Usage-Banded Anomaly Detection for System Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems in information processing systems fail to accurately identify performance-impacting and security-impacting issues, particularly when anomalies become frequent and are misinterpreted as normal behavior due to historical data analysis.
Innovation Solution
Implementing usage-banded anomaly detection by tagging system metric data with predefined usage bands, segregating it into normal and outlier sets, and applying different anomaly detection algorithms to each set to identify specific anomalies and facilitate remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a single anomaly detection algorithm is applied to all system metric data, then the detection process is simple, but the accuracy of identifying performance-impacting and security-impacting issues deteriorates when anomalies become frequent
Solution Approach 1:
The patent segments system metric data into multiple usage bands (e.g., low usage, medium usage, high usage bands) based on historical analysis. Each usage band is then analyzed by a specific anomaly detection algorithm tailored to its characteristics. This segmentation allows frequent anomalies in high-usage periods to be distinguished from actual security threats, improving detection accuracy without requiring a single overly complex algorithm to handle all scenarios.
2Adaptability or versatility
If historical data is used to identify normal behavior patterns, then the system adapts to regular operations, but frequent anomalies are misinterpreted as normal behavior
Solution Approach 1:
The patent performs preliminary analysis of historical data to establish usage bands and determine expected anomaly frequencies for each band before actual anomaly detection occurs. By pre-defining what constitutes normal anomaly frequency in each usage band, the system can quickly compare real-time anomalies against these predetermined thresholds, preventing misinterpretation of frequent anomalies as normal behavior while maintaining adaptability to legitimate operational patterns.
Data Source
AI summary
A method comprises collecting a set of data from an information processing system, wherein the set of data represents one or more system metrics associated with the information processing system. The method tags data values in the collected set of data with usage bands selected from a plurality of predefined usage bands, wherein each usage band represents a unique range of values within which data values in the set of data can be categorized. Further, the tagged data values are segregated into at least a first set and a second set based on the usage bands. A first anomaly detection algorithm is applied to the first set and a second anomaly detection algorithm is applied to the second set to generate anomaly data sets. The anomaly data sets are mapped back to the collected set of data to identify one or more specific anomalies.