Anomaly detection with model hyperparameter selection

1 . One or more non-transitory computer-readable media storing program instructions that, when executed by one or more processors, cause the one or more processors to perform a method comprising:

receiving, for one or more data points of a data set, an anomaly label indicating an error in a determination by a second machine learning model about whether the one or more data points correspond to an anomaly,

generating, using a first machine learning model, one or more updated hyperparameters based on the one or more data points and the anomaly label, wherein the first machine learning model is trained to minimize a cost function that incorporates a previous cost state weighted by a decay rate and a difference between a time-series data sample and a predicted time series that is a parametric function of the one or more updated hyperparameters, and

training the second machine learning model to determine anomalies in the data set, wherein the training is performed using the one or more updated hyperparameters.

2 . The one or more non-transitory computer-readable media of claim 1 , wherein the data set includes at least one of a set of metrics of a system or a set of logs of the system.

3 . The one or more non-transitory computer-readable media of claim 1 , wherein the anomaly label is received through a user interface as a selection of the one or more data points of the data set and a selection of the anomaly label.

4 . The one or more non-transitory computer-readable media of claim 1 , wherein the error in the determination comprises an incorrect determination by the second machine learning model that the one or more data points correspond to the anomaly.

5 . The one or more non-transitory computer-readable media of claim 1 , wherein the training includes at least one of retraining of the second machine learning model or training a replacement machine learning model to replace the second machine learning model.

6 . The one or more non-transitory computer-readable media of claim 1 , wherein the method further comprises: displaying a predicted anomaly label for the one or more data points received from the second machine learning model after the training.

7 . The one or more non-transitory computer-readable media of claim 1 , wherein the method further comprises: applying the second machine learning model, after the training, to detect anomalies in the data set.

8 . The one or more non-transitory computer-readable media of claim 1 , wherein the one or more updated hyperparameters includes one or more of a window size, a sequence length, a number of long short-term memory units, a number of repeat units, a number of training epochs, a training batch size, an optimization function, an activation function, a loss function, or the decay rate.

9 . The one or more non-transitory computer-readable media of claim 1 , wherein the second machine learning model determines anomalies in the data set according to a baseline.

10 . The one or more non-transitory computer-readable media of claim 1 , wherein a baseline for determining anomalies is determined according to a baseline equation.

11 . The one or more non-transitory computer-readable media of claim 1 , wherein the method further includes training the first machine learning model based on a reinforcement learning process.

12 . The one or more non-transitory computer-readable media of claim 1 , wherein the error in the determination comprises a failure by the second machine learning model to determine that the one or more data points correspond to the anomaly.

13 . A system, comprising:

a memory that stores instructions, and

a processor that is coupled to the memory and, when executing the instructions, is configured to:

receive, for one or more data points of a data set, an anomaly label indicating an error in a determination by a second machine learning model about whether the one or more data points correspond to an anomaly,

generate, using a first machine learning model, one or more updated hyperparameters based on the one or more data points and the anomaly label, wherein the first machine learning model is trained to minimize a cost function that incorporates a previous cost state weighted by a decay rate and a difference between a time-series data sample and a predicted time series that is a parametric function of the one or more updated hyperparameters, and

train the second machine learning model to determine anomalies in the data set, wherein the training is performed using the one or more updated hyperparameters.

14 . The system of claim 13 , wherein the data set includes at least one of a set of metrics of a second system or a set of logs of the second system.

15 . The system of claim 13 , wherein the anomaly label is received through a user interface as a selection of the one or more data points of the data set and a selection of the anomaly label.

16 . The system of claim 13 , wherein the error in the determination comprises an incorrect determination by the second machine learning model that the one or more data points correspond to the anomaly.

17 . The system of claim 13 , wherein the training includes at least one of retraining of the second machine learning model or training a replacement machine learning model to replace the second machine learning model.

18 . The system of claim 13 , wherein the processor is further configured, when executing the instructions, to display a predicted anomaly label for the one or more data points received from the second machine learning model after the training.

19 . The system of claim 13 , wherein the processor is further configured, when executing the instructions, to apply the second machine learning model, after the training, to detect anomalies in the data set.

20 . The system of claim 13 , wherein the one or more updated hyperparameters includes one or more of, a window size, a sequence length, a number of long short-term memory units, a number of repeat units, a number of training epochs, a training batch size, an optimization function, an activation function, a loss function, or the decay rate.

21 . The system of claim 13 , wherein the second machine learning model determines anomalies in the data set according to a baseline.

22 . The system of claim 13 , wherein a baseline for determining anomalies is determined according to a baseline equation.

23 . The system of claim 13 , wherein the processor is further configured, when executing the instructions, to train the first machine learning model based on a reinforcement learning process.

24 . The system of claim 13 , wherein the error in the determination comprises a failure by the second machine learning model to determine that the one or more data points correspond to the anomaly.

25 . A computer-implemented method, comprising:

receiving, for one or more data points of a data set, an anomaly label indicating an error in a determination by a second machine learning model about whether the one or more data points correspond to an anomaly,

generating, using a first machine learning model, one or more updated hyperparameters based on the one or more data points and the anomaly label, wherein the first machine learning model is trained to minimize a cost function that incorporates a previous cost state weighted by a decay rate and a difference between a time-series data sample and a predicted time series that is a parametric function of the one or more updated hyperparameters, and

training the second machine learning model to determine anomalies in the data set, wherein the training is performed using the one or more updated hyperparameters.

26 . The computer-implemented method of claim 25 , wherein the data set includes at least one of a set of metrics of a system or a set of logs of the system.

27 . The computer-implemented method of claim 25 , wherein the anomaly label is received through a user interface as a selection of the one or more data points of the data set and a selection of the anomaly label.

28 . The computer-implemented method of claim 25 , wherein the error in the determination comprises an incorrect determination by the second machine learning model that the one or more data points correspond to the anomaly.

29 . The computer-implemented method of claim 25 , wherein the training includes at least one of retraining of the second machine learning model or training a replacement machine learning model to replace the second machine learning model.

30 . The computer-implemented method of claim 25 , further comprising: displaying a predicted anomaly label for the one or more data points received from the second machine learning model after the training.

31 . The computer-implemented method of claim 25 , further comprising: applying the second machine learning model, after the training, to detect anomalies in the data set.

32 . The computer-implemented method of claim 25 , wherein the one or more updated hyperparameters includes one or more of, a window size, a sequence length, a number of long short-term memory units, a number of repeat units, a number of training epochs, a training batch size, an optimization function, an activation function, a loss function, or the decay rate.

33 . The computer-implemented method of claim 25 , wherein the second machine learning model determines anomalies in the data set according to a baseline.

34 . The computer-implemented method of claim 25 , wherein a baseline for determining anomalies is determined according to a baseline equation.

35 . The computer-implemented method of claim 25 , further comprising: training the first machine learning model based on a reinforcement learning process.

36 . The computer-implemented method of claim 25 , wherein the error in the determination comprises a failure by the second machine learning model to determine that the one or more data points correspond to the anomaly.