Temporal Causality Graph Anomaly Detection in Network Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for detecting anomalies in large networked systems, such as digital networking systems and clouds, face challenges in identifying anomalies beyond temporal causality relations, leading to potential disruptions and economic losses.
Innovation Solution
A method is developed to build a temporal causality graph describing functional relationships among local components during normal periods, using non-negative LASSO regression to identify causal relations and predict system status, allowing for anomaly detection by examining patterns on the graph.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If sparse temporal event regression method is used to detect anomalies in noisy multi-variate time series data, then anomaly detection capability is improved, but the system cannot identify causal relationships beyond temporal sequences
Solution Approach 1:
The patent transforms the analysis from one-dimensional temporal sequences to two-dimensional causal graphs by introducing causal strength as a new dimension. The causal graph G=(V,E) with edge weights representing causal strength adds structural information beyond temporal ordering, enabling the system to capture both temporal patterns and causal relationships simultaneously.
Solution Approach 2:
The patent introduces causal graphs as an intermediary representation between raw time series data and anomaly detection results. The causal graph serves as a mediator that encodes causal relationships from time series data, allowing the anomaly detection algorithm to operate on this enriched structure rather than directly on raw temporal data.
2Measurement precision
If random walk traversal is performed on the graph induced by temporal event regression, then anomaly detection is achieved, but the method lacks domain knowledge and requires interference with the system
Solution Approach 1:
The patent implements self-service by using the system's own operational data to build the causal graph without external intervention. The causal relationships are inferred automatically from the time series data using algorithms like Granger causality or PCMCI, eliminating the need for domain experts to manually specify relationships or inject test signals into the system.
3Loss of information
If causal inference algorithms based on sparse Granger causality are used, then temporal causality relations are identified, but the system does not focus on identifying anomalies
Solution Approach 1:
The patent merges causal inference with anomaly detection by integrating the causal graph construction step with the anomaly detection process. The same causal graph used to understand system relationships also serves as the basis for detecting anomalies through methods like causal impact analysis or residual analysis, combining both functionalities into a unified framework.
Data Source
AI summary
An exemplary method for detecting one or more anomalies in a system includes building a temporal causality graph describing functional relationship among local components in normal period; applying the causality graph as a propagation template to predict a system status by iteratively applying current system event signatures; and detecting the one or more anomalies of the system by examining related patterns on the template causality graph that specifies normal system behaviors. The system can align event patterns on the causality graph to determine an anomaly score.