Single-User Metric Incident Detection for Cloud Service Dependencies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face challenges in achieving minimal time-to-detect (TTD) service incidents with high precision and coverage, as traditional methods often rely on multiple metrics that consume vast computing resources and are prone to inaccuracies.
Innovation Solution
A system and method utilizing a single user metric, such as dependency call duration, for anomaly detection, combining unsupervised learning to identify anomalies and supervised learning to classify them, thereby reducing computational load and improving precision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple metrics are used for service incident detection, then detection precision is improved, but computational resource consumption increases significantly
Solution Approach 1:
The patent extracts and focuses on a single critical metric (error metric representing user-facing failures) from the complex multi-metric system. This selective extraction maintains detection precision by concentrating on the most indicative signal while eliminating the computational burden of processing multiple metrics simultaneously.
Solution Approach 2:
The detection system is segmented into distinct functional components: unsupervised anomaly detection module, supervised classification module, and filtering module. This segmentation allows each component to operate efficiently on simplified data structures, reducing overall computational resource consumption while maintaining detection precision.
2Measurement precision
If multiple metrics are used for service incident detection, then detection precision is improved, but system complexity increases
Solution Approach 1:
The patent extracts only the essential error metric that directly correlates with user-facing service failures, removing extraneous metrics from the detection pipeline. This extraction reduces system complexity by eliminating the need to collect, store, and process multiple metric types while preserving detection precision through focused monitoring of the critical error signal.
Solution Approach 2:
Instead of starting with multiple metrics and filtering down, the system inverts the approach by starting with a single purpose-built error metric that is specifically designed to capture user-facing failures. This inversion simplifies the system architecture while maintaining or improving detection precision through targeted measurement.
3Reliability
If traditional anomaly detection methods are used, then detection coverage is achieved, but time to detect incidents increases
Solution Approach 1:
The system performs preliminary unsupervised anomaly detection on the error metric to identify potential incidents before they escalate. This preliminary action enables early warning detection, reducing the time to detect incidents while maintaining comprehensive coverage through the subsequent supervised classification stage that confirms and categorizes detected anomalies.
Solution Approach 2:
The detection system dynamically adapts its analysis depth based on anomaly characteristics. High-confidence anomalies detected by unsupervised methods trigger immediate alerts, while ambiguous cases undergo additional supervised classification. This dynamic approach reduces average detection time while maintaining comprehensive coverage across different incident types.
Data Source
AI summary
Systems and methods for service incident detection in a cloud computing platform. According to an example implementation, the incident detection system retrieves a single user metric corresponding to a service call to a resource on which the service is dependent and uses unsupervised anomaly detection to detect anomalies indicative of a service incident. Detected anomalies include an anomaly score indicating a level of anomality. Additionally, a supervised learning classifier is trained and used to filter/classify the anomaly detection results based on features corresponding to the anomaly score. The features are learned based on characteristic dimensions, distribution, and statistics of anomaly scores of the user metric at different resolution/aggregation levels. Anomaly detection results are classified as an incident or not an incident. A report is generated for a determined incident.