Machine Learning Model for False Positive Network Event Detection

Solution Overview

Problem

In microservices architecture cloud environments, the failure of a single network component can trigger cascading failures, leading to critical issues where software engineers spend excessive time identifying the root cause of network anomalies, often encountering false positive indicators that divert attention from the actual problem.

Innovation Solution

A method utilizing a machine learning model trained with historic anomaly network event data to differentiate between false positive and active network event indicators, applying real-time data for analysis to determine which anomalies are false positives and which are active, thereby streamlining the identification of root causes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If engineers manually analyze network event data to identify root causes, then they can investigate anomalies in detail, but the time required increases significantly due to false positive indicators

Engineering Contradiction:

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

A machine learning model is introduced as an intermediary between network monitoring systems and engineers. The model processes network event data, filters out false positive indicators, and presents only relevant information, thereby reducing the time engineers spend analyzing data while maintaining diagnostic accuracy.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs self-service by automatically detecting and filtering false positive indicators using machine learning algorithms. The model continuously learns from network event patterns to improve its ability to distinguish between actual issues and false alarms, reducing the burden on engineers without requiring constant human intervention.

Inventive Principle:

Principle #25Self-service

2Reliability

If engineers review all network event indicators, then they ensure comprehensive coverage, but false positive indicators divert attention from actual problems

Engineering Contradiction:

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The machine learning model extracts and isolates false positive indicators from the overall network event data. By separating harmful false alarms from useful information, the system enables engineers to focus only on genuine anomalies, improving operational efficiency while maintaining comprehensive detection through the model's thorough analysis of all event data.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system incorporates feedback mechanisms where engineers' resolutions of actual problems provide training data for the machine learning model. This feedback loop continuously improves the model's ability to distinguish between false positives and real issues, enhancing both the reliability of detection and the ease of operation over time.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12061516B2Determining false positive and active event data

Publication Date: 2024.08.13

AI summary

In one example of the present disclosure, a method for determining false positive and active indications is disclosed. The method may apply anomaly network event data to a machine learning model. The machine learning model is trained with historic and correlated anomaly network event data. The method then determines which one of the anomaly network event data is a false positive indication and which one is an active indication.