Resource Graph Anomaly Score Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems struggle to aggregate results from multiple anomaly detection engines effectively, leading to disjointed reports and difficulties in identifying the root cause of problems or generating proactive alerts.
Innovation Solution
A method that generates a resource graph to represent resources as nodes and relationships between them, allowing for the aggregation of anomaly detection results from multiple engines by assigning and calculating overall anomaly scores based on weighted values reflecting node relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple anomaly detection engines are used to detect anomalies, then the detection coverage and reliability are improved, but the complexity of aggregating results and identifying root causes increases
Solution Approach 1:
The system segments the complex aggregation problem into manageable components by building a resource graph where resources are divided into nodes and relationships are divided into edges. Each anomaly detection engine's results are attached to specific nodes, allowing independent processing and aggregation of individual anomaly scores before combining them at parent nodes through the relationship edges.
Solution Approach 2:
The resource graph serves as an intermediary structure that mediates between multiple anomaly detection engines and the final aggregated results. The graph's nodes and edges provide a standardized framework for translating and combining results from different detection engines, simplifying the aggregation process while maintaining detection reliability.
2Measurement precision
If anomaly scores from multiple sources are aggregated, then the overall anomaly detection accuracy is improved, but the difficulty of calculating and interpreting results increases
Solution Approach 1:
The system transforms the aggregation problem from a flat, multidimensional calculation challenge into a hierarchical structure with clear dimensions. Anomaly scores from multiple sources are aggregated vertically at each node level, while the resource graph provides a horizontal organizational dimension. This dimensional transformation makes the aggregation process systematic and the results easier to interpret through the graph's visual hierarchy.
3Ease of operation
If a unified view of anomaly scores is provided, then the ease of operation and diagnostic efficiency are improved, but the amount of data processing and computation increases
Solution Approach 1:
The system performs preliminary actions by pre-building the resource graph structure and pre-attaching anomaly detection results to relevant nodes before aggregation is needed. This preliminary organization of data into the graph structure with established relationships allows for efficient retrieval and aggregation operations, reducing the time and computational resources required when unified anomaly views are requested.
Data Source
AI summary
Examples described herein provide a computer-implemented method that includes receiving a list of objects with anomaly detection results associated therewith. The method further includes generating a resource graph, wherein the resource graph comprises at least two nodes, each of the at least two nodes being associated with one of the objects. The method further includes determining a relationship between the at least two nodes. The method further includes assigning an anomaly score to at least one of the objects. The method further includes calculating for at least one of the nodes, an overall anomaly score for the at least one of the nodes based on the anomaly score for the at least one of the objects and based on the anomaly score for another node related to the at least one of the nodes.