Resource Popularity Assessment for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently monitoring and managing resource usage across computing environments, particularly in identifying anomalous behaviors and optimizing resource allocation for enhanced security and usability.
Innovation Solution
A computing system that uses a processor and digital memory to characterize resource usage by forming subsets based on usage values and assigning popularity assessments, which are then used to enhance security, usability, and efficiency by allocating resources effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive logging of all events is implemented, then complete security monitoring is achieved, but storage requirements and processing complexity increase enormously
Solution Approach 1:
The patent extracts and focuses only on the most critical security events for logging, such as authentication attempts, privilege changes, and error conditions. By selectively logging only these essential events rather than all system events, the storage requirements are dramatically reduced while maintaining effective security monitoring capability.
Solution Approach 2:
The patent implements differential logging strategies for different system components and event types. Critical security-relevant events are logged with high detail, while less important events are logged with minimal detail or not at all. This localized quality approach ensures that storage resources are allocated efficiently based on the security importance of each event type.
2Reliability
If comprehensive logging of all events is implemented, then complete security monitoring is achieved, but processing complexity increases enormously
Solution Approach 1:
The patent extracts and focuses only on the most critical security events for processing. By filtering out non-essential events from the logging pipeline, the processing complexity is significantly reduced while maintaining the ability to detect and respond to security threats effectively.
Solution Approach 2:
The patent segments the logging and processing system into multiple specialized components, each handling specific types of events. This segmentation allows for optimized processing of different event categories and reduces the overall complexity by dividing the monolithic processing task into smaller, more manageable units.
3Measurement precision
If resource usage data is collected for all resources, then complete resource characterization is achieved, but data accumulation and processing requirements increase
Solution Approach 1:
The patent extracts and collects resource usage data only for resources that are actively being used or that are critical to system operation. By excluding data collection for inactive or non-critical resources, the data accumulation requirements are significantly reduced while maintaining accurate characterization of the resources that matter most for system management and security analysis.
4Measurement precision
If detailed resource usage monitoring is implemented, then accurate popularity assessment is achieved, but system overhead increases
Solution Approach 1:
The patent extracts and monitors only the key metrics necessary for popularity assessment, such as request frequency and resource access patterns. By focusing on these essential metrics rather than collecting all possible usage details, the system achieves accurate popularity assessment while minimizing the overhead associated with data collection and processing.
Data Source
AI summary
Computing environment resource popularity is assessed, using a computed ratio of accumulations of resource usage values and a relationship condition, thereby providing inputs as guidance for automatic system enhancement utilizations such as anomaly detection, resource management, and access or maintenance prioritization. Unlike V1 approaches that base resource popularity on at most two resource usage values, the V2 assessment approaches taught herein consider a distribution of usage values across an entire group of resources, thereby providing finer grained actionable results. Usage value accumulations may be scaled. Popularity or rareness of one or more resources of various types may be determined. A cache or other decay model may be employed to optimize assessment efficiency by reducing usage value retrieval I/O transactions. Specific utilizations of resource popularity assessments for enhancing system usability, security, functionality, and effectiveness are discussed.