Minimally monitored anomaly source detection based on seasonality
System, methods, and machine-readable media may facilitate minimally monitored anomaly source detection based on seasonality. Time series data individually corresponding to entities may be obtained. For each entity or for each cluster of entities, statistical parameter fingerprints may be generated. For each entity or cluster, the statistical parameter fingerprints may be updated using a weighted averaging technique that incorporates newly received time series data. The statistical parameter fingerprints for a given entity or cluster may be compared across the time horizons to detect discrepancies indicative of seasonality. Anomaly detection thresholds may be defined for each time horizon based on the corresponding statistical parameter fingerprints. An anomalous value in the time series data of an entity or cluster may be detected by determining that a value falls outside the anomaly detection threshold for at least one time horizon. Automated interventions may be performed based on a severity assessment.
1 . A system comprising:
one or more processing devices and memory communicatively coupled with and readable by the one or more processing devices, the memory comprising processor-readable instructions which, when executed by the one or more processing devices, cause the system to perform operations comprising:
obtaining time series data individually corresponding to a plurality of entities;
for each entity of the plurality of entities or for each cluster of entities of the plurality of entities, generating statistical parameter fingerprints comprising at least mean and variance values calculated across a plurality of time horizons, the plurality of time horizons including at least a first horizon and a second horizon;
storing the statistical parameter fingerprints in a data store associated with the system;
updating, for each entity or cluster, the statistical parameter fingerprints using a weighted averaging technique that incorporates newly received time series data;
comparing the statistical parameter fingerprints for a given entity or cluster across the plurality of time horizons to detect discrepancies indicative of seasonality;
defining anomaly detection thresholds for each time horizon based at least in part on the corresponding statistical parameter fingerprints;
detecting an anomalous value in the time series data of an entity or cluster by determining that a value falls outside the anomaly detection threshold for at least one time horizon; and
upon validating that an anomaly has occurred, performing one or more automated interventions based on a severity assessment.
2 . The system as recited claim 1 , the operations further comprising validating whether the detected anomalous value is an anomaly by comparing the statistical parameter fingerprints of the entity or cluster to those of one or more correlated peers, the correlated peers identified based on shared hierarchical and/or attribute values.
3 . The system as recited claim 1 , the operations further comprising adjusting the anomaly detection thresholds dynamically in response to statistical feedback from cluster-level analysis.
4 . The system as recited claim 1 , wherein the one or more automated interventions comprise blocking a resource transfer.
5 . The system as recited claim 1 , wherein the one or more automated interventions comprise freezing an account.
6 . The system as recited claim 1 , wherein the automated interventions are triggered according to a threat matrix that maps anomaly scores to specific intervention actions.
7 . The system as recited claim 6 , wherein the threat matrix is dynamically updated based on intervention outcomes.
8 . The system as recited claim 2 , wherein the validating whether the detected anomalous value is an anomaly further comprises:
identifying correlated peers for the entity or cluster based on a first level of a hierarchy; and
when the statistical parameter fingerprints of the entity or cluster are not anomalous with respect to first level peers, identifying correlated peers based on a second level of the hierarchy and determining whether the statistical parameter fingerprints of the entity or cluster are anomalous with respect to the correlated peers based on the second level.
9 . A computer-implemented method comprising:
obtaining, by a computer system, time series data individually corresponding to a plurality of entities;
for each entity of the plurality of entities or for each cluster of entities of the plurality of entities, generating, by the computer system, statistical parameter fingerprints comprising at least mean and variance values calculated across a plurality of time horizons, the plurality of time horizons including at least a first horizon and a second horizon;
storing, by the computer system, the statistical parameter fingerprints in a data store associated with the computer system;
updating, by the computer system for each entity or cluster, the statistical parameter fingerprints using a weighted averaging technique that incorporates newly received time series data;
comparing, by the computer system, the statistical parameter fingerprints for a given entity or cluster across the plurality of time horizons to detect discrepancies indicative of seasonality;
defining, by the computer system, anomaly detection thresholds for each time horizon based at least in part on the corresponding statistical parameter fingerprints;
detecting, by the computer system, an anomalous value in the time series data of an entity or cluster by determining that a value falls outside the anomaly detection threshold for at least one time horizon; and
upon validating that an anomaly has occurred, performing, by the computer system, one or more automated interventions based on a severity assessment.
10 . The computer-implemented method as recited claim 9 , further comprising validating whether the detected anomalous value is an anomaly by comparing the statistical parameter fingerprints of the entity or cluster to those of one or more correlated peers, the correlated peers identified based on shared hierarchical and/or attribute values.
11 . The computer-implemented method as recited claim 9 , further comprising adjusting the anomaly detection thresholds dynamically in response to statistical feedback from cluster-level analysis.
12 . The computer-implemented method as recited claim 9 , wherein the one or more automated interventions comprise blocking a resource transfer.
13 . The computer-implemented method as recited claim 9 , wherein the one or more automated interventions comprise freezing an account.
14 . The computer-implemented method as recited claim 9 , wherein the automated interventions are triggered according to a threat matrix that maps anomaly scores to specific intervention actions.
15 . The computer-implemented method as recited claim 14 , wherein the threat matrix is dynamically updated based on intervention outcomes.
16 . The computer-implemented method as recited claim 10 , wherein the validating whether the detected anomalous value is an anomaly further comprises:
identifying correlated peers for the entity or cluster based on a first level of a hierarchy; and
when the statistical parameter fingerprints of the entity or cluster are not anomalous with respect to first level peers, identifying correlated peers based on a second level of the hierarchy and determining whether the statistical parameter fingerprints of the entity or cluster are anomalous with respect to the correlated peers based on the second level.
17 . One or more non-transitory, machine-readable media having machine-readable instructions thereon which, when executed by one or more processing devices, cause a system to perform operations comprising:
obtaining time series data individually corresponding to a plurality of entities;
for each entity of the plurality of entities or for each cluster of entities of the plurality of entities, generating statistical parameter fingerprints comprising at least mean and variance values calculated across a plurality of time horizons, the plurality of time horizons including at least a first horizon and a second horizon;
storing the statistical parameter fingerprints in a data store associated with the system;
updating, for each entity or cluster, the statistical parameter fingerprints using a weighted averaging technique that incorporates newly received time series data;
comparing the statistical parameter fingerprints for a given entity or cluster across the plurality of time horizons to detect discrepancies indicative of seasonality;
defining anomaly detection thresholds for each time horizon based at least in part on the corresponding statistical parameter fingerprints;
detecting an anomalous value in the time series data of an entity or cluster by determining that a value falls outside the anomaly detection threshold for at least one time horizon; and
upon validating that an anomaly has occurred, performing one or more automated interventions based on a severity assessment.
18 . The one or more non-transitory, machine-readable media as recited claim 17 , the operations further comprising validating whether the detected anomalous value is an anomaly by comparing the statistical parameter fingerprints of the entity or cluster to those of one or more correlated peers, the correlated peers identified based on shared hierarchical and/or attribute values.
19 . The one or more non-transitory, machine-readable media as recited claim 17 , the operations further comprising adjusting the anomaly detection thresholds dynamically in response to statistical feedback from cluster-level analysis.
20 . The one or more non-transitory, machine-readable media as recited claim 17 , wherein the one or more automated interventions comprise blocking a resource transfer.