Log File Anomaly Detection via Event Sequence Parsing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Analyzing large volumes of log files to determine the root cause of anomalous behavior in computing systems is complex and laborious, especially when multiple modules or devices are involved, as it requires reviewing numerous log files and correlating event records to identify deviations from expected sequences or out-of-bound values.
Innovation Solution
The approach involves parsing event records to extract static and mutable portions, associating them with numeric identifiers, and using a sequential event model, such as a neural network, to analyze these identifiers and determine anomalies, thereby simplifying the identification of anomalous behavior and its root cause.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis of log files is performed to identify root cause of anomalies, then measurement precision is improved, but loss of time increases
Solution Approach 1:
The patent introduces an intermediary system comprising a log parser, event sequence generator, and anomaly detector that acts as a mediator between raw log files and human analysts. This intermediary automatically processes log files, extracts event sequences, and identifies anomalies, thereby maintaining high detection accuracy while dramatically reducing the time required for analysis.
Solution Approach 2:
The patent replaces the manual mechanical process of log file analysis with an automated computational system. The system uses algorithms to parse logs, generate event sequences, and detect anomalies automatically, substituting human manual effort with machine-based processing that is both accurate and time-efficient.
2Reliability
If comprehensive log file analysis is performed to identify root cause, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent segments the complex log file analysis process into distinct modular components: a log parser module that extracts events, an event sequence generator module that orders events, and an anomaly detector module that identifies deviations. This segmentation reduces system complexity by breaking down the monolithic analysis task into manageable, independent modules while maintaining comprehensive analysis capability.
Solution Approach 2:
The patent introduces intermediary processing layers (log parser and event sequence generator) that simplify the interface between raw complex log data and the anomaly detection logic. These intermediaries structure and preprocess data, making the overall system more manageable and less complex while improving reliability through systematic processing.
3Measurement precision
If multiple log files are correlated to determine root cause, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent merges multiple log files into a unified event sequence by parsing events from different sources and correlating them through a common temporal and causal framework. This merging process maintains high detection accuracy by considering cross-file correlations while reducing complexity through standardized event representation and sequence generation.
Data Source
AI summary
Examples of analyzing a log file are described. In an example, a log file comprising a plurality of event records is obtained from a computing device. The event records in the plurality of log files may be processed. Thereafter, an occurrence of anomaly in the log file may be ascertained.