Machine Learning Alert Grouping with Temporal Constraints

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The increasing volume and diversity of machine data in IT environments pose challenges for efficient analysis and monitoring, as conventional systems discard raw data during pre-processing, leading to a need for effective alert grouping and analysis methods that can handle massive quantities of minimally processed data.

Innovation Solution

An event-based data intake and query system with a late-binding schema allows for flexible data processing and storage, enabling users to analyze all generated data and automatically tune alert grouping based on user feedback through a common information model across disparate data sources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If raw data is stored for later analysis, then data analysis flexibility is improved, but storage cost and data management complexity increase

Engineering Contradiction:

Improvedata analysis flexibilityVSAvoiddata management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system performs preliminary actions by ingesting and storing all raw machine data without pre-processing or filtering. This allows complete data to be available for future analysis while the complexity of data processing is deferred to query time rather than ingestion time, resolving the contradiction between data flexibility and management complexity.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary layer (the data intake and query system) that sits between data sources and analysis tools. This intermediary handles the complexity of storing and managing raw data from multiple sources, while presenting a simplified interface for querying and analysis, thus resolving the contradiction between data flexibility and management complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If all generated data is analyzed, then insight quality is improved, but processing time and computational resources increase

Engineering Contradiction:

Improveinsight qualityVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system dynamically adapts its processing based on query requirements. Rather than statically processing all data uniformly, it dynamically filters and processes only the relevant portions of raw data needed for each specific analysis task, thereby maintaining high insight quality while reducing processing time and computational resource consumption.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent changes the parameter of data processing from static pre-processing to dynamic query-time processing. By altering when and how data is processed based on specific analysis needs, the system achieves both high insight quality and efficient resource utilization, resolving the contradiction between insight quality and processing time.

Inventive Principle:

Principle #35Parameter changes

3Adaptability or versatility

If alert volume increases with more data, then monitoring coverage is improved, but alert usefulness decreases due to parsing difficulty

Engineering Contradiction:

Improvemonitoring coverageVSAvoidalert parsing ease

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The system merges multiple related alerts into unified alert groups based on their relationships and temporal proximity. This consolidation reduces the total number of individual alerts administrators must parse while maintaining comprehensive monitoring coverage, as related issues are presented together in a structured format that is easier to analyze and respond to.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent implements feedback mechanisms where the system learns from administrator interactions with grouped alerts. By analyzing how administrators interact with alert groupings, the system refines its grouping logic to better match user needs and preferences, thereby improving alert usefulness and parsing ease while maintaining comprehensive monitoring coverage.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12182169B1Systems and methods for machine-learning based alert grouping including temporal constraints

Publication Date: 2024.12.31 CISCO TECHNOLOGY INC

AI summary

A computerized method is disclosed for grouping alerts through machine learning while implementing certain time constraints. The method includes receiving an alert to be assigned to any of a plurality of existing issues or to a newly created issue, the alert including a temporal field that includes a timestamp of an arrival time of the alert, wherein an issue is a grouping of one or more alerts, determining a subset of existing issues from the plurality of existing issues that each satisfy time constraints, wherein the time constraints correspond to (i) a time elapsed between a most recent alert of a first existing issue and a timestamp of the alert, or (ii) a maximum issue time length of the first existing issue, and deploying a trained machine learning model to assign the alert to either an existing issue of the subset of existing issues or a newly created issue.