Anomaly detection based on performance indicators
During operation, a computer may monitor values of at least one performance metric associated with packet communication by access points in a network. Then, the computer may compare current values of the performance metric for the access points with historical values of the performance metric for the access points within a temporal context in order to determine temporal anomaly scores for the access points. Moreover, the computer may compare the temporal anomaly scores of a group of access points in order to determine spatial temporal anomaly scores for the access points that indicate a significance of the temporal anomaly scores in a spatial context. Furthermore, when a spatial temporal anomaly score for an access point meets a detection criterion, the computer system may identify the current value of the performance metric for the access point as an anomaly. Next, the computer system may perform a remedial action based on the identified anomaly.
1. A computer, comprising:
an interface circuit configured to communicate with access points in a network;
a processor coupled to the interface circuit; and
memory, coupled to the processor, which stores program instructions that, when executed by the processor, causes the computer to:
monitor values of at least one performance metric associated with packet communication by the access points;
compare current values of the performance metric for the access points with historical values of the performance metric for the access points within a temporal context in order to determine temporal anomaly scores for the access points, wherein the temporal context comprises one of: a target time, a time interval, and a sequence of time intervals;
compare the temporal anomaly scores of a group of access points in order to determine spatial temporal anomaly scores for the access points that indicate a significance of the temporal anomaly scores in a spatial context, wherein the spatial context comprises access points that: have environments with a common characteristic, or have approximately the same response to a change in an environmental factor;
when a spatial temporal anomaly score for an access point meets a detection criterion, identify the current value of the performance metric for the access point as an anomaly; and
perform a remedial action based at least in part on the identified anomaly.
2. The computer of claim 1 , wherein the performance metric comprises one of: a received signal strength (RSSI), a throughput, and a packet error rate.
3. The computer of claim 1 , wherein the performance metric is based at least in part on a set of measurements and a statistical analysis technique.
4. The computer of claim 1 , wherein, when executed by the processor, the program instructions further causes the computer to identify, prior to comparing the temporal anomaly scores of the group of access points, the group of access points using an unsupervised learning technique.
5. The computer of claim 1 , wherein the remedial action comprises one of: providing a notification associated with the anomaly, updating firmware of the access point, rebooting the access point, and providing another type of feedback to the access point.
6. A computer, comprising:
an interface circuit configured to communicate with access points in a network;
a processor coupled to the interface circuit and
memory, coupled to the processor, which stores program instructions module that, when executed by the processor, causes the computer to:
monitor values of at least one performance metric associated with packet communication by the access points;
compare current values of the performance metric for the access points with historical values of the performance metric for the access points within a temporal context in order to determine temporal anomaly scores for the access points;
compare the temporal anomaly scores of a group of access points in order to determine spatial temporal anomaly scores for the access points that indicate a significance of the temporal anomaly scores in a spatial context
when a spatial temporal anomaly score for an access point meets a detection criterion, identify the current value of the performance metric for the access point as an anomaly; and
perform a remedial action based at least in part on the identified anomaly, wherein comparing a current value of the performance metric for a given access point with the historical values of the performance metric of the given access point comprises at least one of: computing a logarithm of a ratio of the current value of the performance metric for the given access point with the historical values of the performance metric of the access point, determining a p-value of the current value of the performance metric for the given access point based at least in part von the historical values of the performance metric of the access point, and determining a confidence interval of the current value of the performance metric for the access point based at least in part on the historical values of the performance metric of the given access point.
7. The computer of claim 1 , wherein comparing the current values of the performance metric for the access points with the historical values of the performance metric for the access points within the temporal context comprises comparing the current values of the performance metric with a repetitive variation of the historical values of the performance metric as a function of time.
8. A non-transitory computer-readable storage medium for use in conjunction with a computer, the computer-readable storage medium storing program instructions that, when executed by the computer, causes the computer to:
monitor values of at least one performance metric associated with packet communication by the access points;
compare current values of the performance metric for the access points with historical values of the performance metric for the access points within a temporal context in order to determine temporal anomaly scores for the access points, wherein the temporal context comprises one of: a target time, a time interval, and a sequence of time intervals;
compare the temporal anomaly scores of a group of access points in order to determine spatial temporal anomaly scores for the access points that indicate a significance of the temporal anomaly scores in a spatial context, wherein the spatial context comprises access points that: have environments with a common characteristic, or have approximately the same response to a change in an environmental factor;
when a spatial temporal anomaly score for an access point meets a detection criterion, identify the current value of the performance metric for the access point as an anomaly; and
perform a remedial action based at least in part on the identified anomaly.
9. The computer-readable storage medium of claim 8 , wherein the performance metric comprises one of: a received signal strength (RSSI), a throughput, and a packet error rate.
10. The computer-readable storage medium of claim 8 , wherein the performance metric is based at least in part on a set of measurements and a statistical analysis technique.
11. The computer-readable storage medium of claim 8 , wherein, when executed by the processor, the program instructions further causes the computer to identify, prior to comparing the temporal anomaly scores of the group of access points, the group of access points using an unsupervised learning technique.
12. The computer-readable storage medium of claim 8 , wherein the remedial action comprises one of: providing a notification associated with the anomaly, updating firmware of the access point, rebooting the access point, and providing another type of feedback to the access point.
13. A method for identifying an anomaly, comprising:
by a computer:
monitoring values of at least one performance metric associated with packet communication by the access points;
comparing current values of the performance metric for the access points with historical values of the performance metric for the access points within a temporal context in order to determine temporal anomaly scores for the access points, wherein the temporal context comprises one of: a target time, a time interval, and a sequence of time intervals;
comparing the temporal anomaly scores of a group of access points in order to determine spatial temporal anomaly scores for the access points that indicate a significance of the temporal anomaly scores in a spatial context, wherein the spatial context comprises access points that: have environments with a common characteristic, or have approximately the same response to a change in an environmental factor;
when a spatial temporal anomaly score for an access point meets a detection criterion, identifying the current value of the performance metric for the access point as an anomaly; and
performing a remedial action based at least in part on the identified anomaly.
14. The method of claim 13 , wherein the temporal context comprises one of: a target time, a time interval, and a sequence of time intervals.
15. The method of claim 13 , wherein the group of access points comprises access points that: have environments with a common characteristic, are geographically proximate to each other, or have approximately the same response to a change in an environmental factor.
16. The method of claim 13 , wherein the remedial action comprises one of: providing a notification associated with the anomaly, updating firmware of the access point, rebooting the access point, and providing another type of feedback to the access point.
17. The method of claim 13 , wherein the method comprises identifying, prior to comparing the temporal anomaly scores of the group of access points, the group of access points using an unsupervised learning technique.
18. The method of claim 13 , wherein the remedial action comprises one of: providing a notification associated with the anomaly, updating firmware of the access point, rebooting the access point, and providing another type of feedback to the access point.
19. The method of claim 13 , wherein comparing a current value of the performance metric for a given access point with the historical values of the performance metric of the given access point comprises at least one of: computing a logarithm of a ratio of the current value of the performance metric for the given access point with the historical values of the performance metric of the access point, determining a p-value of the current value of the performance metric for the given access point based at least in part von the historical values of the performance metric of the access point, and determining a confidence interval of the current value of the performance metric for the access point based at least in part on the historical values of the performance metric of the given access point.
20. The computer-readable storage medium of claim 8 , wherein comparing a current value of the performance metric for a given access point with the historical values of the performance metric of the given access point comprises at least one of: computing a logarithm of a ratio of the current value of the performance metric for the given access point with the historical values of the performance metric of the access point, determining a p-value of the current value of the performance metric for the given access point based at least in part von the historical values of the performance metric of the access point, and determining a confidence interval of the current value of the performance metric for the access point based at least in part on the historical values of the performance metric of the given access point.