Systems and methods for unsupervised anomaly detection using non-parametric tolerance intervals over a sliding window of t-digests

One or more non-transitory computer-readable media storing instructions, which, when executed by one or more hardware processors, cause:

• generating an approximation of a data distribution for a training dataset, wherein the training dataset includes varying values for a particular metric associated with at least one computing resource;
• training, by one or more machine learning processes based at least in part on the approximation of the data distribution for the training dataset, an anomaly detection model, wherein training the anomaly detection model includes:
• determining, based on a size of the training dataset, a first quantile probability and a second quantile probability that represent an interval for covering a prescribed proportion of values for the particular metric within a prescribed confidence level;
• updating a lower limit of the anomaly detection model using a first quantile that represents the first quantile probability in the approximation of the data distribution;
• and
• updating an upper limit of the anomaly detection model using a second quantile that represents the second quantile probability in the approximation of the data distribution;
• evaluating, using the trained anomaly detection model, a set of input data for the particular metric using the lower limit and the upper limit of the anomaly detection model to determine whether a particular computing resource is exhibiting anomalous behavior;
• and
• triggering one or more responsive actions directed to addressing the anomalous behavior of the particular computing resource responsive, at least in part, to determining that the particular computing resource is exhibiting anomalous behavior.

A system comprising:

• one or more hardware processors;
• one or more non-transitory computer-readable media storing instructions, which, when executed by the one or more hardware processors, cause:
• generating an approximation of a data distribution for a training dataset, wherein the training dataset includes varying values for a particular metric associated with at least one computing resource;
• training, by one or more machine learning processes based at least in part on the approximation of the data distribution for the training dataset, an anomaly detection model, wherein training the anomaly detection model includes:
• determining, based on a size of the training dataset, a first quantile probability and a second quantile probability that represent an interval for covering a prescribed proportion of values for the particular metric within a prescribed confidence level;
• updating a lower limit of the anomaly detection model using a first quantile that represents the first quantile probability in the approximation of the data distribution;
• and
• updating an upper limit of the anomaly detection model using a second quantile that represents the second quantile probability in the approximation of the data distribution;
• evaluating, using the trained anomaly detection model, a set of input data for the particular metric using the lower limit and the upper limit of the anomaly detection model to determine whether a particular computing resource is exhibiting anomalous behavior;
• and
• triggering one or more responsive actions directed to addressing the anomalous behavior of the particular computing resource responsive, at least in part, to determining that the particular computing resource is exhibiting anomalous behavior.