Anomaly Detection Using Forecast-Based Confidence Intervals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems for time series data face challenges in accurately identifying anomalies, particularly in complex data sets with seasonality and trends, due to reliance on threshold-based methods that require expert knowledge and are prone to false positives, or complex machine learning models that are difficult to interpret and tune.
Innovation Solution
A network anomaly detection system using configurable statistical control rules (SCRs) that forecasts future values based on seasonality characteristics and compares actual values with predicted values and confidence intervals, allowing for customizable and visually configurable anomaly detection triggers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If threshold-based anomaly detection is used, then implementation is simple and computationally efficient, but the system requires expert knowledge to set thresholds and generates false positives or misses anomalies
Solution Approach 1:
The patent introduces forecasted values and confidence intervals as intermediary elements between the simple threshold check and the actual anomaly detection. Instead of directly comparing observed values to fixed thresholds, the system compares them to dynamically generated forecast ranges, which automatically adapt to seasonal patterns and trends in the data without requiring expert knowledge
Solution Approach 2:
The system changes the parameter from fixed thresholds to dynamic forecast-based thresholds that adapt to data characteristics. By using forecasted values with confidence intervals, the thresholds automatically adjust to seasonal variations and trends, improving detection accuracy while maintaining simplicity
2Productivity
If simple threshold checks are used, then the system is computationally efficient, but it is not sensitive to complex data characteristics such as recent trends or seasonality
Solution Approach 1:
The system performs preliminary forecasting to establish expected value ranges before conducting anomaly detection. By pre-calculating forecasted values and confidence intervals that capture seasonal patterns and trends, the system prepares adaptive thresholds in advance, enabling efficient real-time detection without complex computations during the monitoring phase
3Measurement precision
If machine learned anomaly detection models are used, then the system can produce good results, but the models are difficult to build and tune requiring long training periods and large amounts of training data
Solution Approach 1:
The patent extracts the essential forecasting and uncertainty quantification components from complex machine learning models. By using simpler statistical forecasting methods to generate confidence intervals and comparing observed values against these intervals, the system achieves anomaly detection accuracy comparable to ML models while eliminating the need for extensive training data and model tuning
Solution Approach 2:
The system replaces expensive, complex machine learning models with simpler, computationally inexpensive forecasting methods. The forecast-based approach uses lightweight statistical calculations that require minimal training data and can be quickly adapted to different datasets without the overhead of training sophisticated ML models
4Measurement precision
If machine learning models are used, then anomaly detection accuracy improves, but the models provide little clue as to why a particular observation was flagged as an anomaly
Solution Approach 1:
The system provides feedback by comparing observed values against forecasted values and confidence intervals, making the anomaly detection process transparent. When an anomaly is detected, the system can explain that the observed value fell outside the expected range based on historical patterns and seasonal trends, providing actionable insights rather than black box decisions
Data Source
AI summary
Systems and methods are disclosed to implement a time series anomaly detection system that uses configurable statistical control rules (SCRs) and a forecasting system to detect anomalies in a time series data (e.g. fluctuating values of a network activity metric). In embodiments, the system forecasts future values of the time series data along with a confidence interval based on seasonality characteristics of the data. The time series data is monitored for anomalies by comparing actual observed values in the time series with the predicted values and confidence intervals, according to the SCRs. The SCRs may be defined and tuned via a configuration interface that allows users to visually see how different SCRs perform over real data. Advantageously, the disclosed system allows users to create custom anomaly detection triggers for different types of time series data, without use of a monolithic detection model which can be difficult to tune.