Signed bi-directional anomaly neighborhood algorithm
Aspects of the present disclosure relate to systems and protocols for detecting anomalies in time series data. Embodiments include comparing the value for a data item to values for a neighborhood of data items from before the data item in the time series and values for a neighborhood of data items from after the data item in the time series. Based on the comparisons, an anomaly may be detected using an anomaly detection algorithm. Furthermore, the anomaly detection protocol may be integrated into computing systems to detect anomalous activity and performance metrics. Based on the detected anomalies, remedial actions may be performed with respect to the computing systems.
1 . A system, comprising:
one or more processors; and
a memory comprising instructions that, when executed by the one or more processors, cause the system to:
receive time series data comprising a set of data items, each data item of the set of data items comprising a respective distance in an embedding space between an embedding representation of a respective input provided to a generative machine learning model and an embedding representation of a respective output generated by the generative machine learning model based on the respective input, wherein a given data item of the time series data has a first neighborhood of data items from earlier in the time series data than the given data item and a second neighborhood of data items from later in the time series data than the given data item;
determine a first score for the given data item based on comparing a value for the given data item to a third quartile value and a first quartile value for the first neighborhood;
determine a second score for the given data item based on comparing a value for the given data item to a third quartile value and a first quartile value for the second neighborhood;
detect that the given data item is anomalous based on a third score that is determined based on the first score and the second score; and
retrain the generative machine learning model based on detecting that the given data item is anomalous.
2 . The system of claim 1 , wherein determining the first score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the first neighborhood by a threshold amount or determining that the first quartile value for the first neighborhood exceeds the value for the given data item by the threshold amount.
3 . The system of claim 1 , wherein determining the second score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the second neighborhood by a threshold amount or determining that the first quartile value for the second neighborhood exceeds the value for the given data item by the threshold amount.
4 . The system of claim 3 , wherein, based on the value for the given data item exceeding the third quartile value for the second neighborhood by the threshold amount, the second score is positive.
5 . The system of claim 4 , wherein:
determining the first score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the first neighborhood by the threshold amount;
based on the value for the given data item exceeding the third quartile value for the first neighborhood by the threshold amount, the first score is positive;
the third score is based on a product of the first score and the second score; and
the given data item is detected as anomalous based on the third score being positive.
6 . A method, comprising:
receiving time series data comprising a set of data items, each data item of the set of data items comprising a respective distance in an embedding space between an embedding representation of a respective generative machine learning model output that corresponds to a use case and an embedding representation of a ground truth output that corresponds to the use case, wherein a given data item of the time series data has a first neighborhood of data items from earlier in the time series data than the given data item and a second neighborhood of data items from later in the time series data than the given data item;
determining a first score for the given data item based on comparing a value for the given data item to a third quartile value and a first quartile value for the first neighborhood;
determining a second score for the given data item based on comparing a value for the given data item to a third quartile value and a first quartile value for the second neighborhood;
detecting that the given data item is anomalous based on a third score that is determined based on the first score and the second score; and
retraining the generative machine learning model based on detecting that the given data item is anomalous.
7 . The method of claim 6 , wherein determining the first score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the first neighborhood by a threshold amount or determining that the first quartile value for the first neighborhood exceeds the value for the given data item by the threshold amount.
8 . The method of claim 6 , wherein determining the second score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the second neighborhood by a threshold amount or determining that the first quartile value for the second neighborhood exceeds the value for the given data item by the threshold amount.
9 . The method of claim 8 , wherein, based on the value for the given data item exceeding the third quartile value for the second neighborhood by the threshold amount, the second score is positive.
10 . The method of claim 9 , wherein:
determining the first score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the first neighborhood by the threshold amount;
based on the value for the given data item exceeding the third quartile value for the first neighborhood by the threshold amount, the first score is positive;
the third score is based on a product of the first score and the second score; and
the given data item is detected as anomalous based on the third score being positive.
11 . The method of claim 10 , wherein the threshold amount is determined based on a supervised learning process through which a value that most accurately detects anomalies in a labeled training data set is selected as the threshold amount.
12 . A method, comprising:
receiving time series data comprising a set of data items, each data item of the set of data items comprising performance data associated with a computing system, wherein a given data item of the time series data has a first neighborhood of data items from earlier in the time series data than the given data item and a second neighborhood of data items from later in the time series data than the given data item;
determining a first score for the given data item based on comparing a value for the given data item to a third quartile value and a first quartile value for the first neighborhood;
determining a second score for the given data item based on comparing a value for the given data item to a third quartile value and a first quartile value for the second neighborhood;
detecting that the given data item is anomalous based on a third score that is determined based on the first score and the second score; and
performing a remedial action with respect to the computing system based on detecting that the given data item is anomalous.
13 . The method of claim 12 , wherein determining the first score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the first neighborhood by a threshold amount or determining that the first quartile value for the first neighborhood exceeds the value for the given data item by the threshold amount.
14 . The method of claim 12 , wherein determining the second score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the second neighborhood by a threshold amount or determining that the first quartile value for the second neighborhood exceeds the value for the given data item by the threshold amount.
15 . The method of claim 14 , wherein, based on the value for the given data item exceeding the third quartile value for the second neighborhood by the threshold amount, the second score is positive.
16 . The method of claim 15 , wherein:
determining the first score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the first neighborhood by the threshold amount;
based on the value for the given data item exceeding the third quartile value for the first neighborhood by the threshold amount, the first score is positive;
the third score is based on a product of the first score and the second score; and
the given data item is detected as anomalous based on the third score being positive.
17 . The method of claim 16 , wherein the threshold amount is determined based on a supervised learning process through which a value that most accurately detects anomalies in a labeled training data set is selected as the threshold amount.
18 . A method, comprising:
receiving time series data comprising a set of data items, each data item of the set of data items comprising data associated with a respective network packet, wherein a given data item of the time series data has a first neighborhood of data items from earlier in the time series data than the given data item and a second neighborhood of data items from later in the time series data than the given data item;
determining a first score for the given data item based on comparing a value for the given data item to a third quartile value and a first quartile value for the first neighborhood;
determining a second score for the given data item based on comparing a value for the given data item to a third quartile value and a first quartile value for the second neighborhood;
detecting that the given data item is anomalous based on a third score that is determined based on the first score and the second score; and
blocking one or more network packets based on detecting that the given data item is anomalous.
19 . The method of claim 18 , wherein determining the first score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the first neighborhood by a threshold amount or determining that the first quartile value for the first neighborhood exceeds the value for the given data item by the threshold amount.
20 . The method of claim 18 , wherein determining the second score for the given data item comprises determining that the value for the given data item exceeds the third quartile value for the second neighborhood by a threshold amount or determining that the first quartile value for the second neighborhood exceeds the value for the given data item by the threshold amount.