Service Graph Phase Control for Stable Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Application-level monitoring data accumulates rapidly, making it impractical to manually identify abnormal data in real time, and maintaining a service graph representing inter-component dependencies is challenging, especially during application updates.
Innovation Solution
A control device that acquires update information, determines update convergence of the service graph, and shifts operational phases to update and detect anomalies using a service graph, ensuring the graph model remains current.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the service graph is continuously updated to reflect the latest inter-component dependencies, then the accuracy of anomaly detection is improved, but the system complexity and difficulty of maintaining update convergence increase
Solution Approach 1:
The service graph is designed to be dynamic rather than static, automatically adapting its structure based on incoming trace data. The graph evolves over time by adding new components and dependencies as they are discovered in the traces, while maintaining convergence properties through systematic update procedures that balance freshness with stability.
Solution Approach 2:
The service graph update mechanism operates autonomously by processing trace data and automatically determining when updates are needed. The system self-manages the complexity of maintaining the graph by implementing convergence determination logic that automatically decides when the graph structure has stabilized and when updates should proceed, eliminating the need for manual intervention in graph maintenance.
2Reliability
If manual extraction of normal operation models is performed from monitoring data, then the service graph can be constructed, but the time and effort required increase significantly
Solution Approach 1:
The manual mechanical process of extracting normal operation models is replaced with an automated computational system. The service graph generation device automatically processes trace data using algorithmic procedures to construct the service graph, substituting human manual extraction with automated information processing that is both faster and more consistent.
Solution Approach 2:
The system implements feedback mechanisms where trace data continuously informs the service graph structure. By processing actual runtime traces and comparing them against the current service graph model, the system automatically refines and updates the graph to reflect the true normal operation patterns, creating a self-improving model extraction process.
3Measurement precision
If the service graph is updated frequently to capture application changes, then the detection accuracy is improved, but false anomaly detections increase
Solution Approach 1:
Before performing anomaly detection, the system executes a preliminary convergence determination step that assesses whether the service graph has stabilized. This preliminary action filters out premature updates that would occur during transitional periods, ensuring that only mature, stable graph structures are used for detection, thereby reducing false positives.
Solution Approach 2:
The service graph maintains a dynamic balance between updating to capture changes and stabilizing to ensure reliability. The convergence determination mechanism dynamically adjusts the update frequency and timing, allowing frequent updates when the system is stable and reducing updates during transitional periods, thus optimizing both detection precision and false positive reduction.
Data Source
AI summary
Provided is a control device 10 for controlling an operation phase of a maintenance control system, wherein the system performs maintenance on a monitored service 100 implementing specific features by means of a chained operation of multiple components using a service graph illustrating a dependency between components constituting the monitored service 100. The control device 10 includes an acquisition unit 11 configured to acquire update information of the monitored service 100, a determination unit 13 configured to determine update convergence of the service graph, and a control unit 12 configured to shift the operation phase to a learning phase in which the service graph is updated when the update information has been received, and shift the operation phase to a detection phase in which anomalies are detected using the service graph when it is determined that the update of the service graph has converged.