IT Server Anomaly Detection via Incident Consolidation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems for IT servers face challenges in maintaining a balance between true positive and false positive rates, leading to excessive alerts and potential overlooking of real incidents due to reliance on user-configured thresholds and lack of automation in server monitoring.
Innovation Solution
A system and method for anomaly detection in IT servers that incorporates a data import unit, detection framework database, model learners module, time-series anomaly detectors, Incident Consolidation And Filtering (ICAF) module, and ICAF Optimizer, which consolidates point anomalies into logical incident reports and continuously tunes parameters to optimize the balance between true and false positive rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly detection systems issue alerts for every detected anomaly to maintain high true positive rate, then real incidents are detected, but false positive rate increases and administrators ignore alerts
Solution Approach 1:
The patent merges multiple point anomalies into consolidated incident reports by grouping anomalies that occur within a time window and share similar characteristics. This consolidation reduces the number of separate alerts while maintaining detection of all underlying issues, thereby reducing false positives while preserving true positive detection through the aggregation logic that identifies patterns across multiple anomalies.
Solution Approach 2:
The patent introduces an intermediary consolidation layer between anomaly detection and alert notification. This intermediary processes raw anomaly points, applies filtering and grouping rules, and generates consolidated incident reports. This mediator filters out noise and redundant alerts while preserving significant incidents, resolving the contradiction between high detection rate and low false alarm rate.
2Object-generated harmful factors
If anomaly detection systems consolidate alerts to reduce false positives, then alert volume decreases, but detection of real incidents may be missed
Solution Approach 1:
The patent implements feedback mechanisms where consolidation rules and parameters are continuously optimized based on historical incident data and administrator responses. The system learns from past true positives and false positives, adjusting consolidation thresholds and time windows to ensure real incidents are not missed while maintaining false positive reduction. This adaptive feedback loop resolves the contradiction by dynamically balancing consolidation aggressiveness against detection sensitivity.
3Adaptability or versatility
If user-configured thresholds are used for anomaly detection, then detection rules can be customized, but automation is reduced and manual configuration is required
Solution Approach 1:
The patent enables the anomaly detection system to automatically learn and configure detection thresholds and consolidation parameters from historical server behavior data without requiring manual user configuration. The system performs self-service by analyzing patterns in normal and anomalous operations, automatically setting detection rules that adapt to changing server characteristics, thereby achieving both automation and adaptability simultaneously.
Solution Approach 2:
The patent dynamically changes detection and consolidation parameters based on learned server behavior patterns and historical incident data. Rather than using fixed user-configured thresholds, the system automatically adjusts sensitivity thresholds, time windows, and grouping parameters to optimize detection performance for each specific server and workload type, maintaining adaptability while eliminating manual configuration requirements.
Data Source
Figure 1
Figure 2
AI summary
The invention is a system and method for anomaly detection in IT servers using incident consolidation. The anomaly detection is done by measuring different computing performance features such as CPU load, memory consumption, I/O level of activity, etc. at some specific frequency and then, consolidating point anomalies to higher-level objects called incidents. Each incident is checked according to specific parameters and if the checked incident is found to be an anomaly incident, the incident triggers an incident alert, which is communicated to a system administrator.