Systems, apparatuses, and methods for anomaly detection

1. A computer-implemented method comprising:

receiving, at an anomaly detection service in a multi-tenant provider network, a request to monitor for anomalies from one or more data sources;

analyzing, by an anomaly detection component of the anomaly detection service, time-series data from the one or more data sources by:

ingesting the time-series data from the one or more data sources, wherein the time-series data is time-stamped and has at least one value, and

determining there is an anomaly in the time-series data using at least one distributional time series model by:

dividing a domain space into a plurality of bins using an approximation,

predicting a probability of a value being in one of the plurality of bins using a recurrent neural network, and

performing anomaly detection using the probability and the bins;

generating, by a findings detection service of the anomaly detection service, a recommendation for handling the anomaly, the recommendation generated by performing one or more of a root cause analysis, a heuristic analysis, and an incident similarity analysis; and

reporting, by a findings service in the multi-tenant provider network, the anomaly and the recommendation to a user.

2. The computer-implemented method of claim 1 , wherein the time-series data includes at least one of log data, metric data, event data, and configuration data.

3. The computer-implemented method of claim 1 , wherein the ingesting comprises:

pre-processing the received data to put it in a form for the at least one distributional time series model;

storing the pre-processed data; and

storing the received data in a raw form.

4. A computer-implemented method comprising:

receiving, at an anomaly detection service in a multi-tenant provider network, a request to monitor for anomalies from one or more data sources;

ingesting, by the anomaly detection service, time-series data from the one or more data sources;

determining, by the anomaly detection service, there is an anomaly in the time-series data using at least one distributional time series model by:

dividing a domain space into a plurality of bins using an approximation,

predicting a probability of a value of the time-series data being in one of the plurality of bins using a recurrent neural network, and

performing anomaly detection using the probability and the bins;

generating, by the anomaly detection service, a recommendation for handling the anomaly, the recommendation generated by performing one or more of a root cause analysis, a heuristic analysis, and an incident similarity analysis; and

reporting, by a findings service in the multi-tenant provider network, the anomaly and the recommendation.

5. The computer-implemented method of claim 4 , wherein the analyzing time-series data from the one or more data sources comprises performing one or more of:

single metric anomaly detection on an individual log or metric;

long-term anomaly detection to predict anomalies that have not yet occurred; and

an odd-one-out detection to determine resources that have inconsistent use compared to similar resources.

6. The computer-implemented method of claim 4 , wherein the time-series data includes at least one of log data, metric data, event data, and configuration data.

7. The computer-implemented method of claim 4 , wherein the recommendation includes contextual information about the anomaly and a suggested action.

8. The computer-implemented method of claim 4 , wherein the ingesting comprises:

pre-processing the received data to perform one or more of extracting relevant data, aggregating relevant data, and seasonality evaluation;

storing the pre-processed data; and

storing the received data in a raw form.

9. The computer-implemented method of claim 4 , wherein reporting the anomaly and the recommendation comprises sending the anomaly and the recommendation using a notification channel as indicated by the request.

10. The computer-implemented method of claim 4 , further comprising:

storing the anomaly and recommendation for later querying.

11. The computer-implemented method of claim 4 , wherein the request is received via an external interface that allows for configuration of the ingestion of the time-series data, the analyzing of the ingested time-series data, and the generating of the recommendation.

12. The computer-implemented method of claim 4 , wherein models to be used in the analyzing of the time-series data from the one or more data sources are stored in a model repository and the models are adjustable based on user feedback.

13. A system comprising:

one or more electronic devices implementing an anomaly detection service in a multi-tenant provider network, the anomaly detection service including instructions that upon execution by one or more processors cause the anomaly detection service to:

receive a request to monitor for anomalies from one or more of the plurality of services;

ingest time-series data from the one or more data sources;

determine there is an anomaly in the time-series data using at least one distributional time series model by:

dividing a domain space into a plurality of bins using an approximation,

predicting a probability of a value of the time-series data being in one of the plurality of bins using a recurrent neural network, and

performing anomaly detection using the probability and the bins;

generate, by a findings detection service of the anomaly detection service, a recommendation for handling the determined anomaly, the recommendation generated by performing one or more of a root cause analysis, a heuristic analysis, and an incident similarity analysis; and

report, by a findings service in the multi-tenant provider network, the anomaly and recommendation.

14. The system of claim 13 , wherein to analyze time-series data from the one or more data sources comprises performing one or more of:

single metric anomaly detection on an individual log or metric;

long-term anomaly detection to predict anomalies that have not yet occurred; and

an odd-one-out detection to determine resources that have inconsistent use compared to similar resources.

15. The system of claim 13 , wherein the time-series data includes at least one of log data, metric data, event data, and configuration data.

16. The system of claim 13 , wherein the recommendation includes contextual information about the anomaly and a suggested action.

17. The system of claim 13 , wherein to report the anomaly and recommendation comprises to send the anomaly and recommendation using a notification channel as indicated by the received request.

18. The system of claim 13 , wherein the ingesting time-series data from the one or more data sources comprises:

pre-processing the received data to perform one or more of extracting relevant data, aggregating relevant data, and seasonality evaluation;

storing the pre-processed data; and

storing the received data in a raw form.

19. The system of claim 13 , wherein reporting the anomaly and the recommendation comprises sending the anomaly and the recommendation using a notification channel as indicated by the request.

20. The system of claim 13 , wherein the request is received via an external interface that allows for configuration of the ingestion of the time-series data, the analyzing of the ingested time-series data, and the generating of the recommendation.