Network Performance Data Channel Segmentation for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional automated analysis systems for network performance data struggle to provide sophisticated analysis due to limited sophistication in identifying anomalies, as they primarily analyze data as aggregates or distinct channels based on origin, lacking the ability to effectively utilize attribute combinations for deeper insights.
Innovation Solution
The method creates channels from data records based on unique attribute value combinations, allowing for the identification of channels meeting specific criteria, which can be further analyzed to report unique attribute value combinations, enabling more advanced analysis and decision tree-based diagnostics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If data records are analyzed as aggregates or distinct channels based on origin, then analysis simplicity is maintained, but analysis sophistication and anomaly detection capability are limited
Solution Approach 1:
The patent segments data records into multiple channels based on attribute values (e.g., link type, protocol, application). Each channel contains records with the same attribute value, allowing sophisticated analysis within each segment while maintaining overall system organization. This resolves the contradiction by enabling precise anomaly detection in segmented channels without requiring overly complex aggregate analysis.
Solution Approach 2:
The patent introduces a new dimension for data organization by creating channels based on attribute values rather than just origin. This multi-dimensional channel structure (combining origin, attribute values, and record types) enables sophisticated anomaly detection capabilities while keeping the analysis framework systematic and manageable, thus resolving the contradiction between complexity and precision.
2Measurement precision
If channels are created for each attribute value combination, then anomaly detection sophistication is improved, but system complexity increases
Solution Approach 1:
The system segments channels into hierarchical levels: first by origin, then by attribute values. This segmented approach allows precise anomaly detection within each segment while avoiding the complexity of analyzing all possible attribute combinations simultaneously. The segmentation principle enables sophisticated analysis through structured division rather than monolithic complexity.
Solution Approach 2:
The patent implements dynamic channel creation where channels are formed based on actual attribute values present in the data stream. Rather than pre-defining all possible channels, the system dynamically creates channels as needed, adapting to the data characteristics. This dynamic approach reduces unnecessary complexity while maintaining precision for actual anomaly detection scenarios.
3Adaptability or versatility
If multiple attributes are analyzed simultaneously, then diagnostic capability is enhanced, but processing complexity increases
Solution Approach 1:
The patent segments the analysis process into multiple passes: first analyzing channels by origin, then creating attribute-based channels from relevant results, and finally analyzing combinations. This segmented multi-pass approach enables comprehensive multi-attribute diagnostic capability while managing processing complexity through staged analysis rather than simultaneous processing of all attributes.
Solution Approach 2:
The system performs preliminary analysis to identify anomalous channels based on origin and individual attributes before conducting combined attribute analysis. This preliminary action filters the data set, reducing the complexity of subsequent multi-attribute analysis by focusing only on channels that require deeper diagnostic examination, thus enhancing diagnostic capability without proportionally increasing overall processing complexity.
Data Source
AI summary
Disclosed methods and systems create channels from a stream of data records relating to electronic data processing system performance. Each data record includes the attribute value for each of a plurality of attributes related to the electronic data processing system. A channel is created for each unique value of a selected attribute or each unique combination of values for a plurality of selected values. Each channel is analyzed to determine if it meets at least one criterion. The unique value or combination of values of a channel meeting the at least one criterion is reported. The foregoing steps may be repeated using the results of previous steps. At least once, a channel is created for each unique combination of attribute values for a plurality of selected attributes.