IT Anomaly Detection via Automated Interval Labeling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current automated systems for identifying unusual activity in IT systems are costly and error-prone due to the need for manual intervention in selecting time intervals for statistical modeling and labeling, which is both time-consuming and prone to errors.
Innovation Solution
A method that automatically categorizes historical IT messages into time intervals based on system data from multiple sources, creating a training set for anomaly detection using machine learning algorithms, and removes intervals corresponding to known events like startups, shutdowns, and standard/command activities to simplify the model creation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual selection of time intervals is performed by domain experts to build statistical models, then the accuracy of anomaly detection is improved, but the cost and time consumption increase significantly
Solution Approach 1:
The system performs self-service by automatically selecting time intervals using machine learning algorithms. The computer automatically analyzes message streams, identifies patterns, and selects intervals without human intervention, replacing the manual expert selection process while maintaining detection accuracy.
Solution Approach 2:
The manual mechanical process of expert selection is replaced with an automated computational system. Machine learning models and algorithms substitute the human expert's analytical work, using computational methods to identify and select relevant time intervals automatically.
2Reliability
If domain experts manually label time intervals for training sets, then the quality of anomaly detection model is improved, but the cost and error rate increase
Solution Approach 1:
The system automatically labels time intervals using machine learning algorithms and pattern recognition. The computer analyzes message streams and systematically categorizes intervals as normal or anomalous based on learned patterns, eliminating human labeling errors and reducing costs.
Solution Approach 2:
The system creates accurate copies of expert knowledge through machine learning models. By training on labeled data, the system learns to replicate expert judgment and labeling decisions, achieving high model quality without requiring ongoing manual expert intervention.
3Adaptability or versatility
If all time intervals are used to create statistical models, then the comprehensiveness of analysis is improved, but the inclusion of irrelevant intervals (startups, shutdowns, standard activities) reduces detection accuracy
Solution Approach 1:
The system extracts and removes irrelevant intervals from the analysis. Machine learning algorithms identify and exclude intervals corresponding to startups, shutdowns, and standard activities, separating useful data from noise while maintaining comprehensive analysis of relevant anomalies.
Solution Approach 2:
The system segments time intervals into different categories based on their characteristics. By dividing the message stream into distinct intervals and classifying them, the system can selectively analyze only those intervals that contain meaningful anomaly information while excluding routine activities.
Data Source
AI summary
Embodiments include identifying unusual activity in an IT system based on user configurable message anomaly scoring. Aspects include receiving a message stream for the IT system and dividing the message stream into a plurality of intervals, wherein each interval corresponds to a time period. Aspects also include identifying and removing one or more intervals from the plurality of intervals that include a startup or a shutdown of an element of the IT system, identifying and removing one or more intervals from the plurality of intervals that correspond to a standard level of command activity and an elevated level of user complaint activity, and identifying and removing one or more intervals from the plurality of intervals that correspond to an elevated level of command activity and an standard level of user complaint activity. Aspects further include creating a training set of intervals that consists of the remaining labelled intervals.