Detecting and validating anomalies from ongoing data collection

Patent metadata

Field	Value
Publication number	US-12592872-B2
Application number	US-202318340568-A
Country	US
Kind code	B2
Filing date	Jun 23, 2023
Priority date	Jun 23, 2023
Publication date	Mar 31, 2026
Grant date	Mar 31, 2026

Abstract

The present disclosure relates to systems, non-transitory computer-readable media, and methods for detecting and validating anomalies from an ongoing data collection by applying an algorithm corresponding to a data pattern of the ongoing data collection. In particular, in one or more embodiments, the disclosed systems utilize a time series classification model to identify a data pattern corresponding to the ongoing data collection. Further, the disclosed systems can utilize an algorithm corresponding to the data pattern to monitor the ongoing data collection for anomaly candidates. Additionally, in one or more embodiments, the disclosed systems pass anomaly candidates through an anomaly validation filter to remove false positives.

First claim

What is claimed is:

1 . A method comprising:
utilizing a time series classification model to determine a time series classification corresponding to an ongoing data collection; selecting, based on the time series classification corresponding to the ongoing data collection, a data pattern for the ongoing data collection; determining a custom-fit algorithm for monitoring the ongoing data collection based on the data pattern for the ongoing data collection by automatically applying a tuning function to modify one or more parameters of the custom-fit algorithm relative to the data pattern for the ongoing data collection, wherein determining the custom-fit algorithm further comprises generating kernel parameters from a Gaussian process regression by maximizing a log marginal likelihood utilizing a data-fit term, a complexity penalty, and a normalization constant within the Gaussian process regression; monitoring the ongoing data collection utilizing the custom-fit algorithm corresponding to the data pattern; utilizing the custom-fit algorithm corresponding to the data pattern to identify an anomaly candidate from the ongoing data collection; validating the anomaly candidate as an anomaly by passing the anomaly candidate through an anomaly filter; and in response to validating the anomaly candidate, providing an anomaly notification comprising information about the anomaly via a data report graphical user interface.

2 . The method of claim 1 , wherein the ongoing data collection comprises a plurality of data signals, further comprising:
categorizing a plurality of data patterns for the plurality of data signals; and utilizing a plurality of custom-fit algorithms corresponding to the plurality of data signals.

3 . The method of claim 1 , further comprising:
receiving feedback via the data report graphical user interface corresponding to the anomaly notification; and updating, based on the feedback, the custom-fit algorithm corresponding to the data pattern.

4 . The method of claim 1 , further comprising identifying the anomaly candidate by:
comparing a most recent data point of the ongoing data collection to the custom-fit algorithm corresponding to the data pattern to determine a likelihood that the most recent data point follows the data pattern; generating an anomaly threshold based on received user input indicating a value for the anomaly threshold; and identifying the anomaly candidate by determining that the likelihood satisfies the anomaly threshold.

5 . The method of claim 1 , wherein the time series classification model comprises the Gaussian process regression and the data pattern comprises one or more kernel functions.

6 . The method of claim 1 , wherein the custom-fit algorithm comprises a normal range of values for the ongoing data collection.

7 . The method of claim 1 , wherein applying the anomaly filter further comprises:
determining an anomaly ratio for the ongoing data collection utilizing the anomaly candidate; and comparing the anomaly ratio to an anomaly ratio threshold.

8 . The method of claim 1 , further comprising generating a customized anomaly filter for a user account based on user feedback.

9 . A system comprising:
at least one processor; and at least one non-transitory computer-readable storage medium storing instructions that, when executed by the at least one processor, cause the system to:
utilize a time series classification model to determine a time series classification corresponding to an ongoing data collection;
select, based on the time series classification corresponding to the ongoing data collection, a data pattern for the ongoing data collection;
determine a custom-fit algorithm for monitoring the ongoing data collection based on the data pattern for the ongoing data collection by automatically applying a tuning function to modify one or more parameters of the custom-fit algorithm relative to the data pattern for the ongoing data collection, wherein determining the custom-fit algorithm comprises generating kernel parameters from a Gaussian process regression by maximizing a log marginal likelihood utilizing a data-fit term, a complexity penalty, and a normalization constant within the Gaussian process regression;
monitor the ongoing data collection utilizing the custom-fit algorithm corresponding to the data pattern;
utilize the custom-fit algorithm corresponding to the data pattern to identify an anomaly candidate from the ongoing data collection;
validate the anomaly candidate as an anomaly by passing the anomaly candidate through an anomaly filter; and
in response to validating the anomaly candidate, provide an anomaly notification comprising information about the anomaly via a data report graphical user interface.

10 . The system of claim 9 , further comprising instructions that, when executed by the at least one processor, cause the system to:
categorize a plurality of data patterns for a plurality of data signals; and utilize a plurality of custom-fit algorithms corresponding to the plurality of data signals.

11 . The system of claim 9 , further comprising instructions that, when executed by the at least one processor, cause the system to:
receive feedback via the data report graphical user interface corresponding to the anomaly notification; and update, based on the feedback, the custom-fit algorithm corresponding to the data pattern.

12 . The system of claim 9 , further comprising instructions that, when executed by the at least one processor, cause the system to identify the anomaly candidate by:
comparing a most recent data point of the ongoing data collection to the custom-fit algorithm corresponding to the data pattern to determine a likelihood that the most recent data point follows the data pattern; and identifying the anomaly candidate by determining that the likelihood satisfies an anomaly threshold.

13 . A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause a computer device to:
utilize a time series classification model to determine a time series classification corresponding to an ongoing data collection; select, based on the time series classification corresponding to the ongoing data collection, a data pattern for the ongoing data collection; determine a custom-fit algorithm for monitoring the ongoing data collection based on the data pattern for the ongoing data collection by automatically applying a tuning function to modify one or more parameters of the custom-fit algorithm relative to the data pattern for the ongoing data collection, wherein determining the custom-fit algorithm further comprises generating kernel parameters from a Gaussian process regression by maximizing a log marginal likelihood utilizing a data-fit term, a complexity penalty, and a normalization constant within the Gaussian process regression; monitor the ongoing data collection utilizing the custom-fit algorithm corresponding to the data pattern; utilize the custom-fit algorithm corresponding to the data pattern to identify an anomaly candidate from the ongoing data collection; validate the anomaly candidate as an anomaly by passing the anomaly candidate through an anomaly filter; and in response to validating the anomaly candidate, provide an anomaly notification comprising information about the anomaly via a data report graphical user interface.

14 . The non-transitory computer-readable medium of claim 13 , further comprising instructions that, when executed by the at least one processor, cause the computer device to:
categorize a plurality of data patterns for a

Assignees

• Qualtrics Llc

Inventors

• Chlebus Grzegorz
• Haney Carol Sue
• Simajchel Przemyslaw Franciszek
• Titov Maksym
• Colak Recep
• Surmacz Kamil
• Schaefer Dominik Franciszek
• Jachim Szymon Wladyslaw

Classifications

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L43/028 Primary

  by filtering · CPC title