Log Analyzer Tree Structure for Cloud Fault Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current fault detection methods in cloud platforms are inefficient, relying on user feedback, manual configuration, and resource-intensive automated test suites, which can lead to delayed fault detection and performance degradation, especially in complex systems with numerous hardware and software failure points.
Innovation Solution
A tree-based structure is built using historical log records to represent normal system behavior, allowing for real-time anomaly detection in live log records, with a mechanism to verify if anomalies indicate actual faults and update the system to prevent false positives, enabling automatic and efficient fault detection without expert input.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automated test suites are used to detect faults, then fault detection capability is improved, but system resources are consumed and service availability deteriorates
Solution Approach 1:
The system builds a tree structure representing normal system behavior in advance using historical log data. This preliminary model allows the system to detect faults by comparing live logs against the pre-established normal behavior pattern, eliminating the need for resource-intensive automated test suites during operation and thus maintaining service availability while preserving fault detection capability
Solution Approach 2:
Instead of using actual automated test suites that consume system resources, the patent creates a copy or representation of normal system behavior through a tree structure built from historical logs. This copy serves as a reference model for fault detection without requiring the original test infrastructure, thereby avoiding resource consumption and service degradation
2Use of energy by moving object
If manual fault detection methods are used, then resource consumption is reduced, but fault detection speed and efficiency deteriorate
Solution Approach 1:
The system performs self-service by automatically building and maintaining a tree structure representing normal behavior from historical logs, and automatically comparing live logs against this structure. This eliminates the need for manual fault detection while maintaining low resource consumption, as the system uses its own historical data to create the detection model without requiring external expert intervention or additional heavy resources
Solution Approach 2:
The tree structure representing normal system behavior is built in advance using historical log data. This preliminary preparation enables fast automated comparison with live logs, achieving both low resource consumption during operation and high fault detection speed through efficient pattern matching against the pre-built model
3Measurement precision
If automated fault detection is implemented, then fault detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex task of fault detection into two distinct phases: (1) building a tree structure from historical logs that captures normal behavior patterns, and (2) comparing live logs against this tree structure to detect anomalies. This segmentation simplifies the overall system by breaking down the complex pattern recognition problem into manageable components with clear interfaces, improving detectability while controlling system complexity
Data Source
AI summary
Apparatuses and methods for anomaly detection. In one embodiment, a method is implemented in a computing device for building a tree structure to represent a system behavior includes obtaining one or more training log records; and building a tree structure using the one or more training log records. The tree structure includes a plurality of tree nodes. Each successive tree node in a root-to-leaf path of the tree structure representing successive log elements of the one or more training log records. Each of the one or more training log records includes one or more log elements. In one embodiment, a method implemented in a computing device for fault detection includes obtaining a live log record and determining an anomaly in the live log record by comparing corresponding successive elements of the live log record to successive nodes in a root-to-leaf direction of the tree structure.