Log Analysis Using User Activity Volume

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing log analysis systems face challenges in accurately identifying abnormalities in computer system logs due to the high volume of user activity, which can lead to false indications of system problems.

Innovation Solution

A log analysis system comprising an activity engine, a baseline engine, and an abnormality engine that monitors user activity volume and compares it to an expected baseline to classify abnormalities, adjusting for seasonal patterns and user activity, thereby reducing false positives.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If log analysis is performed without considering user activity volume, then system abnormalities can be detected, but false indications of abnormalities increase due to high user activity volume

Engineering Contradiction:

Improveabnormality detection accuracyVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The patent introduces user activity volume as an intermediary variable that mediates between log entry quantity and abnormality detection. The system monitors user activity volume and uses it to adjust the baseline expectation for log entries, thereby reducing false positives while maintaining accurate abnormality detection

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system dynamically changes the parameter of baseline log entry expectations based on user activity volume. When user activity volume increases, the baseline for expected log entries is adjusted upward, allowing the system to distinguish between increased logging due to user activity versus increased logging due to system abnormalities

Inventive Principle:

Principle #35Parameter changes

2Loss of information

If log volume increases due to system problems, then more information is available for analysis, but it becomes more difficult to locate and interpret relevant information

Engineering Contradiction:

Improveinformation completenessVSAvoidrelevant information identification

Core Design Contradiction:

Loss of informationVSDifficulty of detecting and measuring

Solution Approach 1:

The patent extracts and separates the component of log volume that is attributable to user activity from the total log volume. By calculating the expected log entries based on user activity and subtracting this from the actual log volume, the system isolates the portion of logs that may indicate system abnormalities, making relevant information easier to identify

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system segments log analysis into two components: expected logs due to user activity and unexpected logs that may indicate abnormalities. This segmentation allows analysts to focus on the unexpected portion while understanding that the expected portion is normal operational noise

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11457029B2Log analysis based on user activity volume

Publication Date: 2022.09.27 MICRO FOCUS LLC

AI summary

In one example implementation, a log analysis system can comprise an activity engine to monitor user activity of a computer system, a baseline engine to generate an expected baseline of a log, and an abnormality engine to compare the log to the expected baseline to identify an abnormality, compare the abnormality to a user activity volume based on a correlation between the user activity volume and the log activity, and classify the log.