Multivariate Web Session Model for Outlier Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data-driven e-business environments face challenges in monitoring system health due to overwhelming data volumes, diverse data sources, and the risk of false alarms from individual statistical approaches, which can obscure important business events and diminish reporting credibility.
Innovation Solution
An automated web session analysis system that generates a multivariate model of normal network session activity to identify outliers and significant events, minimizing false alarms by analyzing the entire set of web session events and isolating the most likely causes of abnormal behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a selective individual (univariate) statistical approach is used to monitor important data sources, then the monitoring focus is simplified and easier to manage, but false alarms increase and important business events may be missed
Solution Approach 1:
The patent combines multiple univariate statistical monitors into a single multivariate statistical monitor that simultaneously evaluates multiple data sources. This merging approach maintains monitoring simplicity while reducing false alarms by considering the joint behavior and correlations among multiple variables, allowing the system to distinguish between normal fluctuations and genuine anomalies more effectively.
Solution Approach 2:
The multivariate statistical monitor serves multiple functions simultaneously: it monitors multiple data sources, detects correlations between them, identifies outliers, and provides a unified view of system health. This multi-functionality eliminates the need for separate univariate monitors for each data source, simplifying the monitoring approach while improving reliability through comprehensive analysis.
2Loss of information
If multiple diverse data sources are monitored individually, then comprehensive coverage of business events is achieved, but the garbage effect obscures important events and reduces monitoring effectiveness
Solution Approach 1:
The patent merges multiple diverse data sources into a unified multivariate statistical framework that processes them simultaneously. This combination maintains complete information coverage from all data sources while improving signal detection clarity by evaluating the joint distribution and correlations among variables, allowing important events to be distinguished from noise through their characteristic patterns in the multivariate space.
Solution Approach 2:
The multivariate statistical model acts as an intermediary that transforms raw data from multiple diverse sources into a standardized multivariate distribution representation. This intermediary processing layer preserves all information from individual sources while filtering out the garbage effect through statistical normalization and correlation analysis, making important events detectable despite the diversity and volume of input data.
3Measurement precision
If univariate statistical monitoring is used for each data source, then individual event detection is straightforward, but the system cannot identify causal relationships or holistic patterns in abnormal behavior
Solution Approach 1:
The patent merges individual univariate monitoring capabilities into a unified multivariate framework that preserves the precision of individual event detection while adding the ability to analyze causal relationships. The multivariate statistical model maintains sensitivity to individual variable anomalies while simultaneously evaluating their joint behavior and correlations, enabling the identification of causal patterns and holistic abnormal behavior that cannot be detected by univariate monitors alone.
Data Source
AI summary
A two-module system is created for automated web activity monitoring. A model is generated and model outliers are identified by the first module of the system. Reports are generated that identify the events based on their significance to the outliers. The model may be automatically and periodically regenerated for different historical time periods of the web sessions. New groups of events may be periodically extracted from new web sessions and applied to the previously generated model by the second module of the system. Model outliers may be identified from the new groups of events. The new events may be analyzed and reported to a web session operator based on their contribution to any identified outliers. Even if no outliers are detected, the new events having a most significant impact on web session operating conditions may be identified and reported in real-time.