Log Anomaly Detection via Vector Space Modeling

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

As software development progresses, identifying and resolving issues in test logs becomes increasingly time-consuming and prone to errors due to the growing complexity and volume of test cases, making it difficult to pinpoint problems and root causes in code changes.

Innovation Solution

A computing system utilizes a vector space model to analyze test log data, comparing updated test results against a reference non-anomalous test performance space to identify anomalies by calculating deviation metrics, thereby flagging potentially problematic lines in the log data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If automated software testing is used to verify program behavior, then testing efficiency is improved, but the volume of test log data increases making analysis more difficult

Engineering Contradiction:
Improvetesting efficiencyVSAvoidtest log data volume
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The patent segments the large volume of test log data into individual log lines and further into tokens (words or phrases). Each log line is processed independently, converting text into numerical vectors. This segmentation transforms the overwhelming bulk data into manageable discrete units that can be analyzed systematically using vector space modeling and anomaly detection algorithms.

Inventive Principle:
Principle #1Segmentation

2Measurement precision

If manual analysis of test logs is performed, then detailed inspection is possible, but time consumption and human error increase

Engineering Contradiction:
Improvelog analysis accuracyVSAvoidanalysis time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent replaces the manual mechanical process of log analysis with an automated computational system. The system uses vector space modeling to convert log lines into numerical representations, then applies anomaly detection algorithms to automatically identify problematic patterns. This substitution eliminates human fatigue and error while processing vast volumes of logs quickly, maintaining high accuracy through systematic mathematical comparison against learned normal patterns.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If the number of test cases increases to cover more code, then code coverage is improved, but identifying root causes in failed tests becomes more difficult

Engineering Contradiction:
Improvecode coverageVSAvoidroot cause identification
Core Design Contradiction:
ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements feedback by continuously learning from test log patterns. The system builds a vector space model from historical logs representing normal test behavior, then uses this model to detect anomalies in new logs. When anomalies are detected, the system provides feedback by highlighting specific deviating log lines, guiding developers to the root cause. This feedback loop enables efficient root cause identification even as test case numbers grow, because the system adapts to new patterns while maintaining awareness of baseline behavior.

Inventive Principle:
Principle #23Feedback

Data Source

PatentUS20210342313A1Autobuild log anomaly detection methods and systems
Publication Date: 2021.11.04 SALESFORCE INC
  • US20210342313A1 patent drawing
  • US20210342313A1 patent drawing
  • US20210342313A1 patent drawing

AI summary

Computing systems, database systems, and related methods are provided for detecting anomalies within a log file. One method involves obtaining log data for test runs executed with respect to a compiled version of executable code for an application platform, filtering the log data based on one or more performance metrics to obtain reference log data, converting the reference log data to a corresponding numerical representation and generating a matrix of the numerical representation. For each line of test log data associated with an update to the executable code, the method converts the line into a numerical representation, determines a difference between the numerical representation and the matrix, and provides an indication of an anomaly when the difference is greater than a detection threshold.