US 10,855,712 B2 · Detection of anomalies in a time series using values of a different time series

Abstract

In some implementations, sequences of time series values determined from machine data are obtained. Each sequence corresponds to a respective time series. A plurality of predictive models is generated for a first time series from the sequences of time series values. Each predictive model is to generate predicted values associated with the first time series using values of a second time series. For each of the plurality of predictive models, an error is determined between the corresponding predicted values and values associated with the first time series. A predictive model is selected for anomaly detection based on the determined error of the predictive model. Transmission is caused of an indication of an anomaly detected using the selected predictive model.

Claims30

Dependent claims

A computer-implemented method comprising:

obtaining sequences of time series values determined from raw machine data, each sequence corresponding to a respective time series, wherein the raw machine data is produced by one or more components within an information technology or security environment and reflects activity within the information technology or security environment;
identifying a predictive model for a first time series based on the sequences of time series values, the predictive model trained over a training period to generate predicted values associated with the first time series using time series values corresponding to a second time series;
evaluating one or more characteristics of the predictive model;
and
selecting the predictive model for anomaly detection based on the evaluating of the one or more characteristics.

2 more elements

Dependencies are inferred from the claim text.

Detection of anomalies in a time series using values of a different time series

Life of this patent

Detection of anomalies in a time series using values of a different time series

Life of this patent

Abstract

Claims30