Knowledge Graph Event Data for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anomalous behavior detection in IT environments requires extensive computational resources and data storage to perform behavioral modeling, making it inefficient for detecting a wide variety of anomalies.
Innovation Solution
The method employs a knowledge graph representation of event data to generate histograms on demand for common anomaly queries, using a system that maps event data into a common information model, transforms it into a knowledge graph, and stores it in an event store database, allowing for efficient anomaly detection by representing events as nodes and links with time series data attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional behavioral modeling is performed to detect anomalies, then anomaly detection capability is improved, but computational resource consumption increases significantly
Solution Approach 1:
The patent pre-processes event data into a knowledge graph format with encoded time series information during data ingestion, rather than performing computationally expensive behavioral modeling at query time. This preliminary structuring of data with embedded temporal patterns enables fast anomaly detection without repeated heavy computation
Solution Approach 2:
The patent creates a simplified knowledge graph representation that copies only the essential temporal and relational characteristics of the original event data. This compressed representation maintains anomaly detection capability while requiring minimal computational resources for querying and analysis
2Measurement precision
If extensive behavioral modeling is performed prior to receiving anomaly queries, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs data transformation and encoding into knowledge graph format during the data ingestion phase, preparing all necessary temporal and relational information in advance. This eliminates the need for time-consuming behavioral modeling when anomaly queries are received, achieving both accuracy and speed
3Reliability
If comprehensive event data is stored for anomaly detection, then detection coverage is improved, but data storage requirements increase
Solution Approach 1:
The patent extracts only the essential temporal and relational features from comprehensive event data, storing them in an encoded knowledge graph format. This selective extraction maintains the coverage needed for anomaly detection while dramatically reducing storage requirements by eliminating redundant raw data
Solution Approach 2:
The system transforms event data from raw format into an encoded knowledge graph representation, changing the data parameters from detailed raw events to compressed temporal patterns. This parameter transformation preserves detection coverage while reducing storage needs through efficient encoding
Data Source
AI summary
A technique for anomaly detection is disclosed. Event data is converted into a normalized common information model. The resulting data may be stored in an event data store database. Additionally, the resulting data may be stored in a knowledge graph representation in a knowledge graph database. The knowledge graph database efficiently stores event data to generate histograms on demand for common anomaly queries.