, allowing the system to maintain both overall evaluation and detailed component-level explanations simultaneously.
3Ease of manufacture
If conventional anomaly detection is applied to hierarchical systems, then the implementation is simple, but the detection accuracy deteriorates because subtle anomalies in sub-components are not detected
Solution Approach 1:
The patent segments the anomaly detection process into hierarchical levels, computing anomaly scores for each child node separately before aggregating them to the parent node. This segmentation preserves information about which specific sub-components contribute to the overall anomaly, maintaining explainability while keeping the evaluation process straightforward through the hierarchical structure.
Data Source
AI summary
Embodiments may include techniques for hierarchical evaluation of the anomaly level of a system and its sub-components using domain knowledge, so as to provide improved accuracy and explainability compared to conventional methods. For example a method of anomaly detection in a hierarchical computer network may comprise defining a tree-like topological structure which describes how the hierarchical computer network comprises sub-components, wherein each node of the tree-like topological structure represents a sub-component of the hierarchical computer network, and wherein at least some of the sub-components are monitored to generate signals indicating an operational condition of each sub-component, collecting a plurality of time-series of maximum absolute anomaly scores for each monitored signal, and computing an anomaly score for a root node of the tree-like topological structure.