Relevance Scoring for Automated Alert Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying the most relevant administrator for handling alerts related to shared resources in cloud-based platforms is cumbersome and time-consuming, especially in large organizations, leading to delayed investigation and mitigation of threats.
Innovation Solution
A system that automatically identifies the most relevant person for handling notifications by analyzing an activity log, calculating operation and user relevance scores based on recent and authorized operations, and displaying their contact information in the notification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If manual documentation maintenance is used to identify administrators, then the system complexity is reduced, but the time required to identify the correct person increases significantly
Solution Approach 1:
The system automatically identifies the most relevant administrator by analyzing activity logs and calculating relevance scores, eliminating the need for manual documentation maintenance and search processes. The system serves itself by autonomously determining who should receive alerts based on recent operations and user relevance metrics.
Solution Approach 2:
The patent replaces manual mechanical processes (document searching, human coordination) with automated computational processes (activity log analysis, relevance score calculation, automated alert routing). This substitution eliminates time-consuming manual tasks while maintaining accurate administrator identification.
2Adaptability or versatility
If multiple administrators are assigned to shared resources, then resource accessibility and versatility improve, but the difficulty of identifying the correct administrator increases
Solution Approach 1:
The system assigns different levels of relevance to different administrators based on their specific operational history and recent activity patterns. Instead of treating all administrators equally, the system identifies which administrator has the highest relevance to the current alert based on localized analysis of their operations and expertise.
Solution Approach 2:
The system changes the parameter of administrator identification from a static list of all administrators to a dynamic calculation based on activity log analysis. By using relevance scores that change over time based on recent operations, the system adapts to current organizational needs and identifies the most appropriate administrator dynamically.
3Speed
If real-time alert routing is implemented, then threat mitigation speed improves, but the computational resources and system complexity increase
Solution Approach 1:
The system performs preliminary analysis of activity logs and calculation of relevance scores in advance, before alerts occur. By maintaining updated profiles of administrator operations and calculating relevance metrics proactively, the system is ready to rapidly route alerts without needing complex real-time computation when threats actually occur.
Data Source
Figure 1
Figure 2
Figure 3A~3C
AI summary
Disclosed herein is a system that implements a model for automatic discovery and identification of a person who is most relevant to handle a notification generated for a resource based on a triggered event. The model accesses an activity log for the resource to identify operations that are relevant to a type of the event. The operations are performed by different users (e.g., owners of the shared resource). The model then calculates an operation relevance score for each of the operations and a user relevance score for each of the different users. The user relevance scores are used to identify a most relevant person from the different users. Contact information for the most relevant person (e.g., name, email address, phone number) is added to the notification so that a person that first views the notification can efficiently forward the notification to the person best positioned to deal with the event.