Microservice Activity Graph for Enterprise Anomaly Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In production environments, human error or malicious activities can lead to improper data analysis, as dummy application instances may not be registered correctly, contaminating business decisions with testing data, necessitating a method to identify unusual user/application interactions without consuming resources meant for end users.

Innovation Solution

Modeling activities in the production environment as sequences of microservices, using a directed graph to determine unusual activities through statistical analysis of microservice invocation records, with a self-learning model that updates based on actual end-user behavioral patterns.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If statistical analysis of microservice invocation records is used to identify unusual activities, then measurement precision of unusual activities is improved, but use of energy by stationary object increases due to continuous monitoring and analysis operations

Engineering Contradiction:

Improvedetection accuracy of unusual activitiesVSAvoidcomputational resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by stationary object

Solution Approach 1:

The system pre-generates directed graphs representing normal user behavior patterns before monitoring begins. These graphs serve as reference models that eliminate the need for real-time statistical computation during actual monitoring, thereby maintaining high detection accuracy while minimizing continuous energy consumption.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of performing complex statistical analysis on live data streams, the system creates simplified copies of normal behavior patterns in the form of directed graphs. These graphical representations capture essential behavioral characteristics without requiring computationally intensive calculations during operation.

Inventive Principle:

Principle #26Copying

2Reliability

If continuous monitoring of production environment is implemented to identify unusual activities, then reliability of data analysis is improved, but productivity of end user services deteriorates due to resource consumption

Engineering Contradiction:

Improveaccuracy of business analysis dataVSAvoidend user service performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The monitoring system is segmented into offline preparation phase (creating directed graphs from historical data) and online detection phase (comparing current activities against pre-built graphs). This segmentation allows comprehensive monitoring for reliability while keeping online resource consumption minimal to preserve end user service productivity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Directed graphs serve as an intermediary representation between raw microservice invocation records and the detection logic. This intermediary structure enables efficient comparison and pattern matching without requiring direct complex statistical analysis of raw data streams during production operations.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Difficulty of detecting and measuring

If comprehensive activity analysis is performed on all application instances, then detection coverage of unusual activities is improved, but device complexity increases due to processing requirements

Engineering Contradiction:

Improvedetection coverage of unusual activitiesVSAvoidprocessing system complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The system applies different processing approaches to different data characteristics: directed graphs capture structural patterns of user workflows, while statistical analysis handles variability in timing and frequency. This localized application of appropriate analysis methods improves detection coverage without uniformly increasing complexity across all processing aspects.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS11386206B2Alerting unusual activities in an enterprise production environment

Publication Date: 2022.07.12 DELL PROD LP

AI summary

A system and method model activities in the production environment as sequences of microservices, and identify unusual activities by analyzing these sequences. In particular, a directed graph of usual activity is formed as a basis for determining unusual activities. Next, activities that were actually performed are determined by statistically analyzing records of microservice invocation in application diagnostic files. These activity sequences are overlaid on the directed graph to determine relative fit by using a trace coverage percentage score. Application instances or activities with low relative fit are deemed suspicious. If the low fit persists for an extended duration, then the instances or activities are deemed unusual and an individual is alerted to begin a manual review.