Context-based anomaly detection

Patent metadata

Field	Value
Publication number	US-2025211600-A1
Application number	US-202318391311-A
Country	US
Kind code	A1
Filing date	Dec 20, 2023
Priority date	Dec 20, 2023
Publication date	Jun 26, 2025
Grant date	—

Abstract

Time-series data is received. Using an identifier of the time-series data, contextual reference anomaly detection parameters are identified from a repository. A data trend of the time-series data is classified. Based on the classified data trend, a type of model to be generated for the time-series data is selected and a model having generated anomaly detection parameters is generated. A history of anomaly detection parameters determined for the time-series data is identified, and the generated anomaly detection parameters are adjusted based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters.

First claim

What is claimed is:

1 . A method, comprising:
receiving time-series data; using an identifier of the time-series data, identifying contextual reference anomaly detection parameters from a repository; classifying a data trend of the time-series data; based on the classified data trend, selecting a type of model to be generated for the time-series data and generating a model having generated anomaly detection parameters; identifying a history of anomaly detection parameters determined for the time-series data; and adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters.

2 . The method of claim 1 , wherein the identifier of the time-series data is determined at least in part by tokenizing a metric name associated with the time-series data.

3 . The method of claim 1 , wherein the identified contextual reference anomaly detection parameters from the repository include an upper bound and a lower bound.

4 . The method of claim 3 , wherein at least one of the identified contextual reference anomaly detection parameters from the repository indicates whether there exists a positive correlation or a negative correlation between values of the time-series data and a likelihood of an anomaly.

5 . The method of claim 1 , wherein the type of model is a statistical model or a machine learning model.

6 . The method of claim 1 , wherein the identified history of the anomaly detection parameters includes data distribution information associated with the time-series data.

7 . The method of claim 6 , wherein the data distribution information includes a maximum historical value, a minimum historical value, a standard deviation value, a mean value, a skewness value, or a kurtosis value.

8 . The method of claim 1 , wherein adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters includes determining a context-based upper bound or a context-based lower bound.

9 . The method of claim 1 , wherein adjusting the generated anomaly detection parameters includes determining a weighted standard deviation value based on training data associated with the generated model and at least one parameter of the history of anomaly detection parameters.

10 . The method of claim 1 , wherein adjusting the generated anomaly detection parameters includes determining a standardized mean difference value based on at least one of the contextual reference anomaly detection parameters and at least one parameter of the history of anomaly detection parameters.

11 . A system comprising:
one or more processors; and a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
receive time-series data;
using an identifier of the time-series data, identify contextual reference anomaly detection parameters from a repository;
classify a data trend of the time-series data;
based on the classified data trend, select a type of model to be generated for the time-series data and generate a model having generated anomaly detection parameters;
identify a history of anomaly detection parameters determined for the time-series data; and
adjust the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters.

12 . The system of claim 11 , wherein the identified contextual reference anomaly detection parameters from the repository include an upper bound and a lower bound.

13 . The system of claim 12 , wherein at least one of the identified contextual reference anomaly detection parameters from the repository indicates whether there exists a positive correlation or a negative correlation between values of the time-series data and a likelihood of an anomaly.

14 . The system of claim 11 , wherein the type of model is a statistical model or a machine learning model.

15 . The system of claim 11 , wherein the identified history of the anomaly detection parameters includes data distribution information associated with the time-series data.

16 . The system of claim 15 , wherein the data distribution information includes a maximum historical value, a minimum historical value, a standard deviation value, a mean value, a skewness value, or a kurtosis value.

17 . The system of claim 11 , wherein adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters includes determining a context-based upper bound or a context-based lower bound.

18 . The system of claim 11 , wherein adjusting the generated anomaly detection parameters includes determining a weighted standard deviation value based on training data associated with the generated model and at least one parameter of the history of anomaly detection parameters.

19 . The system of claim 11 , wherein adjusting the generated anomaly detection parameters includes determining a standardized mean difference value based on at least one of the contextual reference anomaly detection parameters and at least one parameter of the history of anomaly detection parameters.

20 . A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving time-series data; using an identifier of the time-series data, identifying contextual reference anomaly detection parameters from a repository; classifying a data trend of the time-series data; based on the classified data trend, selecting a type of model to be generated for the time-series data and generating a model having generated anomaly detection parameters; identifying a history of anomaly detection parameters determined for the time-series data; and adjusting the generated anomaly detection parameters based on the contextual reference anomaly detection parameters and the history of anomaly detection parameters.

Assignees

• Servicenow Inc

Inventors

• Barkai Efrat
• Segal Yafit
• Hasdai-Rippa Neta
• Arazy Nir

Classifications

• G06V10/25

  Determination of region of interest [ROI] or a volume of interest [VOI] · CPC title

• A61B5/02028

  Determining haemodynamic parameters not otherwise provided for, e.g. cardiac contractility or left ventricular ejection fraction · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06N20/00 Primary

  Machine learning · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title