Context-based anomaly detection

Patent metadata

Field	Value
Publication number	US-12547941-B2
Application number	US-202318391311-A
Country	US
Kind code	B2
Filing date	Dec 20, 2023
Priority date	Dec 20, 2023
Publication date	Feb 10, 2026
Grant date	Feb 10, 2026

Abstract

Time-series data is received. Using an identifier of the time-series data, contextual reference anomaly detection parameters are identified from a repository. A data trend of the time-series data is classified. Based on the classified data trend, a type of model to be generated for the time-series data is selected and a model having generated anomaly detection parameters is generated. A history of anomaly detection parameters determined for the time-series data is identified, and the generated anomaly detection parameters are adjusted based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters.

First claim

What is claimed is:

1 . A method, comprising:
receiving time-series data; using an identifier of the time-series data, identifying contextual reference anomaly detection parameters from a repository in a first layer of context-based analysis; classifying a data trend of the time-series data; based on the classified data trend, selecting a type of model to be generated for the time-series data based on fitting the time-series data using the classified data trend and generating a model having generated anomaly detection parameters based on the selected type of model in a second layer of the context-based analysis; identifying a history of anomaly detection parameters determined for the time-series data in a third layer of the context-based analysis, wherein the identified history of the anomaly detection parameters includes data distribution information associated with the time-series data; integrating the first layer, the second layer, and the third layer of the context-based analysis by adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters; and applying the adjusted generated anomaly detection parameters to one or more anomaly scores.

2 . The method of claim 1 , wherein the identifier of the time-series data is determined at least in part by tokenizing a metric name associated with the time-series data.

3 . The method of claim 1 , wherein the identified contextual reference anomaly detection parameters from the repository include an upper bound and a lower bound.

4 . The method of claim 3 , wherein at least one of the identified contextual reference anomaly detection parameters from the repository indicates whether there exists a positive correlation or a negative correlation between values of the time-series data and a likelihood of an anomaly.

5 . The method of claim 1 , wherein the type of model is a statistical model or a machine learning model.

6 . The method of claim 1 , wherein the data distribution information includes a maximum historical value, a minimum historical value, a standard deviation value, a mean value, a skewness value, or a kurtosis value.

7 . The method of claim 1 , wherein adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters includes determining a context-based upper bound or a context-based lower bound.

8 . The method of claim 1 , wherein adjusting the generated anomaly detection parameters includes determining a weighted standard deviation value based on training data associated with the generated model and at least one parameter of the history of anomaly detection parameters.

9 . The method of claim 1 , wherein adjusting the generated anomaly detection parameters includes determining a standardized mean difference value based on at least one of the contextual reference anomaly detection parameters and at least one parameter of the history of anomaly detection parameters.

10 . A system comprising:
one or more processors; and a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
receive time-series data;
using an identifier of the time-series data, identify contextual reference anomaly detection parameters from a repository in a first layer of context-based analysis;
classify a data trend of the time-series data;
based on the classified data trend, select a type of model to be generated for the time-series data based on fitting the time-series data using the classified data trend and generate a model having generated anomaly detection parameters based on the selected type of model in a second layer of the context-based analysis;
identify a history of anomaly detection parameters determined for the time-series data in a third layer of the context-based analysis, wherein the identified history of the anomaly detection parameters includes data distribution information associated with the time-series data;
integrate the first layer, the second layer, and the third layer of the context-based analysis by adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters; and
apply the adjusted generated anomaly detection parameters to one or more anomaly scores.

11 . The system of claim 10 , wherein the identified contextual reference anomaly detection parameters from the repository include an upper bound and a lower bound.

12 . The system of claim 11 , wherein at least one of the identified contextual reference anomaly detection parameters from the repository indicates whether there exists a positive correlation or a negative correlation between values of the time-series data and a likelihood of an anomaly.

13 . The system of claim 10 , wherein the type of model is a statistical model or a machine learning model.

14 . The system of claim 10 , wherein the data distribution information includes a maximum historical value, a minimum historical value, a standard deviation value, a mean value, a skewness value, or a kurtosis value.

15 . The system of claim 10 , wherein adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters includes determining a context-based upper bound or a context-based lower bound.

16 . The system of claim 10 , wherein adjusting the generated anomaly detection parameters includes determining a weighted standard deviation value based on training data associated with the generated model and at least one parameter of the history of anomaly detection parameters.

17 . The system of claim 10 , wherein adjusting the generated anomaly detection parameters includes determining a standardized mean difference value based on at least one of the contextual reference anomaly detection parameters and at least one parameter of the history of anomaly detection parameters.

18 . A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving time-series data; using an identifier of the time-series data, identifying contextual reference anomaly detection parameters from a repository in a first layer of context-based analysis; classifying a data trend of the time-series data; based on the classified data trend, selecting a type of model to be generated for the time-series data based on fitting the time-series data using the classified data trend and generating a model having generated anomaly detection parameters based on the selected type of model in a second layer of the context-based analysis; identifying a history of anomaly detection parameters determined for the time-series data in a third layer of the context-based analysis, wherein the identified history of the anomaly detection parameters includes data distribution information associated with the time-series data; integrating the first layer, the second layer, and the third layer of the context-based analysis by adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters; and applying the adjusted generated anomaly detection parameters to one or more anomaly sco

Assignees

• Servicenow Inc

Inventors

• Barkai Efrat
• Segal Yafit
• Hasdai-Rippa Neta
• Arazy Nir

Classifications

• G06V10/25

  Determination of region of interest [ROI] or a volume of interest [VOI] · CPC title

• A61B5/02028

  Determining haemodynamic parameters not otherwise provided for, e.g. cardiac contractility or left ventricular ejection fraction · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• G06N20/00 Primary

  Machine learning · CPC title