Neural Network-Based Anomaly Detection for Time Series Data

Abstract

The system uses a neural network to detect anomalies in time series data. The system trains the neural network for a fixed number of iterations using data from a time window of the time series. To identify anomalies in the time series data, the system uses a loss value at the end of the fixed number of iterations. For the time window, the system initializes the neural network to a random value and trains the neural network for a fixed number of iterations using the data in the time window. After the fixed number of iterations, the system compares the loss values ​​for various data points to a threshold. Data points with loss values ​​that exceed the threshold are identified as anomalous data points.

Description

[Technical field]

[0001] The present disclosure relates generally to the analysis of time series data, and more specifically, to the use of neural networks for identifying anomalies in time series data. [Background technology]

[0002] Time series data is generated and processed in several contexts. Examples of time series data include sensor data, data generated by instrumentation software that monitors utilization of resources such as processing resources, memory resources, storage resources, network resources, and application usage data. Anomaly detection is typically performed to identify problems with the system generating the time series data. For example, anomalies in utilization of a computing resource may be an indication of a server failure that is likely to occur in the near future. Similarly, anomalies in utilization of a network resource may be an indication of a network failure that is likely to occur in the near future. Accurate and timely detection of anomalies in time series data may allow such failures to be predicted in advance so that preventative measures can be taken.

[0003] Various techniques have been used for anomaly detection, including clustering analysis, random forest techniques, and machine learning-based models, such as neural networks. Traditional neural network-based techniques for anomaly detection require large amounts of training data and significant computational resources to train the neural network. Furthermore, when the characteristics of the time series data being analyzed differ from the time series data used to train the neural network, neural network-based techniques have low accuracy. [Brief description of the drawings]

[0004] The disclosed embodiments have other advantages and features that will become more readily apparent from the detailed description, the appended claims, and the accompanying figures (or drawings). A brief introduction of the figures is as follows.

[0005] [Figure 1] FIG. 1 is a block diagram of a system environment including a computing system for performing time series analysis, according to one embodiment.

[0006] [Diagram 2] 1 illustrates exemplary time series data and corresponding output for anomaly detection, according to one embodiment.

[0007] [Diagram 3] 1 illustrates a system architecture for a time series processing module, according to one embodiment.

[0008] [Figure 4] 1 illustrates an exemplary neural network architecture used for anomaly detection, according to one embodiment.

[0009] [Diagram 5] 1 illustrates a process for anomaly detection, according to one embodiment.

[0010] [Figure 6] 1 shows a flowchart illustrating a process of anomaly detection, according to one embodiment.

[0011] [Figure 7] 2 is a high-level block diagram illustrating an example computer for implementing the client device and / or computing system of FIG. 1.

[0012] The drawings and the following description set forth specific embodiments for purposes of illustration only. Those skilled in the art will readily recognize from the following description that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles described herein. Reference will now be made in detail to certain embodiments, examples of which are illustrated in the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] The system performs anomaly detection on time series data using a machine learning based model, e.g., a neural network. The system trains the neural network for a fixed number of iterations using data from a time window of the time series. To identify anomalies in the time series data, the system uses a loss value at the end of the fixed number of iterations. The loss value may represent the difference between a predicted data value and a data value of the time series corresponding to a time value. For example, the system compares the loss value to a predefined threshold. The system uses the loss value to tune parameters of the neural network, e.g., using backpropagation. The system also uses the loss value determined during the training phase to determine whether a data point of the time series represents an anomaly. If the loss value at a time point exceeds a threshold, the system determines that the time value corresponds to an anomaly. In one embodiment, the anomaly is a point anomaly. The system performs the above steps for a new time interval. The system reinitializes the neural network for the new time interval and repeats the above steps.

[0014] Traditionally, neural networks are trained using a training data set, and the trained neural network is used during inference to predict outcomes. In contrast, systems according to various embodiments determine anomalies during the training phase rather than through the use of a trained neural network to make predictions.

[0015] The system trains a neural network using data within the time window and detects anomalies in the data points within the time window based on the loss values ​​determined within the time window. Conventional systems train the neural network until convergence, e.g., until the loss value falls below a threshold. In contrast, systems according to various embodiments train the neural network for a fixed number of iterations. After the fixed number of iterations, the system compares the loss values ​​of the data points within the time window to a threshold. The system identifies data points having loss values ​​above the threshold as anomalous data points. The system repeats this process for subsequent time intervals.

[0016] When this process is repeated for the next time window, the system discards the neural network trained using the data of the previous time window. Thus, for each time window, the system reinitializes the neural network, for example, using random values. Thus, the system does not train the neural network for future use as a predictor during inference. The system simply performs the training process to use the losses determined during the training process to identify point anomalies. After an anomaly is detected for the time window during the training phase of the neural network, the system discards the neural network and reinitializes it using random values ​​for the next time interval.

[0017] Furthermore, the system performs training of the neural network for a fixed number of iterations. Traditionally, training of a neural network is performed until some convergence criterion is met, e.g., until a loss value falls below a threshold indicating that convergence has been reached. The system does not attempt to reach convergence, but rather uses the training dynamics to determine anomalies. Thus, the system does not aim to generate a perfectly trained neural network.

[0018] As a result, the process used to detect anomalies in time series data is computationally efficient since the neural network is trained for only a few iterations, rather than until it converges. The accuracy of the disclosed technique is better than, or at least as good as, other techniques that fully train the neural network. Thus, the system achieves high accuracy with fewer computing resources. Thus, the disclosed technique improves the computational efficiency of the process of detecting anomalies in time series data, providing technical advantages over conventional techniques.

[0019] Overall System Environment Figure 1 is a block diagram of a system environment including a computing system for performing time series analysis, according to one embodiment. The system environment 100 shown in Figure 1 includes a computing system 130, a client device 110, an external system 120, and a network 150. In alternative configurations, different and / or additional components may be included in the system environment 100. The computing system 130 may be an online system or may be a system that works offline, for example, by running batch processes to perform anomaly detection.

[0020] Computing system 130 includes a time series processing module 140, a listener module 145, and an action module 160. Listener module 145 receives time series data 135 from one or more sources, e.g., external system 120. Time series processing module 140 performs anomaly detection on time series data 135 to detect anomalies, e.g., point anomalies 155. Action module 160 takes action based on detected anomalies 155, e.g., by sending a warning message to a user or by taking automated remedial action. In some embodiments, computing system 130 itself may be a source of time series data.

[0021] 2 illustrates exemplary time series data and corresponding output of anomaly detection performed by time series processing module 140 according to one embodiment. Chart 210 represents the time series data 135 received by listener module 145 and provided as input to time series processing module 140. Time series processing module 140 outputs a score indicative of the occurrence of anomalies in the time series data shown in chart 210. An exemplary score determined based on the time series data of chart 210 is shown as chart 220. As shown in FIG. 2, computing system 130 determines the occurrence of anomaly 155 if the score generated by time series processing module 140 exceeds a predefined threshold, e.g., based on a point anomaly detected in the time series data at point 215, the score increases at point 225.

[0022] Anomaly detection may be performed for system maintenance, for example, to detect system problems in advance. For example, anomalies in computing resource utilization may be an indication of a server failure that may occur in the near future. Similarly, anomalies in network resource utilization may be an indication of a network failure that may occur in the near future. Therefore, accurate and timely detection of anomalies is important in the analysis of such time series data.

[0023] The computing system 130 receives time series data 135 from a source, e.g., the external system 120. For example, the external system 120 includes a computing resource 125 that generates the time series data. Examples of computing resources include memory resources, processing resources, storage resources, network resources, etc. The external system 120 may execute instrumentation software that generates time series data representative of resource usage of one or more resources. For example, the external system 120 may execute instrumentation software that monitors network usage and periodically reports metrics indicative of the network usage. The reported data represents the time series 135 received by the computing system 130. The time series processing module 140 may detect anomalies 155 that represent potential issues with the computing resources, e.g., potential failures that are likely to occur. Action module 160 may take appropriate action in response to detection of anomaly 155, for example, by sending an alert to a system administrator, or by taking automatic remedial action, for example, by allocating additional computing resources to a task or process if the system determines that anomaly 155 indicates a shortage of a particular computing resource allocated to the task or process. For example, computing system 130 may determine that a point anomaly detected in a time series representing network usage indicates a lack of sufficient network resources for a communication channel, and action module 160 may reallocate network resources to provide additional network bandwidth to the communication channel. As another example, the time series data may represent a number of pages swapped by a process, and anomaly 155 may be caused by an increase in the number of swapped pages indicating a shortage of storage resources. In response to detection of anomaly 155, action module 160 may allocate additional storage to the process.

[0024] Time series data 135 may also be reported by other sources, such as sensors that monitor some real world data, such as temperature, pressure, weight, light intensity, etc., and report it periodically. For example, a sensor may monitor the temperature or pressure of an industrial process that performs a chemical reaction and report it periodically as time series data 135. Action module 160 may perform an action to control the industrial process in response to detection of anomaly 155, for example, by controlling the industrial process to adjust the rate of a chemical reaction.

[0025] The time series data 135 may represent user actions, e.g., user interactions with the online system. For example, the computing system 130 may monitor user interactions with the online system to detect anomalies in the user interactions. The point anomalies may be an indication of a change in the user's behavior or a problem with the online system receiving the user interactions. The action module 160 may take appropriate action based on the detection of the point anomalies 155, e.g., by sending an alert message to the user. The alert message may provide suggestions of actions the user may take to adjust online system parameters in response to the anomaly detection. For example, if the anomalies 155 are determined as an indication of increased demand for a particular product, the online system may launch an online campaign for the product to provide information describing the product to additional users.

[0026] FIG. 1 shows single instances of various components, such as external systems, client devices, etc. However, there may be multiple instances of each of these components. For example, there may be several computing systems 130 and dozens or hundreds of client devices 110 or external systems 120 in communication with each computing system 130. The figures use like reference numbers to identify like elements. A letter following a reference number, such as "110a," indicates that the text is specifically referring to the element having that particular reference number. A reference number in the text without a following letter, such as "110," refers to any or all of the elements in the figure having that reference number.

[0027] Client device 110 is a computing device such as a smartphone having an operating system such as ANDROID® or APPLE® IOS®, a tablet computer, a laptop computer, a desktop computer, an electronic stereo in an automobile or other vehicle, or any other type of network-enabled device capable of listening to or otherwise experiencing digital content. A typical client device 110 includes the necessary hardware and software to connect to network 150 (e.g., via Wifi and / or 4G or other wireless communication standards).

[0028] Network 150 provides a communications infrastructure between client device 110, external system 120, and computing system 130. Network 150 is typically the Internet, but may be any network including, but not limited to, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile wired or wireless network, a private network, or a virtual private network. Portions of network 150 may be provided by links using communications technologies including WiFi based on the IEEE 802.11 standard, the BLUETOOTH® short-range standard, and the wireless Universal Serial Bus (USB) standard.

[0029] System Architecture 3 illustrates a system architecture of a time series processing module, according to one embodiment. The time series processing module 140 includes an anomaly detection module 310 and a time series database 360. The time series processing module 140 may perform various types of processing of time series data, including anomaly detection. The anomaly detection module 310 performs anomaly detection on the time series data stored in the time series database 360. The anomaly detection module 310 includes a neural network 320, a loss determination module 340, a training module 330, and a threshold determination module 350. Conventional components such as network interfaces, security functions, load balancers, failover servers, and management network operations consoles are not shown so as not to obscure the details of the system architecture.

[0030] In one embodiment, the neural network 320 is a multi-layer perceptron. Figure 4 illustrates a neural network architecture used for anomaly detection, according to one embodiment. Figure 4 shows an example neural network 400 including an input layer 410, one or more hidden layers 420, and an output layer 430. The input layer 410 is configured to receive time values ​​as input, and the output layer 430 is configured to predict data values ​​corresponding to the input time values.

[0031] The loss determination module 340 determines a loss value based on the predictions of the neural network being trained. The loss value represents the difference between a predicted data value and a corresponding known data value of the time series corresponding to the time value. For example, if the time series data value is D1 for a time value T1, the neural network predicts a value D1' and determines a loss value based on the difference between D1' and D1. The loss value may be determined using any of a variety of possible metrics, such as, for example, root mean square, mean absolute value, etc.

[0032] The training module 330 performs a neural network training process. The training module 330 initializes the neural network, for example, by setting the parameters of the neural network to random values. The training module 330 predicts values ​​of the time series data using the neural network and determines a loss value by invoking the loss determination module 340. Based on the loss value, the training module 330 adjusts the parameters of the neural network to minimize the loss value, for example, using backpropagation.

[0033] The threshold determination module 350 determines a threshold used to determine a point anomaly. The anomaly detection module 310 compares the neural network loss value to the threshold determined by the threshold determination module 350 to determine whether a point anomaly exists at a time value in the time series data. In one embodiment, the threshold determination module 350 adjusts the threshold based on a comparison of the identified anomaly to known anomalies. For example, the point anomaly may be presented to a user to receive feedback describing whether the point anomaly was correctly identified.

[0034] If the anomaly detection module 310 receives feedback indicating that one or more known point anomalies were not detected by the anomaly detection module 310, the threshold may be reduced so that point anomalies similar to the missed point anomalies may be identified later. If the anomaly detection module 310 receives feedback indicating that one or more known point anomalies were identified by the anomaly detection module 310 but were not actual point anomalies, the threshold may be increased so that point anomalies similar to previously identified pseudo point anomalies are subsequently filtered out and not detected. The threshold determination module 350 uses the adjusted threshold to identify anomalies for subsequent time windows.

[0035] Anomaly Detection Process FIG. 5 illustrates a process of anomaly detection, according to one embodiment. As shown in FIG. 5, the time series data 135 includes time 510 and data values ​​520. For example, the time series data 135 may be represented as a sequence of tuples (Tn, Dn), where Tn represents the time values ​​510 and Dn represents the data values ​​520. The neural network 320 receives the time values ​​510 as input and predicts the data values ​​530. The loss determination module 320 receives the predicted data values ​​530 and the actual data values ​​520 of the time series as input and determines a loss value that is used as feedback to adjust the parameters of the neural network. The loss value is used by the anomaly detection module 310 to determine anomalies 540 by comparing the loss value against a threshold value.

[0036] 6 shows a flow chart illustrating a process of anomaly detection, according to one embodiment. The steps described herein may be performed in a different order than shown herein. Each step may be performed by a different module than shown herein.

[0037] The time series processing module 140 receives 610 a time series including a sequence of data values. Each data value of the time series is associated with a time value. The time series processing module 140 processes different time windows of the time series data to determine point anomalies within each time window. The time window represents a range of time values. Thus, the time series processing module 140 trains a neural network based on the data values ​​of the time window and detects point values ​​within the time window based on a loss value determined during the training phase of the neural network based on the time series data of the time window. The time series processing module 140 repeats the following steps for each time window:

[0038] The time series processing module 140 receives a time window that represents a range of time values ​​(620). The time series processing module 140 initializes a neural network for the time window (630). The time series processing module 140 trains the neural network for a predetermined number of iterations by repeating the following steps 660, 670, 680. For each iteration, the time series processing module 140 repeats steps 660 and 670 for the time values ​​in the time window. For the time values ​​in the time window, the time series processing module 140 runs the neural network to predict data values ​​for the time values ​​(660). The time series processing module 140 determines a loss value based on the predicted data values ​​(670). After repeating steps 660 and 670 for the set of time values ​​in the time window, the time series processing module 140 determines an aggregate loss value over the set of time values.

[0039] The time series processing module 140 adjusts 680 the parameters of the neural network based on the total loss value. The steps of determining the total loss value and adjusting the parameters of the neural network are repeated for each iteration. After a predetermined number of iterations, the time series processing module 140 identifies a point anomaly within the time window as follows: If the loss value corresponding to a particular time value within the time window exceeds a threshold, the time series processing module 140 identifies the corresponding data value as an anomaly. The computing system 130 may store information describing the data value identified as a point anomaly. The action module 160 may take an action based on the identified point anomaly, such as sending a warning message to a user describing the point anomaly, sending information describing the point anomaly for display via a user interface, suggesting a remedial action based on the point anomaly, or performing a remedial action based on the point anomaly.

[0040] The time series processing module 140 initializes the neural network for each time window and discards the neural network at the end of the processing of the time window. The neural network may be initialized by setting the parameter values ​​of the neural network to random values. Thus, the time series processing module 140 performs the step of training the neural network but does not use the trained neural network for any processing. The time series processing module 140 uses the loss value determined during the training process to detect point anomalies in the time series data of the time window and repeats the process for the next time window. Furthermore, the time series processing module 140 trains the neural network for a predetermined number of iterations rather than training the neural network until the total loss value falls below a threshold. The predetermined number of iterations may be configurable by a user or set to a default value. The predetermined number of iterations is set to a value less than the number of iterations required to ensure that the total loss value falls below the threshold. This ensures that the anomaly detection process runs efficiently since the goal of the time series processing module 140 is not to generate a trained model that can be used at inference time to make predictions, but only goes through a partial training process, so that the loss values ​​during the partial training process can be used to identify point anomalies.

[0041] Performance improvements Experimental data shows the performance improvements obtained by using the techniques disclosed herein. The table below shows the F1 scores obtained by running various models on various datasets. The F1 score is calculated as F1=2*precision*recall / (precision+recall). Each column represents a particular dataset and each row represents a particular model. The disclosed techniques were compared to other models including WinStats, ISF, RRCF (robust random cut forest), and Prophet. The first row represents data from a system according to one disclosed embodiment, and the remaining rows represent other models that do not use the disclosed techniques. For example, (1) WinStats (window statistics) is a technique that uses statistics of time series data to determine which particular points are anomalous, (2) ISF (isolation forest) is a technique based on a decision tree algorithm, (3) RRCF (robust random cut forest) is a technique similar to ISF but modified to work on streaming data, and (4) Prophet is an approach based on regression models. [Table 1]

[0042] As shown in the above table, the F1 scores of the system based on the disclosed technology showed that the system predicts anomalies without requiring any retraining, but outperforms all the models tested or close to the best model. For example, the last "Average" column represents the average performance of all the models for the various datasets, showing that the average performance of the disclosed system is better than all the models studied. Thus, the disclosed system is computationally efficient since it requires significantly less computational resources to train the model compared to the other techniques, while at least exhibiting comparable or better performance than the other techniques. The average performance of the disclosed technology across all datasets was better than all the other techniques tested. Computer Architecture

[0043] Figure 7 is a high-level block diagram illustrating an example computer for implementing the client device and / or computing system of Figure 1. Computer 700 includes at least one processor 702 coupled to a chipset 704. Chipset 704 includes a memory controller hub 720 and an input / output (I / O) controller hub 722. Memory 706 and graphics adapter 712 are coupled to memory controller hub 720, and display 718 is coupled to graphics adapter 712. Storage device 708, input device 714, and network adapter 716 are coupled to I / O controller hub 722. Other embodiments of computer 700 have different architectures.

[0044] The storage device 708 is a non-transitory computer-readable storage medium, such as a hard drive, a compact disc read-only memory (CD-ROM), a DVD, or a solid-state memory device. The memory 706 holds instructions and data used by the processor 702. The input interface 714 is a touch screen interface, a mouse, a trackball, or other type of pointing device, a keyboard, or some combination thereof, and is used to input data into the computer 700. In some embodiments, the computer 700 may be configured to receive input (e.g., commands) from the input interface 714 via gestures from a user. The graphics adapter 712 displays images and other information on the display 718. The network adapter 716 couples the computer 700 to one or more computer networks.

[0045] The computer 700 is adapted to execute computer modules for providing the functions described herein. As used herein, the term "module" refers to computer program logic used to provide a particular function. Thus, a module may be implemented in hardware, firmware, and / or software. In one embodiment, the computer module is stored on the storage device 708, loaded into the memory 706, and executed by the processor 702.

[0046] 1 may vary depending on the embodiment and the processing power required by the entity. Computer 700 may lack some of the components described above, such as graphics adapter 712, display 718, etc. For example, computing system 130 may be comprised of multiple blade servers communicating over a network, such as in a server farm. Alternative Embodiments

[0047] It should be understood that the figures and descriptions of the disclosed invention are simplified to illustrate elements relevant to a clear understanding of the invention, but for clarity, omit many other elements found in a typical distributed system. Those skilled in the art may recognize that other elements and / or steps are desirable and / or necessary in implementing the embodiments. However, because such elements and steps are well known in the art and do not facilitate a better understanding of the embodiments, a discussion of such elements and steps is not provided herein. The disclosure herein covers all such variations and modifications to such elements and methods known to those skilled in the art.

[0048] Some portions of the above description describe embodiments in terms of algorithms and symbolic representations of operations on information. These algorithmic descriptions and representations are used by those skilled in the data processing arts to effectively convey the substance of their work to others skilled in the art. These operations, while described functionally, computationally, or logically, will be understood to be implemented by computer programs or equivalent electrical circuits, microcode, or the like. Further, it has proven convenient at times, without loss of generality, to refer to arrangements of these operations as modules. The described operations and their associated modules may be embodied in software, firmware, hardware, or any combination thereof.

[0049] As used herein, any reference to "one embodiment" or "an embodiment" means that a particular element, feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearances of the phrase "in one embodiment" in various places in the specification do not necessarily all refer to the same embodiment.

[0050] Some embodiments may be described using the terms "coupled" and "connected," along with their derivatives. It should be understood that these terms are not intended as synonyms for each other. For example, some embodiments may be described using the term "connected" to indicate that two or more elements are in direct physical or electrical contact with each other. In another example, some embodiments may be described using the term "coupled" to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term "coupled" may also mean that two or more elements are not in direct contact with each other, but still cooperate or interact with each other. The embodiments are not limited in this context.

[0051] As used herein, the words "comprise," "comprising," "including," "including," "having," or any other derivatives thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, article, or apparatus that includes a list of elements is not necessarily limited to only those elements, but may include other elements not expressly listed or inherent in such process, method, article, or apparatus. Furthermore, unless expressly stated to the contrary, "or" refers to an inclusive or, not an exclusive or. For example, a condition A or B is satisfied by any one of the following: A being true (or present) and B being false (or absent), A being false (or absent) and B being true (or present), and both A and B being true (or present).

[0052] In addition, the use of "a" or "an" is used to describe elements and components of the embodiments herein. This is done merely for convenience and to give a general sense of the invention. This description should be read to include one or at least one, and the singular also includes the plural unless it is clear that this is not meant.

[0053] Upon reading this disclosure, those skilled in the art will appreciate still additional alternative structural and functional designs for systems and processes for displaying charts using distorted regions through the principles disclosed herein. Thus, while specific embodiments and applications have been illustrated and described, it should be understood that the disclosed embodiments are not limited to the precise structures and components disclosed herein. Various modifications, changes and variations, which will be apparent to those skilled in the art, may be made in the arrangement, operation and details of the methods and apparatus disclosed herein without departing from the spirit and scope as defined by the appended claims.

Claims

1. 1. A computer-implemented method for identifying anomalies in time series data, comprising: receiving a time series including a sequence of data values, each data value being associated with a time value; identifying a time window representing a range of time values; identifying anomalies in the time series data in the time window, initializing a neural network configured to receive input time values ​​and predict data values ​​of the time series for the input time values; training the neural network for a predetermined number of iterations, For one or more time values ​​of the time window: executing the neural network to predict a data value for the time value; determining a loss value based on the predicted data values; and adjusting parameters of the neural network based on the loss value. determining an anomaly within the time window after the predetermined number of iterations, determining, in response to a loss value corresponding to a time value exceeding a threshold, identifying the corresponding data value as anomalous; and storing information describing the one or more data values ​​identified as anomalous.

2. The computer-implemented method of claim 1 , wherein the time anomaly is a point time anomaly.

3. The computer-implemented method of claim 1 , wherein initializing the neural network comprises assigning random values ​​to parameters of the neural network.

4. the time window is a first time window and the range of time values ​​is a first range of time values, and the computer-implemented method further comprises: identifying a second time window representing a range of second time values; identifying an anomaly within the second time window, reinitializing the neural network for the second time window; training the neural network using data values ​​in the second time window for the predetermined number of iterations; and identifying the data value for the time value of the second time window as anomalous in response to the loss value for the time value of the second time window exceeding the threshold.

5. The computer-implemented method of claim 1 , wherein a loss value represents a difference between the predicted data value and the data value of the time series corresponding to the time value.

6. Adjusting the parameters of the neural network determining a total loss value based on the loss values ​​corresponding to the time values ​​of the time window; and adjusting parameters of the neural network based on the total loss value.

7. The time series represents resource utilization of a computing resource, and the computer-implemented method includes: identifying a potential resource fault based on the identified anomaly; and The computer-implemented method of claim 1 , further comprising: sending a message reporting the potential resource failure.

8. The computing resource includes: Processing Resources Memory Resources Network resources, or The computer-implemented method of claim 7 , wherein the storage resource is one of the storage resources.

9. The time series represents resource utilization of a computing resource, and the computer-implemented method includes: The computer-implemented method of claim 7 , further comprising taking corrective action to prevent the potential resource failure.

10. 10. The computer-implemented method of claim 1, wherein the neural network is a multi-layer perceptron configured to receive a scalar input and output a scalar value.

11. adjusting the threshold based on a comparison of the identified one or more anomalies to known anomalies; and The computer-implemented method of claim 1 , further comprising: using the adjusted threshold to identify anomalies for one or more other time windows.

12. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more computer processors, cause the one or more computer processors to: receiving a time series including a sequence of data values, each data value being associated with a time value; identifying a time window representing a range of time values; identifying anomalies in the time series of data within the time window, the identifying including: initializing a neural network configured to receive input time values ​​and predict data values ​​of the time series for the input time values; training the neural network for a predetermined number of iterations, said training comprising: For one or more time values ​​of the time window: executing the neural network to predict a data value for the time value; determining a loss value based on the predicted data values; Adjusting and training parameters of the neural network based on the loss value; determining an anomaly within the time window after the predetermined number of iterations, wherein determining the anomaly includes the one or more computer processors: in response to a loss value corresponding to a time value exceeding a threshold, identifying the corresponding data value as anomalous; and storing information describing one or more data values ​​identified as anomalous.

13. The time window is a first time window and the range of time values ​​is a first range of time values, and the instructions further include: identifying a second time window representing a range of second time values; the one or more computer processors; reinitializing the neural network for a second time window; training the neural network using data values ​​in the second time window for the predetermined number of iterations; 13. The non-transitory computer-readable storage medium of claim 12, further comprising: in response to a loss value for a time value of the second time window exceeding the threshold, identifying the data value for the time value as an anomaly, thereby identifying an anomaly within the second time window.

14. The instructions for adjusting parameters of the neural network may include: determining a total loss value based on the loss values ​​corresponding to the time values ​​of the time window; and adjusting parameters of the neural network based on the total loss value.

15. 1. A computer system comprising: one or more computer processors; and a non-transitory computer-readable storage medium storing instructions that, when executed by one or more computer processors, cause the one or more computer processors to: receiving a time series including a sequence of data values, each data value being associated with a time value; identifying a time window representing a range of time values; identifying anomalies in the time series of data within the time window, the identifying including: initializing a neural network configured to receive input time values ​​and predict data values ​​of the time series for the input time values; training the neural network for a predetermined number of iterations, said training comprising: For one or more time values ​​of the time window: executing the neural network to predict a data value for the time value; determining a loss value based on the predicted data values; Adjusting and training parameters of the neural network based on the loss value; determining an anomaly within the time window after the predetermined number of iterations, wherein determining the anomaly includes the one or more computer processors: in response to a loss value corresponding to a time value exceeding a threshold, identifying the corresponding data value as anomalous; and storing information describing one or more data values ​​identified as anomalous.

Images