# US 11,442,941 B2 · Auto tuning data anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,442,941 B2 - Document ID: US11442941B2 - Status: Granted - Kind: B2 - Application number: 16/709,715 - Filed: 2019-12-10 - Published: 2020-04-16 - Granted: 2022-09-13 - Earliest claimed: 2016-06-23 - Assignees: AirWatch LLC - Applicants: AirWatch LLC - Inventors: Ravishankar Chamarajnagar - Web page: https://patentgrep.com/patent/US11442941B2 ## CPC - G06F 16/24568: {Data stream processing; Continuous queries} - G06F 7/20: Comparing separate sets of record carriers arranged in the same sequence to determine whether at least some of the data in one set is identical with that in the other set or sets - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 16/2465: {Query processing support for facilitating data mining operations in structured databases} - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Automatic tuning anomaly detection is described. The context metric keys are established during a training phase based on the surrounding context of data received from devices over time. Anomaly and tuning windows are also established for metric ranges of the context metric keys. After the training phase, incoming data is correlated against the keys to identify sets of the data associated with certain context metric keys. For any given context metric key, metric data values in the associated set of data fall either within or outside the metric range of the context metric key. If they fall outside the range for longer than the anomaly window, an alarm is raised. If they fall outside the range for longer than the tuning window, boundaries for the metric range are updated. Additionally, the contextual parameters of the context metric keys are also updated over time, as new data contexts appear. ## Claims ### Claim 1 A non-transitory computer-readable medium embodying program code for data anomaly detection, the program code, when executed by at least one computing device, being configured to cause the at least one computing device to at least: receive data from a plurality of devices over time; establish a set of context parameter symbols of a context metric key based on a set of context parameters of the data; establish a metric range for the context metric key based at least in part on a highest metric data value and a lowest metric data value from at least a portion of the data that correlates with the set of context parameters of the data; set a window for evaluation of the data using the context metric key; identify a set of the data that correlates with the context parameter symbols of the context metric key; examine the set of the data with reference to the metric range and the window; and raise an alert in response to a plurality of metric data values in the set of the data falling outside the metric range of the context metric key for a period of time greater than the window. ### Claim 2 (depends on 1) The non-transitory computer-readable medium according to claim 1, wherein: the window for evaluation of the data comprises an anomaly window; and the program code is further configured to cause the at least one computing device to at least: determine that the plurality of metric data values in the set of the data fall outside the metric range of the context metric key for a period of time greater than the anomaly window; and raise the alert. ### Claim 3 (depends on 1) The non-transitory computer-readable medium according to claim 1, wherein: the window for evaluation of the data comprises a tuning window; and the program code is further configured to cause the at least one computing device to at least: determine that the plurality of metric data values in the data fall outside the metric range of the context metric key for a period of time greater than the tuning window; and update at least one boundary of the metric range for the context metric key. ### Claim 4 (depends on 1) The non-transitory computer-readable medium according to claim 1, wherein the program code is further configured to cause the at least one computing device to at least determine a high boundary and a low boundary of the metric range for the context metric key. ### Claim 5 (depends on 1) The non-transitory computer-readable medium according to claim 1, wherein the data is organized into a plurality of data tuples, and individual ones of the plurality of data tuples comprise at least one context data element and at least one metric data element. ### Claim 6 (depends on 5) The non-transitory computer-readable medium according to claim 5, wherein the at least one context data element is associated with at least one of a location the data was received from, a time of day the data was received, or a type of device the data was received from. ### Claim 7 (depends on 5) The non-transitory computer-readable medium according to claim 5, wherein, to establish the context metric key, the program code is further configured to cause the at least one computing device to at least determine at least one context parameter symbol among the set of context parameter symbols of the context metric key based on the at least one context data element. ### Claim 8 (depends on 5) The non-transitory computer-readable medium according to claim 5, wherein the program code is further configured to cause the at least one computing device to at least establish the metric range for the context metric key based on the at least one metric data element. ### Claim 9 (depends on 1) The non-transitory computer-readable medium according to claim 1, wherein the program code is further configured to cause the at least one computing device to at least conduct a training phase over a period of time based on the data. ### Claim 10 A method for data anomaly detection, comprising: receiving, by at least one computing device, data from a plurality of devices over time; establishing, by the at least one computing device, a set of context parameter symbols of a context metric key based on a set of context parameters of the data; establishing, by the at least one computing device, a metric range for the context metric key based at least in part on a highest metric data value and a lowest metric data value from at least a portion of the data that correlates with the set of context parameters of the data; setting, by the at least one computing device, a window for evaluation of the data using the context metric key; identify a set of the data that correlates with the context parameter symbols of the context metric key; examining, by the at least one computing device, the set of the data with reference to the metric range and the window; and raise an alert in response to a plurality of metric data values in the set of the data falling outside the metric range of the context metric key for a period of time greater than the window. ### Claim 11 (depends on 10) The method of claim 10, wherein: the window for evaluation of the data comprises an anomaly window; and the method further comprises: determining, by the at least one computing device, that the plurality of metric data values in the set of the data fall outside the metric range of the context metric key for a period of time greater than the anomaly window; and raising the alert. ### Claim 12 (depends on 10) The method of claim 10, wherein: the window for evaluation of the data comprises a tuning window; and the method further comprises: determining, by the at least one computing device, that the plurality of metric data values in the data fall outside the metric range of the context metric key for a period of time greater than the tuning window; and updating at least one boundary of the metric range for the context metric key. ### Claim 13 (depends on 10) The method of claim 10, further comprising determining, by the at least one computing device, a high boundary and a low boundary of the metric range for the context metric key. ### Claim 14 (depends on 10) The method of claim 10, wherein the data is organized into a plurality of data tuples, and individual ones of the plurality of data tuples comprise at least one context data element and at least one metric data element. ### Claim 15 (depends on 14) The method of claim 14, wherein the at least one context data element is associated with at least one of a location the data was received from, a time of day the data was received, or a type of device the data was received from. ### Claim 16 (depends on 14) The method of claim 14, wherein establishing the context metric key comprises determining, by the at least one computing device, at least one context parameter symbol among the set of context parameter symbols of the context metric key based on the at least one context data element. ### Claim 17 A system for data anomaly detection, comprising: a memory device to store program code for data anomaly detection; and at least one computing device configured, through execution of the program code, to at least: establish a set of context parameter symbols of a context metric key based on a set of context parameters of data; establish a metric range for the context metric key based at least in part on a highest metric data value and a lowest metric data value from at least a portion of the data that correlates with the set of context parameters of the data; set a window for evaluation of the data using the context metric key; examine the set of the data with reference to the metric range and the window; and raise an alert in response to a plurality of metric data values in the set of the data falling outside the metric range of the context metric key for a period of time greater than the window. ### Claim 18 (depends on 17) The system according to claim 17, wherein: the window for evaluation of the data comprises an anomaly window; and the at least one computing device is further configured, through execution of the program code, to at least: determine that the plurality of metric data values in the set of the data fall outside the metric range of the context metric key for a period of time greater than the anomaly window; and raise the alert. ### Claim 19 (depends on 17) The system according to claim 17, wherein: the window for evaluation of the data comprises a tuning window; and the at least one computing device is further configured, through execution of the program code, to at least: determine that the plurality of metric data values in the data fall outside the metric range of the context metric key for a period of time greater than the tuning window; and update at least one boundary of the metric range for the context metric key. ### Claim 20 (depends on 17) The system according to claim 17, wherein the program code is further configured to cause the at least one computing device to at least determine a high boundary and a low boundary of the metric range for the context metric key.