Notification Suppression via Flapping Window Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern information technology systems face the challenge of managing flapping incidents, where notifications are repeatedly triggered as incidents switch between unresolved and resolved states, leading to excessive notification generation.
Innovation Solution
A notification management system estimates a flapping window based on historical data, grouping similar incidents and analyzing their flapping periods to suppress notifications during predicted flapping times, using a machine learning model and notification suppression windows to determine when to prevent notification generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If notifications are generated for every incident state change, then complete incident monitoring is achieved, but notification volume increases excessively due to flapping incidents
Solution Approach 1:
The system performs preliminary analysis of incident patterns using historical data before generating notifications. By predicting flapping windows in advance based on learned incident patterns, the system proactively determines which notifications should be suppressed, preventing notification storms before they occur while maintaining monitoring of all incident states
Solution Approach 2:
The system implements feedback mechanisms by continuously learning from incident resolution patterns and adjusting notification suppression decisions. Historical incident data is analyzed to refine predictions of flapping behavior, creating a closed-loop system that improves notification filtering accuracy over time while preserving important alerts
2Loss of information
If all incident notifications are transmitted to administrators, then complete information is provided, but administrator efficiency decreases due to alert fatigue
Solution Approach 1:
The system applies partial action by selectively transmitting only a subset of notifications to administrators. Instead of filtering based on simple thresholds, it uses pattern recognition to identify and suppress only those notifications representing predictable flapping behavior, while still delivering all non-flapping incident alerts, thus maintaining information completeness for important events while reducing noise
Solution Approach 2:
By pre-analyzing incident patterns and predicting flapping windows before notifications are generated, the system prepares suppression decisions in advance. This preliminary action allows the system to distinguish between meaningful incident state changes and predictable flapping behavior, ensuring administrators receive comprehensive information about actual problems while being protected from anticipated notification storms
3Quantity of substance
If notification suppression is applied to reduce flapping alerts, then notification volume decreases, but risk of missing important incidents increases
Solution Approach 1:
The system uses feedback from historical incident patterns to dynamically adjust suppression decisions. By continuously learning from resolved incidents and their flapping characteristics, the system refines its ability to distinguish between benign flapping and significant incident state changes, maintaining high detection accuracy while reducing notification volume
Solution Approach 2:
The system performs preliminary pattern recognition and prediction before suppression decisions are made. By analyzing historical data to identify flapping windows in advance, the system can confidently suppress notifications during predictable flapping periods while maintaining sensitivity to detect actual incident state changes that fall outside learned flapping patterns
Data Source
AI summary
Techniques for suppressing notifications are disclosed. An incident may repeatedly flap between various resolved and unresolved states. Furthermore, other incident attributes may flap between various states such as, for example, varying levels of incident severity. Each change in state results in the transmission of a notification. In order to reduce the number of notifications, the system estimates a flapping window for the incident based on the flapping behavior of prior incidents. The system computes a notification suppression window based at least in part on the estimated flapping window. The system suppresses notifications corresponding to changes in incident state that are detected during the notification suppression window. The notification suppression window may be extended in response to extending the estimated flapping window.