IP Library Granted Patent US 10,467,087
Granted Patent B2
US 10,467,087 · App. 15/725,202 · Granted Nov 5, 2019

Plato anomaly detection

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,467,087
App. No.
15/725,202
Granted
Nov 5, 2019
Kind
B2
Abstract

A method for continuous data anomaly detection includes identifying a period of time covered by metrics data stored in a repository. The stored metrics data is categorized into a plurality of non-overlapping time segments. Statistical analysis of the stored metrics data is performed based on the identified period of time. A range of acceptable metric values is dynamically generated based on the performed statistical analysis.

Claims (16)

1. A method for continuous data anomaly detection, the method comprising steps of:

identifying, by a processor, a period of time covered by metrics data stored in a repository wherein the period of time is greater than three weeks;

categorizing, by a processor, the stored metrics data into a plurality of non-overlapping time segments wherein each of the plurality of non-overlapping time segments represents a predefined number of minutes;

performing, by a processor, statistical analysis of the stored metrics data based on the identified period of time including calculating a mean and a standard deviation of the stored metrics for corresponding time segments for preceding three weeks;

dynamically generating, by a processor, a range of acceptable metric values based on the performed statistical analysis wherein an upper and lower boundary of the range is calculated based on the mean plus/minus the standard deviations of the metric, respectively, for the corresponding time segments for a first, second and third weeks, wherein the first week comprises a week immediately before a current week, the second week comprises a week that is two weeks before the current week and the third week comprises a week that is three weeks before the current week such that wherein performing the statistical analysis of a particular stored metric data for a particular time segment within a current week includes:

calculating a mean and a standard deviation of the metric for the corresponding time segment, a time segment preceding the corresponding time segment and a time segment succeeding the corresponding time segment within the first week;

calculating a mean and a standard deviation of the metric for the corresponding time segment, two time segments preceding the corresponding time segment and two time segments succeeding the corresponding time segment within the second week;

calculating a mean and a standard deviation of the metric for the corresponding time segment, three time segments preceding the corresponding time segment and three time segments succeeding the corresponding time segment within the third week;

discarding the calculated mean and standard deviation for the three time segments succeeding the corresponding time segment based upon predetermined criteria; and

selectively combining the calculated means and standard deviations for the current week and for the first, second and third weeks.

2. The method of claim 1 , wherein the period of time is less than one week, wherein each of the plurality of non-overlapping time segments represents a predefined number of minutes and wherein performing the statistical analysis of a particular stored metric data comprises calculating a mean and a standard deviation of the metric for the two latest time segments.

3. The method of claim 2 , wherein an upper boundary of the range is calculated based on the mean plus a predefined number of standard deviations, and wherein a lower boundary of the range is calculated based on the mean minus the predefined number of standard deviations.

4. The method of claim 1 , wherein the period of time is greater than one week and less than three weeks, wherein each of the plurality of non-overlapping time segments represents a predefined number of minutes and wherein performing the statistical analysis of a particular stored metric data for a particular time segment comprises calculating a mean and a standard deviation of the metric for the corresponding time segments for preceding two weeks.

5. The method of claim 4 , wherein an upper boundary of the range is calculated based on the mean plus the standard deviations of the metric for the corresponding time segments for the preceding two weeks, and wherein a lower boundary of the range is calculated based on the mean minus the standard deviations of the metric for the corresponding time segments for the preceding two weeks.

6. The method of claim 1 , wherein the step of selectively combining the calculated means and standard deviations comprises a selective inverse variance weighted mean calculation and a selective inverse variance weighted standard deviation calculation.

7. The method of claim 6 , wherein the calculated means and standard deviations are combined based on results of an automatically applied hypothesis test.

Assignments (3)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 23, 2021
From: AIRMAGNET, INC.
To: NETSCOUT SYSTEMS, INC.
Reel/Frame 057595/0428 →
SECURITY INTEREST Recorded Jul 27, 2021
From: NETSCOUT SYSTEMS, INC.; ARBOR NETWORKS, INC.; AIRMAGNET, INC.; NETSCOUT SYSTEMS TEXAS, LLC
To: JPMORGAN CHASE BANK, N.A., AS ADMINISTRATIVE AGENT
Reel/Frame 056997/0847 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 6, 2017
From: ZARRINI, DANIEL; REILLY, PETER; SLEEVI, MICHAEL FAUGHAN
To: AIRMAGNET, INC.
Reel/Frame 043802/0700 →