Telemetry Data Classification for Server Overload Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices with software, hardware, or firmware bugs can overwhelm servers with excessive telemetry data, leading to denial of service, server crashes, or data loss, especially when multiple devices are affected, and unauthorized API key usage can further exacerbate these issues.
Innovation Solution
A server system uses machine learning classifiers to analyze telemetry data from computing devices, identify anomalies or security issues by determining the proximity of event features to predefined clusters, and performs remediation actions such as deactivating API keys, updating software or firmware, or replacing hardware to mitigate these issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If computing devices with bugs continuously send telemetry data to servers, then the servers can analyze and identify issues, but the servers become overwhelmed leading to denial of service and crashes
Solution Approach 1:
The patent applies preliminary action by implementing a classification system that pre-categorizes telemetry events into normal and anomalous groups before full processing. The machine learning model pre-identifies patterns and characteristics of anomalous events, allowing the server to prepare appropriate remediation actions in advance. This preliminary classification prevents the server from being overwhelmed by uniformly processing all incoming telemetry data.
Solution Approach 2:
The patent extracts and isolates only the anomalous events from the bulk of normal telemetry data. By using machine learning to identify and separate anomalous patterns, the system removes the harmful subset of data that causes server overload while maintaining the useful information needed for issue identification. This extraction approach allows the server to focus processing resources on only the problematic events.
2Loss of time
If the server processes and classifies all telemetry data in real-time, then issues can be identified and remediated quickly, but the processing complexity and computational resources increase significantly
Solution Approach 1:
The patent segments the telemetry processing task into distinct stages: initial event classification using machine learning, anomaly detection for segmented groups of events, and targeted remediation action selection. This segmentation allows the server to handle different types of processing in parallel and reduces the complexity of any single processing step, enabling real-time analysis without overwhelming computational demands.
Solution Approach 2:
The patent introduces an intermediary classification layer between raw telemetry data intake and full server processing. The machine learning-based classification system acts as a mediator that pre-processes and filters events, translating raw telemetry data into structured anomaly classifications. This intermediary reduces the complexity burden on the main server processing while maintaining real-time detection capabilities.
3Measurement precision
If multiple computing devices with the same bug send excessive data simultaneously, then the issue can be detected through pattern recognition, but the collective data volume overwhelms the server infrastructure
Solution Approach 1:
The patent merges and aggregates telemetry events from multiple computing devices into grouped classifications. By combining data from multiple sources and applying machine learning to identify common patterns across devices, the system can detect bugs affecting multiple devices simultaneously. This merging approach maintains detection precision by recognizing patterns while reducing the individual burden on server infrastructure through consolidated processing.
Data Source
AI summary
In some examples, a server may receive, from a computing device, data identifying an event that occurred on the computing device. The server may determine a plurality of features associated with the event, determine a distance between individual features of the plurality of features and individual centroids of a plurality of clusters, and determine that a particular distance between a particular feature of the plurality of features and a centroid of a particular cluster of the plurality of clusters is a shorter distance than the distance between other features of the plurality of features and other centroids corresponding to other clusters of the plurality of clusters. The server may determine a classification of the event based on the particular cluster and determine that the classification is a remediable issue. Based on the classification, the server may select and perform a remediation action from a plurality of remediation actions.