Software Defined Anomaly Detection Engine for Cloud VMs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalies in cloud computing environments are either inefficient due to the need for updates in the target software or introduce data latency and privacy issues when relying on external services.
Innovation Solution
A software defined anomaly detection system that intercepts network traffic associated with a target application workload within a virtual machine, executing an anomaly detection algorithm in real-time to generate intercept results and trigger alert signals based on threshold comparisons.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection is integrated into target application software, then detection accuracy is improved, but software complexity and maintenance burden increase
Solution Approach 1:
The system segments anomaly detection functionality into a separate, standalone module that can be independently deployed and maintained. This module captures network traffic and performs anomaly detection without being integrated into the target application's codebase, thereby maintaining detection accuracy while reducing software complexity and maintenance burden.
Solution Approach 2:
The system introduces an intermediary component that sits between the network and the target application. This intermediary captures network traffic, performs anomaly detection, and generates alerts without interfering with the application's normal operation. The intermediary approach maintains detection accuracy while isolating complexity from the target application.
2Measurement precision
If external services are used for anomaly detection, then detection capability is improved, but data latency and privacy issues arise
Solution Approach 1:
The system implements self-service anomaly detection by capturing and analyzing network traffic locally within the virtual machine environment. The anomaly detection module processes data in real-time using local computational resources, eliminating the need to transmit data to external services. This approach maintains high detection capability while minimizing data latency and preserving data privacy.
Data Source
AI summary
A system may include a virtual machine, of a cloud computing environment, that executes a target application workload to be intercepted. A software defined anomaly detection engine (that is separate from the target application workload and that is also executing in the virtual machine) may intercept the target application workload. A computer processor of the software defined anomaly detection engine may intercept network traffic that is external to the virtual machine and associated with the target application workload. The software defined anomaly detection engine may then automatically execute an anomaly detection algorithm in substantially real time on the intercepted network traffic to generate an intercept result. An anomaly detection alert signal may be transmitted based on a comparison of the intercept result and an anomaly threshold value.