Web Service Usage Anomaly Detection via Forecasting

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Web service providers face challenges in detecting and preventing usage anomalies, leading to unexpected high costs and potential customer dissatisfaction, as well as impacts on service reliability due to unintentional or unforeseen high usage.

Innovation Solution

A method involving a trained forecasting model to predict web service usage data, comparing near real-time data to forecasted values to identify anomalies, and providing alerts for remedial action, with the ability to adjust based on feedback and context information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If web service providers bill customers at regular intervals (e.g., monthly), then billing simplicity is maintained, but anomaly detection is delayed and costs increase

Engineering Contradiction:

Improvebilling simplicityVSAvoidanomaly detection delay

Core Design Contradiction:

Ease of manufactureVSLoss of time

Solution Approach 1:

The system performs preliminary actions by establishing usage forecasts and thresholds before the billing period ends. It proactively monitors usage throughout the month and prepares anomaly detection mechanisms in advance, so when anomalies occur, they are quickly identified and addressed rather than waiting for monthly billing review.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The billing period is segmented into smaller monitoring intervals with continuous usage tracking. Instead of reviewing total monthly usage, the system divides the monitoring into daily or hourly segments, comparing actual usage against forecasted usage for each segment, enabling timely anomaly detection while maintaining simple monthly billing.

Inventive Principle:

Principle #1Segmentation

2Speed

If usage monitoring is performed continuously in near real-time, then anomaly detection speed improves, but system complexity increases

Engineering Contradiction:

Improveanomaly detection speedVSAvoidmonitoring system complexity

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The system introduces a forecast model as an intermediary between raw usage data and anomaly detection. Instead of directly comparing complex usage patterns against static thresholds, the forecast model generates expected usage values that serve as dynamic baselines, simplifying the anomaly detection process while enabling rapid real-time monitoring.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements feedback loops where actual usage data continuously feeds back to update and refine the forecast model. This feedback mechanism allows the system to adapt to changing usage patterns automatically, maintaining high detection speed while reducing the need for manual configuration and complex rule-based monitoring systems.

Inventive Principle:

Principle #23Feedback

3Measurement precision

If usage thresholds are set to be highly sensitive, then anomaly detection precision improves, but false positive rate increases

Engineering Contradiction:

Improveanomaly detection precisionVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSObject-generated harmful factors

Solution Approach 1:

The system dynamically changes the threshold parameters based on historical usage patterns and forecasted values. Instead of using fixed static thresholds, the thresholds are adjusted as multiples of the forecasted usage (e.g., 1.2x, 1.5x, 2x the forecast), allowing the system to maintain high precision while adapting to different service levels and usage variability, thereby reducing false positives.

Inventive Principle:

Principle #35Parameter changes

4Reliability

If high usage is allowed to continue until monthly billing review, then service availability is maintained, but costs increase and customer dissatisfaction grows

Engineering Contradiction:

Improveservice availabilityVSAvoidunnecessary resource consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system applies preliminary anti-action by detecting and addressing usage anomalies before they result in significant resource waste and cost overruns. When usage exceeds the forecasted threshold, the system immediately generates alerts and can trigger automated responses to correct the underlying issue, preventing the accumulation of unnecessary resource consumption while maintaining service availability.

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS11799889B2Web service usage anomaly detection and prevention

Publication Date: 2023.10.24 INTUIT INC

AI summary

Certain aspects of the present disclosure provide techniques for detecting and preventing web service usage anomalies. Embodiments include forecasting, based on a model, a number of resource instances for one or more web services for a time period. Embodiments include receiving, after the time period has elapsed, a detected number of resource instances for the one or more web services for the time period. Embodiments include comparing the detected number of resource instances to the forecasted number of resource instances. Embodiments include determining, based on the comparing, a usage anomaly. Embodiments include determining an impact of the usage anomaly. Embodiments include outputting an indication of the usage anomaly and the impact of the usage anomaly.