Scalable Automated Detection of Functional Behavior in Complex Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex computing devices face challenges in detecting the cause of performance issues due to numerous processes and threads performing similar operations, leading to poor device operation and user dissatisfaction.
Innovation Solution
A behavior detection system that defines functional behaviors through a set of basic operations with parameters, analyzes event logs to determine if these operations are satisfied, and takes appropriate actions, such as notifying administrators or logging events, to identify and address problematic behaviors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple processes and threads are running to perform similar operations, then system functionality and productivity are improved, but detecting the cause of performance issues becomes more difficult
Solution Approach 1:
The patent segments the complex system behavior into discrete basic operations (system calls, I/O operations, network operations, etc.) that can be individually logged and analyzed. By breaking down the behavior of hundreds of processes into fundamental operation types, the system makes it feasible to detect and analyze performance issues in complex multi-process environments.
Solution Approach 2:
The patent introduces an intermediary detection system that sits between the running processes and the analysis layer. This intermediary automatically logs events, captures basic operations, and correlates them according to behavior definitions, serving as a mediator that translates complex process interactions into analyzable data without interfering with process execution.
2Reliability
If automated detection systems are implemented to identify performance issues, then system monitoring capability is improved, but system complexity increases
Solution Approach 1:
The patent creates a universal detection framework that can monitor multiple types of operations (file I/O, network, memory, processes) through a single unified system. The behavior definitions and event correlation mechanisms serve multiple monitoring purposes simultaneously, reducing the need for separate specialized tools and thereby managing complexity.
Solution Approach 2:
The patent uses copying by creating simplified representations of system behavior through basic operation logs and behavior definitions. Instead of directly analyzing the complex original system state, the detection system works with copied event data and standardized operation models, making analysis more manageable while preserving essential behavioral information.
3Measurement precision
If detailed event logging is performed to capture all basic operations, then detection accuracy is improved, but data processing load increases
Solution Approach 1:
The patent applies partial action by logging only the essential basic operations that are relevant to behavior detection, rather than capturing every possible system event. The system selectively records operations based on predefined behavior definitions, capturing sufficient detail for accurate detection while avoiding the excessive data collection that would create unnecessary processing overhead.
Solution Approach 2:
The patent extracts only the critical information needed for behavior detection from the full system event stream. By filtering and extracting relevant basic operations (system calls, I/O, network events) and discarding irrelevant data, the system achieves high detection accuracy while minimizing the volume of data that requires processing and storage.
Data Source
AI summary
A behavior detection system has access to a collection of behavior definitions that each describe a functional behavior of a system. Each behavior definition includes multiple basic operations, each of which includes an identifier and one or more parameters. The behavior definition also includes, explicitly or inherently, a basic operation combination definition that describes a sequence or other manner in which the basic operations are combined. The behavior detection system analyzes events in an event log for the system and determines whether the events in the event log satisfy any of the behavior definitions. An appropriate responsive action is taken in response to detecting that the events in the event log satisfy a behavior definition. The collection of behavior definitions is scalable, allowing behavior definitions to be added or deleted, and allowing basic operations in a behavior definition to be changed (e.g., adding, removing, and/or modifying basic operation parameters).