Time-Series Anomaly Detection Using Dynamic Time Windows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The vast amount of time-series data collected in IT networks makes it difficult to manage and synthesize for identifying anomalies, leading to challenges in detecting issues and potential false anomaly reporting.
Innovation Solution
An application server analyzes time-series data using a relational time-series query request, classifies the data based on one or more classifications, generates a statistical model, and calculates an anomalous score by adjusting the time window dynamically to identify and report anomalies accurately.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a fixed time window is used for anomaly detection, then the detection process is simple, but the accuracy decreases when data probability varies over time
Solution Approach 1:
The patent implements a dynamic time window adjustment mechanism where the time window size is automatically modified based on the probability characteristics of the time-series data. The system calculates data probability and adjusts the time window accordingly - expanding it when probability is low and contracting it when probability is high - thereby adapting the detection sensitivity to varying data conditions and improving anomaly detection accuracy.
2Measurement precision
If more time-series data is collected, then the statistical model becomes more accurate, but the difficulty of synthesizing and managing the data increases
Solution Approach 1:
The patent extracts and utilizes only the necessary historical data points required for constructing the statistical model, rather than processing all available time-series data. By selectively extracting relevant data based on the dynamic time window and probability thresholds, the system achieves accurate statistical modeling while avoiding the complexity of synthesizing and managing vast amounts of raw data.
3Reliability
If the time window is expanded to capture more data patterns, then the anomaly detection coverage improves, but the response time to detect anomalies increases
Solution Approach 1:
The system dynamically adjusts the time window size based on real-time probability calculations. When data probability is low (indicating potential anomaly), the time window is expanded to improve detection coverage and reliability. When data probability is high (normal conditions), the time window is contracted to enable faster response time. This dynamic adjustment resolves the contradiction between coverage and response time by adapting the window size to current data conditions.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
An anomaly detection module may include a time-series analyzer that classifies current time-series data into at least one of a plurality of classifications based upon historical data and may construct a statistical model representative of the current time-series data based upon the at least one of the plurality of classifications. An anomaly detector monitors a stream of the current time-series data and identifies statistical outliers of the stream of the current time-series data, based upon the statistical model and may determine an anomalous score for the statistical outliers by tracking a history of the statistical outliers; wherein the anomalous score comprises a representation of a magnitude of deviation between the current time-series data and the statistical model over multiple measurements of the current time-series data, over a particular time interval, or both.