Facilitating efficient and effective anomaly detection via minimal human interaction

Patent metadata

Field	Value
Publication number	US-11775502-B2
Application number	US-202117200522-A
Country	US
Kind code	B2
Filing date	Mar 12, 2021
Priority date	Mar 12, 2021
Publication date	Oct 3, 2023
Grant date	Oct 3, 2023

Abstract

Embodiments of the present technology provide systems, methods, and computer storage media for facilitating anomaly detection. In some embodiments, a prediction model is generated using a training data set. The prediction model is used to predict an expected value for a latest (current) timestamp, which is used to determine that the incoming observed data value is an anomaly. Based on the incoming observed data value determined to be the anomaly or not, a corrected data value is generated to be included in the training data set. Thereafter, the training data set having the corrected data value is used to update the prediction model for use in determining whether a subsequent observed data value is anomalous. Such a process may be performed in an iterative manner to maintain optimized training data and prediction model.

First claim

What is claimed is:

1. One or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations to facilitate anomaly detection, the method comprising:
obtaining an incoming observed data value associated with a time;
generating a prediction model using a training data set;
using the prediction model to predict an expected value associated with the time;
using the expected value to determine that the incoming observed data value is an anomaly based on the incoming observed data exceeding a multiple of a standard deviation from the expected value, wherein the standard deviation is determined using a set of observed data values or a set of training data values;
based on the incoming observed data value determined to be the anomaly, generating a corrected data value for the time to include in the training data set, wherein generating the corrected data value for the time comprises adding the standard deviation to the expected value associated with the first time or subtracting the standard deviation from the expected value associated with the time such that the corrected data value is a value between the incoming observed data value and the expected value; and
upon obtaining a subsequent observed data value associated with a subsequent time, using the training data set, having the corrected data value associated with the time, to update the prediction model used to determine whether the subsequent observed data value is anomalous.

2. The one or more computer storage media of claim 1 , wherein prior to using the training data set to generate the prediction model, analyzing data in the training data set to identify and remove any extreme outliers.

3. The one or more computer storage media of claim 2 , wherein the extreme outliers are determined when corresponding data values exceed a second multiple of the standard deviation from a mean of the data in the training data set.

4. The one or more computer storage media of claim 1 , wherein the updated prediction model is used to determine whether the subsequent observed data value is anomalous by:
predicting a subsequent expected value associated with the subsequent time; and
using the subsequent expected value to determine that the subsequent observed data value is the anomaly.

5. A method to facilitate anomaly detection, the method comprising:
using a prediction model, generated via a training data setfor an incoming observed data value associated with a time, to predict an expected value associated with the time, the training data set based on a rolling window of a fixed length;
determining that the incoming observed data value is an anomaly based on the expected value;
based on the incoming observed data value determined to be the anomaly, generating a corrected data value for the time to include in the training data set and providing an anomaly alert that indicates the incoming observed data value is the anomaly;
receiving an anomaly feedback indicating that the incoming observed data value is a normal value;
based on the anomaly feedback, updating the training data set, having the corrected data value, by replacing the corrected data value in the training data set with the incoming observed data value in the training data set, the updated training data set maintaining the fixed length of the rolling window by removing older data points and adding most recently obtained data points; and
using the updated training data set to update the prediction model for use in determining whether a subsequent observed data value is anomalous.

6. The method of claim 5 , wherein prior to using the training data set to generate the prediction model, analyzing data in the training data set to identify and remove any extreme outliers.

7. The method of claim 5 , wherein the incoming observed data value is compared to the expected value to determine that the incoming observed data value is the anomaly.

8. The method of claim 5 , wherein the anomaly alert includes a link that, if select, provides feedback indicating that the incoming observed data value is normal.

9. The method of claim 5 , wherein generating the corrected data value for the time includes correcting the incoming observed data value to be a value between the incoming observed data value and the expected value.

10. The method of claim 8 , wherein the corrected data value is appended in the training data set.

11. A system comprising:
one or more processors; and
one or more computer storage media storing computer-useable instructions that, when used by the one or more processors, cause the one or more processors to:
using a prediction model, generated via a training data set for an incoming observed data value associated with a time, to predict an expected value associated with the time;
determining that the incoming observed data value is an anomaly based on the incoming observed data exceeding a multiple of a standard deviation from the expected value, wherein the standard deviation is determined using a set of observed data values or a set of training data values;
based on the incoming observed data value determined to be the anomaly, generating a corrected data value for the time to include in the training data set, wherein generating the corrected data value for the time comprises adding the standard deviation to the expected value associated with the first time or subtracting the standard deviation from the expected value associated with the time such that the corrected data value for the time is a value between the incoming observed data value and the expected value; and
upon obtaining a subsequent observed data value associated with a subsequent time, using the training data set, having the corrected data value associated with the time, to update the prediction model used to determine whether the subsequent observed data value is anomalous.

12. The system of claim 11 , wherein the prediction model comprises a time series prediction model.

13. The system of claim 11 , further comprising:
providing an anomaly alert indicating the incoming observed data value is anomalous;
receiving a feedback indicating the incoming observed data value is not anomalous; and
based on the feedback, updating the training data set by replacing the corrected data value in the training data set with the incoming observed data value in the training data set.

14. The system of claim 11 further comprising:
obtaining another subsequent observed data value; and
using the updated training data set to further update the prediction model used to determine whether the another subsequent observed data value is anomalous.

15. The system of claim 11 , wherein the incoming observed data value is compared to the expected value to determine that the incoming observed data value is the anomaly.

Assignees

• Adobe Inc

Inventors

• Zhang Wei
• Challis Christopher

Classifications

• G06F16/2365 Primary

  Ensuring data consistency and integrity · CPC title

• G06F11/3452

  Performance evaluation by statistical analysis · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title

• H04L41/147 Primary

  for predicting network behaviour · CPC title