OT Alert Handler Routing via Weighted Confirmation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing alert handling systems in Operational Technology (OT) environments struggle to efficiently determine the appropriate handler for status confirmation of alerts, often leading to inefficient analysis due to insufficient information and unnecessary inquiries to site administrators.
Innovation Solution
An alert handling notification method that receives alerts indicating anomalies in OT environments, identifies corresponding confirmation information items, and determines the most appropriate handler between a first handler (analyst) and a second handler (administrator) based on predefined weights and confirmation item content, thereby streamlining status confirmations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all alerts are notified to all handlers for status confirmation, then no alert is missed, but the handling time and complexity increase significantly
Solution Approach 1:
The patent applies local quality by assigning different confirmation information items to different handlers based on the alert type. Each handler receives only the confirmation items relevant to their expertise and role, rather than all handlers receiving all confirmation items. This selective distribution reduces unnecessary communication overhead while ensuring that the right person receives the right information for efficient status confirmation.
2Reliability
If multiple handlers confirm status for each alert, then comprehensive coverage is achieved, but the complexity of determination and notification increases
Solution Approach 1:
The patent segments the alert handling process by dividing confirmation information items into different categories and assigning them to different handlers based on alert types. The determination unit segments the decision-making process by evaluating alert characteristics against predefined criteria to identify the most appropriate handler for each specific confirmation item, rather than using a complex multi-handler approach for all alerts.
Solution Approach 2:
The notification unit automatically notifies the determined handler of the specific confirmation information items relevant to that handler's role and expertise. The system serves itself by autonomously matching alert characteristics with appropriate handlers and delivering tailored notifications, eliminating the need for manual routing decisions and reducing overall system complexity.
3Loss of information
If handlers receive all confirmation information items, then complete information is available, but the notification efficiency decreases
Solution Approach 1:
The patent implements local quality by tailoring the information content of notifications to the specific handler and alert type. Each handler receives only the confirmation information items that are relevant to their role, expertise, and the specific alert being handled. This selective information delivery maintains completeness of necessary information while eliminating redundant notifications, thereby improving notification efficiency without sacrificing information quality.
Data Source
AI summary
An alert handling notification method includes: receiving an alert indicating an anomaly in an Operational Technology environment; identifying a confirmation information item corresponding to a type of the alert, based on the alert and confirmation information items, each indicating content of a status confirmation for an alert of a corresponding type, and including a first item associated with a first weight and indicating a first status confirmation by a first handler, and a second item associated with a second weight and indicating a second status confirmation by a second handler; determining a handler to be preferentially caused to make a status confirmation for the alert, using the first and second weights specified based on the confirmation information item identified; notifying the first handler of the first item when the first handler is the handler; and notifying the second handler of the second item when the second handler is the handler.