Method and system for anomaly detection based on statistical closed-form isolation forest analysis

A system, comprising:

• a processor;
• and
• a memory having instructions stored thereon which, when executed by the processor, performs an operation for detecting anomalous activity in a computing system, the operation comprising:
• receiving a request to perform an action in a computing system;
• adding the request to a historical time-series data set;
• selecting a portion of the historical time-series data set to be used to determine whether the received request is an anomalous request;
• removing a set of previously identified outliers from the selected portion of the historical time-series data set;
• calculating an anomaly score for the received request based on a statistical analysis of the received request and the selected portion of the historical time-series data set, wherein the anomaly score comprises a predicted number of operations executed to isolate the received request from the selected portion of the historical time-series data set;
• and
• taking one or more actions to process the received request based on the calculated anomaly score.

A system, comprising:

• a plurality of computing resources;
• and
• a request gateway configured to:
• receive a request to perform an action on one or more of the plurality of computing resources;
• add the request to a historical time-series data set;
• select a portion of the historical time-series data set to be used to determine whether the received request is an anomalous request;
• remove a set of previously identified outliers from the selected portion of the historical time-series data set;
• calculate an anomaly score for the received request based on a statistical analysis of the received request and the selected portion of the historical time-series data set, wherein the anomaly score comprises a predicted number of operations executed to isolate the received request from the selected portion of the historical time-series data set;
• and
• take one or more actions to process the received request based on the calculated anomaly score.