Monitoring Rule Configuration Using Explainable Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Configuring monitoring systems for cloud applications is time-consuming and requires significant engineering effort, necessitating an automated approach to streamline the process.
Innovation Solution
An automated configuration of monitoring systems using a combination of unsupervised anomaly detection and rule-based machine learning explainability techniques to generate alarm rule suggestions, which can be selectively implemented by DevOps engineers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration of monitoring systems is performed, then configuration accuracy and reliability are improved, but configuration time and engineering effort increase significantly
Solution Approach 1:
The system performs preliminary actions by automatically generating alarm rule suggestions before human review. The machine learning model analyzes historical data and generates configured rules in advance, so that when engineers need to set up monitoring, the heavy lifting of rule generation is already done, requiring only selective review and minor adjustments.
Solution Approach 2:
The monitoring system configures itself through automated machine learning algorithms that analyze historical data and generate alarm rules independently. The system serves itself by using its own historical performance data to automatically create monitoring configurations, eliminating the need for manual expert intervention in the core configuration task.
2Productivity
If automated configuration is implemented, then configuration time is reduced, but system complexity increases due to machine learning components
Solution Approach 1:
The machine learning model acts as an intermediary between raw historical data and the final alarm rule configurations. It mediates by transforming complex historical patterns into actionable, human-readable alarm rules, shielding engineers from the underlying computational complexity while delivering simplified, ready-to-use configurations.
Solution Approach 2:
The system creates copies of successfully configured alarm rules from historical data by analyzing past performance patterns. Instead of requiring engineers to create rules from scratch, the system generates copies of proven effective rules that can be directly applied or lightly modified, significantly reducing the complexity burden on human operators.
3Measurement precision
If machine learning models are used for anomaly detection, then detection accuracy is improved, but explainability and transparency decrease
Solution Approach 1:
Instead of using a black-box machine learning model that provides accurate predictions without explanation, the system inverts the approach by using interpretable rule-based models that naturally provide explainability. The rules are generated in a way that makes the decision logic transparent and auditable, combining both accuracy and explainability by design rather than compromising one for the other.
Solution Approach 2:
The system changes the parameter representation from complex model weights and thresholds to human-readable rule parameters. By transforming the internal model representations into explicit if-then rules with clear conditions and actions, the system maintains detection precision while making the decision parameters transparent and easily explainable to human users.
Data Source
AI summary
An automated monitoring system configuration uses a combination of an anomaly detection model and a rule-based explainability model for automating configuration of a monitoring system. A set of alarm rule suggestions is generated based on a set of time series signals by applying an unsupervised anomaly detection model to generate a set of labeled anomalies and applying a rule-based explainability model to generate alarm rules from the set of labeled anomalies. The monitoring system may be automatically configured with the set of alarm rule suggestions. Alternatively, the set of alarm rule suggestions may be presented to a user with controls for selecting or unselecting alarm rules. The automated configuration may determine a rule for each signal having a detected anomaly based on the selected rule providing the most increased coverage of the set of labeled anomalies. The automated configuration continues to add selected rules until a coverage threshold is reached.