Predictive anomaly detection framework

A server computer comprising:

• a processor;
• and
• a computer-readable medium coupled to the processor, the computer-readable medium including code executable by the processor for performing:
• receiving a data value of a data stream that is associated with one or more client computers, the data stream providing a series of data values over time, the series of data values comprising the data value and one or more historical data values that were received in the data stream prior to the data value, wherein the data value corresponds to a time interval and each of the one or more historical data values corresponds to a historical time interval;
• selecting a plurality of models based on the time interval associated with the data value, wherein each of the plurality of models has a different periodicity;
• for each model of the plurality of models, generating a score of a plurality of scores based on the model, wherein generating the score comprises:
• predicting a prediction value based on the model, wherein predicting the prediction value comprises feeding, to the model, one or more matching historical data values that match a periodicity of the model;
• and
• generating the score based on the prediction value and the data value;
• generating a final score based on the plurality of scores generated from each of the plurality of models;
• generating a score threshold based on the one or more historical data values;
• determining whether the final score exceeds the score threshold;
• and
• responsive to determining that the final score exceeds the score threshold, generating a notification that indicates that the data value is an anomaly.

A non-transitory computer-readable storage medium including code executable by one or more processors for performing

• receiving, by a server computer, a data value of a data stream that is associated with one or more client computers, the data stream providing a series of data values over time, the series of data values comprising the data value and one or more historical data values that were received in the data stream prior to the data value, wherein the data value corresponds to a time interval and each of the one or more historical data values corresponds to a historical time interval;
• selecting, by the server computer, a plurality of models based on the time interval associated with the data value, wherein each of the plurality of models has a different periodicity;
• for each model of the plurality of models, generating, by the server computer, a score of a plurality of scores based on the model, wherein generating the score comprises:
• predicting, by the server computer, a prediction value based on the model, wherein predicting the prediction value comprises feeding, to the model, one or more matching historical data values that match a periodicity of the model;
• and
• generating, by the server computer, the score based on the prediction value and the data value;
• generating, by the server computer, a final score based on the plurality of scores generated from each of the plurality of models;
• generating, by the server computer, a score threshold based on the one or more historical data values;
• determining, by the server computer, whether the final score exceeds the score threshold;
• and
• responsive to determining that the final score exceeds the score threshold, generating, by the server computer, a notification that indicates that the data value is an anomaly.