IP Library › Granted Patent US 12676823

Granted Patent B1

US 12676823 · App. 17/364,823 · Granted Jul 7, 2026

Dynamically provisioning resources for detecting anomalies in time series data using machine learning models

Inventors: Ranjith Kumar Bodla (Snohomish, WA); Lakshay Kharbanda (Seattle, WA); Sadanand Murthy Sachidananda (Bothell, WA); Ashutosh Gupta (Seattle, WA); Gaurav Rajendra Kataria (Lynnwood, WA); Ketan Vijayvargiya (Seattle, WA)

Assignee: Amazon Technologies, Inc.

H04L47/765 G06F18/214 H04L47/788 H04L47/827 H04L47/828

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12676823
App. No.: 17/364,823
Granted: Jul 7, 2026
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Computing resources for anomaly detection on time series data using a machine learning model may be dynamically provisioned. An expected workload of anomaly detection on time series data is determined in order to determine a number of computing resources. The number of computing resources are provisioned for anomaly detection and updated when the machine learning model is re-trained.

Claims (51)

1 . A system, comprising:

at least one processor; and

a memory, storing program instructions that when executed by the at least one processor, cause the at least one processor to implement:

receive a request to enable anomaly detection using a machine learning model to detect anomalies in time series data, wherein the time series data comprises a plurality of series of data points;

cause the machine learning model to be trained to detect anomalies in the time series data that is to be received as input to the machine learning model;

determine a number of computing resources to be used to apply the machine learning model to detect the anomalies in the time series data, based, at least in part, on:

a first factor comprising a numerical value representing a minimum performance commitment for performing anomaly detection;

a second factor comprising a numerical value representing a compute capacity for an individual one of the computing resources to perform detection of the anomalies in the time series data using the machine learning model; and

a number of different series of data points in the plurality of series of data points to be evaluated by the machine learning model to detect the anomalies in the time series data, wherein the determined number of computing resources to be used is proportional to the number of different series of data points in the plurality of series of data points to be evaluated;

provision the determined number of computing resources to be used to apply the machine learning model to the time series data; and

enable the anomaly detection for the time series data using the provisioned number of computing resources by applying the trained machine learning model to the time series data, wherein the time series data is received as input to the machine learning model.

2 . The system of claim 1 , wherein to determine the number of computing resources to apply the machine learning model to the time series data, the program instructions cause the at least one processor to:

multiply the numerical value representing the minimum performance commitment for performing the anomaly detection by the numerical value representing the compute capacity for the individual computing resource to determine a result; and

divide the number of different series of data points in the time series data to be evaluated for anomalies by the result.

3 . The system of claim 1 , wherein the at least one memory stores further program instructions that when executed by the at last one processor, cause the at least one processor to provision a different number of computing resources for the time series data after the machine learning model is re-trained.

4 . The system of claim 1 , wherein the at least one processor and the memory are implemented as part of an anomaly detection service offered by a provider network and wherein the time series data is stored in a storage service offered by the provider network.

5 . A method, comprising:

receiving, by an anomaly detection system, a request to enable anomaly detection using a machine learning model to detect anomalies in time series data, wherein the time series data comprises a plurality of series of data points;

training, by the anomaly detection system, the machine learning model to detect anomalies in the time series data that is to be received as input to the machine learning model;

provisioning, by the anomaly detection system, a number of computing resources to be used to apply the machine learning model to detect the anomalies in the time series data, the number of computing resources being determined based, at least in part, on:

a first factor comprising a numerical value representing a minimum performance commitment for performing anomaly detection;

enabling, by the anomaly detection system, the anomaly detection for the time series data using the provisioned number of computing resources by applying the trained machine learning model to the time series data, wherein the time series data is received as input to the machine learning model.

6 . The method of claim 5 , further comprising determining the number of computing resources comprising:

multiplying the numerical value representing the minimum performance commitment for performing the anomaly detection by the numerical value representing the compute capacity for the individual computing resource to determine a result; and

dividing the number of different series of data points in the time series data to be evaluated for anomalies by the result.

7 . The method of claim 6 , wherein determining the number of computing resources further comprises adding a buffer amount of computing resources.

8 . The method of claim 6 , wherein determining the number of computing resources further comprises raising an initially determined number of computing resources to a minimum number of computing resources.

9 . The method of claim 5 , further comprising provisioning a different number of computing resources for the time series data after the machine learning model is re-trained.

10 . The method of claim 5 , wherein enabling anomaly detection for the time series data using the provisioned number of computing resources applying the trained machine learning model to the time series data comprises determining a maximum concurrency threshold according to which evaluations of the time series data using the number of computing resources are performed.

11 . The method of claim 5 , wherein the number of computing resources are respective compute instances that host the machine learning model, and wherein the respective compute instances receive requests to evaluate the time series data via a network endpoint that distributes the requests to the respective compute instances.

12 . The method of claim 5 , wherein enabling anomaly detection for the time series data using the provisioned number of computing resources applying the trained machine learning model to the time series data comprises filtering out unknown series added to the time series data for evaluation using the trained machine learning model.

13 . The method of claim 12 , further comprising:

after re-training the machine learning model based on the unknown series, allowing evaluation of the unknown series using the trained machine learning model.

14 . One or more non-transitory, computer-readable storage media, storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement:

receiving a request to enable anomaly detection using a machine learning model to detect anomalies in time series data, wherein the time series data comprises a plurality of series of data points;

causing the machine learning model to be trained to detect anomalies in the time series data that is to be received as input to the machine learning model;

causing a number of computing resources to be provisioned to be used to apply the machine learning model to detect the anomalies in the time series data, the number of computing resources being determined based, at least in part, on:

a first factor comprising a numerical value representing a minimum performance commitment for performing anomaly detection;

enabling the anomaly detection for the time series data using the provisioned number of computing resources by applying the trained machine learning model to the time series data, wherein the time series data is received as input to the machine learning model.

15 . The one or more non-transitory, computer-readable storage media of claim 14 , storing further instructions that when executed by one or more computing devices, cause the one or more computing devices to further implement provisioning a different number of computing resources for the time series data after the machine learning model is re-trained.

16 . The one or more non-transitory, computer-readable storage media of claim 14 , wherein, in enabling anomaly detection for the time series data using the provisioned number of computing resources applying the trained machine learning model to the time series data, the program instructions cause the one or more computing devices to implement determining a maximum concurrency threshold according to which evaluations of the time series data using the number of computing resources are performed.

17 . The one or more non-transitory, computer-readable storage media of claim 14 , wherein, in enabling anomaly detection for the time series data using the provisioned number of computing resources applying the trained machine learning model to the time series data, the program instructions cause the one or more computing devices to implement filtering out unknown series added to the time series data for evaluation using the trained machine learning model.

18 . The one or more non-transitory, computer-readable storage media of claim 14 , storing further instructions that when executed by one or more computing devices, cause the one or more computing devices to further implement determining the number of computing resources by:

dividing the number of different series of data points in the time series data to be evaluated for anomalies by the result.

19 . The one or more non-transitory, computer-readable storage media of claim 18 , wherein, in determining the number of computing resources, the program instructions cause the one or more computing devices to implement adding a buffer amount of computing resources.

20 . The one or more non-transitory, computer-readable storage media of claim 14 , wherein the one or more computing devices are implemented as part of an anomaly detection service offered by a provider network and wherein the time series data is stored in a storage service external to the provider network.