Holo-entropy Adaptive Boosting for VM Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer virtualization, it is challenging to discern anomalous behaviors of processes running in virtual machines, especially when there is limited historical data on normal behaviors, making it difficult to determine whether data is normal or abnormal.
Innovation Solution
The implementation of a holo-entropy adaptive boosting model, which generates a plurality of holo-entropy models and associated weights to combine outputs, allowing for the determination of whether additional data is normal or abnormal relative to a set of normal data, using a method that includes training the model with normal data and applying it to detect anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection methods are used with limited historical normal data, then the detection system can be implemented, but the reliability of anomaly detection deteriorates due to insufficient training data
Solution Approach 1:
The patent segments the anomaly detection task into multiple specialized detectors, each trained on different aspects or features of normal behavior. This segmentation allows the system to make effective use of limited data by focusing each detector on specific patterns, thereby improving overall detection reliability without requiring large amounts of comprehensive historical data.
Solution Approach 2:
The patent employs a composite detection framework that combines multiple detectors with different detection mechanisms and data requirements. By integrating diverse detection approaches (e.g., statistical methods, machine learning models, rule-based systems), the system achieves robust anomaly detection reliability even when individual detectors are trained on limited data subsets.
2Measurement precision
If multiple detection models are combined to improve detection accuracy, then the measurement precision of anomaly detection improves, but the device complexity increases
Solution Approach 1:
The patent divides the complex detection task into multiple specialized detectors, each responsible for specific anomaly patterns. This segmentation improves detection precision by allowing each detector to specialize in particular aspects of anomaly detection, while the modular structure manages complexity through clear division of responsibilities.
Solution Approach 2:
The patent introduces intermediary components such as feature extraction layers, data preprocessing modules, and standardized interfaces between detectors and the decision-making system. These intermediaries simplify the integration of multiple detectors by providing uniform data formats and decision aggregation mechanisms, thereby managing system complexity while maintaining high detection precision.
3Measurement precision
If anomaly detection sensitivity is increased to detect more anomalies, then the measurement precision improves, but the loss of information increases due to more false positives
Solution Approach 1:
The patent segments the detection system into multiple specialized detectors that each focus on different anomaly indicators. This segmentation allows the system to maintain high sensitivity for detecting various types of anomalies while reducing false positives by distributing detection responsibilities across multiple specialists rather than using a single high-threshold detector.
Solution Approach 2:
The patent implements feedback mechanisms where detection results from multiple detectors are aggregated and used to adjust detection thresholds and parameters. This feedback loop allows the system to maintain high sensitivity while dynamically adjusting to minimize false positives, as the collective decision-making process incorporates information from all detectors to validate anomaly detections.
Data Source
AI summary
A computer-implemented method for determining whether data is anomalous includes generating a holo-entropy adaptive boosting model using, at least in part, a set of normal data. The holo-entropy adaptive boosting model includes a plurality of holo-entropy models and associated model weights for combining outputs of the plurality of holo-entropy models. The method further includes receiving additional data, and determining at least one of whether the additional data is normal or abnormal relative to the set of normal data or a score indicative of how abnormal the additional data is using, at least in part, the generated holo-entropy adaptive boosting model.